GNS3 VT-x not available on Windows: how to fix it

You start the GNS3 VM on Windows and VirtualBox stops with VT-x is not available (VERR_VMX_NO_VMX) (AMD-V is not available (VERR_SVM_NO_SVM) on AMD), or VMware says Virtualized Intel VT-x/EPT is not supported on this platform. Something else on the computer holds the CPU's virtualization extensions, usually the Windows hypervisor started by Hyper-V or Memory integrity, or they are turned off in the BIOS.

Why it happens

The GNS3 VM runs your routers and switches with KVM inside a VM. That is nested virtualization: VMware or VirtualBox must get VT-x (Intel) or AMD-V (AMD) from the CPU and pass it on to the GNS3 VM.

Only one hypervisor can own those extensions. Microsoft says so plainly in this support article: VMware and VirtualBox "can't run alongside Hyper-V, Memory Integrity, or Credential Guard". Memory integrity and Credential Guard are parts of virtualization-based security (VBS), and VBS runs on the Windows hypervisor. Several other features start the same hypervisor:

• Hyper-V
• Virtual Machine Platform, which WSL 2 needs
• Windows Hypervisor Platform
• Windows Sandbox
• Memory integrity (also called HVCI or Core isolation) and Credential Guard

When the Windows hypervisor runs, recent VMware and VirtualBox versions can still start VMs on top of it, but they can't pass VT-x to the GNS3 VM. You then get one of the errors above, or a GNS3 VM that boots but shows KVM support available: False (see that post). Other messages you may see:

• Virtualized AMD-V/RVI is not supported on this platform.
• VMware Workstation does not support nested virtualization on this host.
• Cannot enable nested VT-x/AMD-V without nested-paging and unrestricted guest execution! with (VERR_CPUM_INVALID_HWVIRT_CONFIG), which a user fixed with the bcdedit step below (gns3-gui issue #3032).

Fix it

1. Find what holds VT-x

Press Win+R, run msinfo32 and scroll to the bottom of System Summary.

• If you see A hypervisor has been detected. Features required for Hyper-V will not be displayed., the Windows hypervisor is running. Go to steps 3 and 4.
• If you see four Hyper-V - lines instead, no hypervisor runs. Look at Hyper-V - Virtualization Enabled in Firmware. If it says No, go to step 2.
• Virtualization-based security shows whether VBS is running, and which services (Credential Guard, Hypervisor enforced Code Integrity) are on.

You can read the same VBS state in an elevated PowerShell, as the Memory integrity documentation shows. A VirtualizationBasedSecurityStatus of 2 means VBS is running, 0 means it is off.

Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
  Select-Object VirtualizationBasedSecurityStatus, SecurityServicesRunning

2. Enable virtualization in the BIOS/UEFI

Restart into the firmware setup. The option is usually called Intel Virtualization Technology (VT-x) or SVM Mode on AMD, under a CPU, Advanced or Security menu. The GNS3 Windows install guide lists it as a requirement. Save, boot, and check msinfo32 again.

3. Turn off Memory integrity

1. Open Windows Security > Device security > Core isolation details.
2. Turn Memory integrity off.
3. Restart.

If the switch is greyed out with This setting is managed by your administrator, a policy sets it. On a work computer, ask your IT team. Credential Guard is also set by policy; Microsoft's article links to the steps to configure it.

4. Turn off Hyper-V and the hypervisor

Open an administrator PowerShell. First, list the features that start the hypervisor:

Get-WindowsOptionalFeature -Online |
  Where-Object { $_.State -eq 'Enabled' -and $_.FeatureName -match 'Hyper-V|VirtualMachinePlatform|HypervisorPlatform|DisposableClientVM' } |
  Select-Object FeatureName

Disable the ones you don't need. Microsoft gives the first command; the others follow the same pattern:

Disable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-Hypervisor
Disable-WindowsOptionalFeature -Online -FeatureName VirtualMachinePlatform
Disable-WindowsOptionalFeature -Online -FeatureName HypervisorPlatform

Then tell Windows not to load the hypervisor at boot, and restart:

bcdedit /set hypervisorlaunchtype off

To undo it later, run bcdedit /set hypervisorlaunchtype auto and restart. Be aware of the cost: with the hypervisor off, WSL 2, Docker Desktop and Windows Sandbox stop working.

5. Start the GNS3 VM

GNS3 turns on nested virtualization for the GNS3 VM itself. On VMware it adds vhv.enable = "TRUE" to the VM's VMX file if the key isn't there yet. On VirtualBox it runs VBoxManage modifyvm <vm> --nested-hw-virt on. You don't need to tick anything by hand. On VirtualBox, GNS3 requires version 6.1 or later on Intel and 6.0 or later on AMD.

How to check it worked

1. Run msinfo32 again. The hypervisor line should be gone and Hyper-V - Virtualization Enabled in Firmware should say Yes.
2. Start GNS3. The GNS3 VM should boot without the VT-x error.
3. The GNS3 VM console should show KVM support available: True.

If it still fails

• You must keep Hyper-V or VBS. Run the GNS3 VM on Hyper-V instead. In **Edit > Preferences

  GNS3 VM**, pick Hyper-V as the virtualization engine and import the Hyper-V build of the GNS3 VM (GNS3.VM.Hyper-V.<version>.zip on the GNS3 releases page). GNS3 checks for Windows 10 build 14393 or later, and for AMD CPUs build 19640 or later. If it says The Windows account running GNS3 does not have the required permissions for Hyper-V, add your account to the Hyper-V Administrators group.

• GNS3 itself refuses to start a node with Cannot start VM because hardware virtualization (VT-x/AMD-V) is already used by another software like VMware or KVM (on Linux). This is GNS3's own check, raised when a project already runs nodes from another hypervisor. Since 2.2.44 you can turn it off in gns3_server.ini:

[Server]
hardware_virtualization_check = False

• Very old CPU. Nested VT-x in VMware needs EPT. Some older Intel CPUs, such as the Core 2 Quad Q9400 in gns3-server issue #1538, have VT-x without EPT and can't run the GNS3 VM with KVM at all.

The GNS3 troubleshooting guide lists the other common GNS3 VM problems.

Or skip the hypervisor

If your lab is mostly Linux hosts and services, you can avoid nested virtualization altogether. Isothrum's editor is free, runs in your browser with no account, and exports a lab of containers as Docker Compose. A lab of containers needs no GNS3 VM and no nested virtualization. On Windows, Docker Desktop runs on WSL 2, so it works with Hyper-V and Memory integrity left on. Routers such as Cisco IOSv still need KVM, so for those the fix above still applies.