Unicast NLB and distributed routing and switching

[thomas.wendler]

Hi,

I was wondering if the following scenario would work:

2 Microsoft TMG servers (could be any W2K8 R2 based server, e.g. UAG, Exchange etc.) configured for Unicast NLB. The servers are connected to separate L2 switches which are connected to a highly available central L3 switch (see attached drawing).

Unicast NLB works in such a way that it uses a shared virtual IP and a virtual MAC addres which is not used as  Source MAC address when the TMG servers are respondign to requests. Basically it relies onto the fact that the switch does not learn the virtual MAC address and floods all packets destined to the virtual MAC on all ports. The L3 switch would learn the MAC through ARP. The question now is, what the L3 switch would do, if it receives a packet destined for the NLB VIP. It should do an ARP request in order to receive the virtual MAC. How would he decide on which port(s) to forward the packet as he does not know on which port the MAC is found. Can he make a decision based on Layer 3 (IP/VLAN based) therefore he knows that the VLAN for the TMGs is connected on those two uplink ports?

Best regards

Thomas

[Olivier Jessel]

Hi,

I would recommend you to read this :

http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_example09186a0080a07203.shtml

But basically, the best way is to buy an hardware Load balancer or to statically configure the Virtual Mac Adress on Catalyst. (don't forget the the trunk ports. NLB should run in multicalt mode for this setup).

HTH

Regards,

Olivier

[thomas.wendler]

Hi Olivier,

well, Multicast should work in any case. I want understand if unicast will work too in such a scenario (two access switches connected to the core). So the main thing I want to understand on which criteria the L3 core switch will forward the packets destined to the virtual MAC address for the VIP.

Best regards

Thomas

[Olivier Jessel]

The Core switch will use L3 Unicast IP address (VIP) but get a mulsticast MAC Adress from the ARP request.

If you configure NLB with unicast mode, you can't configure static ARP entries with more than one port on the Cisco switch, and so you can not forward your packets through other ports...

With NLB in Multicast mode, you get a Multicast Cluster MAC adress. Then you can configure a static ARP entry on your Catalyst but you can also specify more than one outgoing interface... That's the key ! ;-)

[thomas.wendler]

Hi Olivier,

but do I need to specify a static ARP entry? ARP resolution should work with Unicast NLB because the MAC address is a unicast MAC address.

Best regards

Thomas

[Olivier Jessel · Accepted solution]

If you configure NLB in Unicast mode, you will get flapping error in Catalyst logs, because the virtual MAC address will be seen once on port#1, then port#2, then port#1 and so on....

I have always configured NLB in multicast mode (multicast is only used with MAC adress in this case, you can't configure a multicast IP address for the VIP... Microsoft made here a mistake...)

Then you can configure in catalyst an ARP entry like:

static arp 0000.0e00.1111 gi0/1 Gi0/2 Po1 ...

(command line is not the exact syntax)

Every traffic destinated to  0000.0e00.1111  will be switched to ports gi0/1 Gi0/2 Po1 and so on...

(With a unicast Mac address, you can ONLY specify ONE port.)

No more flooding, or flapping.

Well that's how I installed TMG, or MS clusters...

HTH

Olivier

[thomas.wendler]

Hi Olivier,

thanks. That was exactly the explanation I was looking for.

Cheers

Thomas

[Olivier Jessel]

Great, You're welcome ;-)

Have a nice day !!

Cheers,

Olivier