Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

Microsoft network load balancing guidelines and limitations

Updated: April 17, 2026

Want to summarize with AI?

Describes the operational requirements and constraints for deploying Microsoft network load balancing within the fabric. These guidelines ensure proper traffic handling and configuration compatibility for virtualized server environments.

Provides essential configuration rules and support limitations for Microsoft network load balancing (NLB) to ensure successful integration with the network fabric.

The following guidelines and limitations apply to Microsoft network load balancing (NLB) configurations:

In a bridge domain's Policy > Advanced/Troubleshooting properties, you must disable the Drop ARP with Multicast SMAC knob if the Microsoft NLB VIP address is configured under any EPG in that bridge domain.
Microsoft NLB is not supported when a bridge domain's multi-destination flooding is set to drop .
For an existing bridge domain that is created before the upgrade, Drop ARP with Multicast SMAC knob is disabled by default. For bridge domains created after the upgrade, this knob is enabled by default. If you create a bridge domain for the Microsoft NLB after the upgrade you must disable this knob for Microsoft NLB to work.
Layer 3 multicast is not supported (you cannot enable PIM on the Microsoft NLB bridge domain).
For IGMP, the allowable mode group is IPv4 (IPv6 is not supported).
Only Cisco Nexus 9000 series switches with names that end in EX and later are supported.
Shared services and microsegment (uSeg) EPGs are supported with Microsoft NLB.
Cisco ACI Multi-Site is currently not supported.
You must configure Microsoft NLB in layer 2 unknown unicast flooding mode.
You should configure Microsoft NLB bridge domain with the default SVI MAC address. Under layer 3 configurations, you should configure the bridge domain MAC address with the default setting of 00:22:BD:F8:19:FF. Do not modify this default SVI MAC address for the Microsoft NLB bridge domain.
There is a hardware limit of 128 Microsoft NLB VIPs per fabric.
Virtualized servers that are configured for Microsoft NLB can connect to Cisco ACI with static binding in all modes (unicast, multicast, and IGMP).
Virtualized servers that are configured for Microsoft NLB can connect to Cisco ACI through VMM integration in unicast mode and IGMP mode.
Microsoft NLB unicast mode is not supported with VMM integration behind Cisco UCS B-Series Blade Servers in end-host mode.

If you configure the bridge domain for hardware-proxy instead, Cisco ACI raises a fault, which is cleared by fixing the bridge domain configuration. If you leave the bridge domain incorrectly configured for hardware-proxy, ACI tries to get the faulty configuration up every 30 seconds, which is an unnecessary overhead for the switch.

Microsoft NLB in unicast mode relies on unknown unicast flooding for delivery of cluster-bound packets. Unicast mode will not work on Cisco UCS B-Series Blade Servers when the fabric interconnect is in end-host mode, because unknown unicast frames are not flooded as required by this mode. For more details on the layer 2 forwarding behavior of Cisco UCS B-Series Blade Servers in end-host mode, see: https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/unified-computing/whitepaper_c11-701962.html

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.