Windows Server 2025 The Network Metrics That Really Matter

Welcome to part four of our Networking Deployment Series for Windows Server 2025! In this series, we’ve been following Contoso Medical Center’s journey to deploy Windows Server 2025 Software Defined Datacenter (SDDC) for a modern, secure, and automated environment. 

Thus far, Contoso has accomplished the following: 

• Part 1: Laid the foundation with consistent, automated host networking using Network ATC
• Part 2: Introduced proactive diagnostics and monitoring with Network HUD
• Part 3: Deployed Network Controller on Failover Cluster for a resilient SDN control plane 

With the SDN “brains” now in place, Contoso is ready for the next step: securing every workload from day one with microsegmentation, automated security policies, and a Zero Trust approach. 

From Reactive to Proactive: Securing Every VM by Default 

As Contoso rapidly expands and adopts cutting-edge technologies to enhance patient care and operational efficiency, securing virtual workloads has become their top priority. Historically, they relied on manual firewall rules and static ACLs to protect virtual workloads. However, this reactive approach left gaps—new VMs could be deployed without the proper security policies, and enforcement often varied from host to host, increasing risk of human error. 

With Windows Server 2025, Contoso can shift from reactive security to proactive, automated protection. SDN enables Contoso to secure every VM with microsegmentation, enforcing granular, VM-level network policies so that workloads only communicate when necessary. This approach is central to Zero Trust principles, treating every access request as potentially risky and requiring verification before granting permission. SDN microsegmentation leverages several key technologies: 

• Network Security Groups (NSGs): Every VM is automatically assigned an NSG at creation, providing immediate, distributed firewall protection for both north-south and east-west traffic.
• Tag-Based Segmentation: Security policies are assigned based on workload identity, allowing rules to follow VMs as they move or scale rather than relying on static IPs.
• Default Network Policies: Every VM receives baseline protection from the moment it’s created, even before the operating system is deployed, ensuring no workload is ever left exposed.  

For a healthcare provider like Contoso where patient data and critical applications must be protected at all times, these SDN security capabilities in Windows Server 2025 deliver the automation, consistency, and compliance needed to confidently support rapid growth, safeguard patient data, and protect critical applications from day one. 

What Are NSGs, Tag-Based Segmentation, and DNP? 

Network Security Groups (NSGs) 

An NSG is a 5-tuple firewall (source IP, destination IP, source port, destination port, protocol) that protects both north-south and east-west flows. NSGs can be applied to individual VMs or subnets, and because they’re enforced at the vSwitch, they scale without bottlenecks. 

Key Advantages: 

• Granular control: block lateral traffic between workloads in the same VLAN or subnet
• Multitenancy: policies can be unique per VM even if IP addresses overlap
• Visibility: audit logging of all processed flows for compliance