Microsoft NLB

This chapter contains the following sections:

Microsoft NLB

Microsoft Network Load Balancing (NLB) is a load-balancing feature that

  • distributes client traffic across many servers, with each server running its individual copy of the application

  • uses Layer 2 unknown unicast or multicast to simultaneously distribute incoming network traffic to all cluster hosts, and

  • operates as a group of nodes collectively known as an NLB cluster that serves one or more virtual IP (VIP) addresses.

Microsoft NLB operational modes

Nodes in the NLB cluster use a load-balancing algorithm to decide which individual node will service the particular traffic flow that is destined for the NLB VIP. Every node within the cluster receives every packet of traffic, but only one node services a request.

Microsoft NLB functions in three different operational modes:

  • Unicast Mode: In this mode, each NLB cluster VIP is assigned a unicast MAC address. This mode relies on unknown unicast flooding to deliver traffic to the cluster.

  • Multicast Mode: In this mode, each NLB cluster VIP is assigned a non-Internet Assigned Numbers Authority (IANA) multicast MAC address (03xx.xxxx.xxxx).

  • IGMP Mode: In this mode, an NLB cluster VIP is assigned a unique IPv4 multicast group address. The multicast MAC address for this is derived from the standard MAC derivation for IPv4 multicast addresses.

This figure shows a graphical representation of how Microsoft NLB is implemented with Cisco APIC.

The figure illustrates the implementation of Microsoft Network Load Balancing (NLB) with two servers, Server 1 and Server 2, functioning as a single-host server to external clients. It highlights the use of multicast MAC addresses and unique IPv4 multicast group addresses in the NLB cluster.

In this figure, Server 1 and Server 2 are in the MS NLB cluster. These servers appear as a single-host server to outside clients. All servers in the MS NLB cluster receive all incoming requests, then MS NLB distributes the load between the servers.

Understand unicast mode

Unicast mode is a Network Load Balancing operation where all cluster hosts are assigned the same MAC address derived from the cluster's primary IP address.

  • Reassigns the MAC address of the cluster adapter.

  • Induces switch flooding to deliver incoming traffic to all hosts simultaneously.

  • Modifies source MAC addresses for outgoing packets to avoid Layer 2 switch conflicts.

Unicast Mode Traffic Handling

The following figures illustrate how unicast mode manages incoming traffic and outgoing packet source addresses.

Figure 1. Incoming traffic delivery via switch flooding
Figure 2. Outgoing packet source MAC address modification

Understand multicast mode

Multicast mode is a Network Load Balancing feature that distributes incoming network traffic to all cluster hosts by assigning a Layer 2 multicast address to the cluster adapter.

  • Assigns a Layer 2 multicast address to the cluster adapter.

  • Avoids changing the adapter's MAC address.

  • Eliminates the requirement for a separate adapter for cluster communication.

Multicast mode configuration details

The following example illustrates the address assignment:

  • Multicast MAC address: 03-BF-0A-14-1E-28

  • Primary IP address: 10.20.30.40

Understand IGMP mode

IGMP mode is a configuration for Microsoft NLB servers that enables them to join a multicast group to optimize the scope of multicast message flooding.

  • Uses a querier on a switch and IGMP snooping.

  • Maps the last two octets of the multicast address to the cluster IP.

  • Eliminates the requirement for a separate adapter for cluster communication.

IGMP Mode Operation

Microsoft NLB servers send IGMP joins to a multicast group address where the last two octets correspond to the cluster IP. For example, when servers send IGMP joins to 239.255.x.x, the following mapping occurs:

  • Cluster IP: 10.20. 30.40

  • IGMP sent to 239.255. 30.40

  • MAC used in client-to-server direction: 0100.5E7F. 1E28

Cisco ACI configuration for microsoft NLB servers

Microsoft NLB deployment involves integrating load-balanced server clusters into the fabric using specific bridge domain and EPG configurations.

  • Support for Unicast, Multicast, and IGMP modes.

  • Requirement for specific bridge domain settings including unknown unicast flooding.

  • Integration of VIP subnets and MAC address handling within EPGs.

Deployment modes and configuration options

The following table summarizes the deployment considerations for each Microsoft NLB deployment mode.

Table 1. Cisco ACI Deployment Modes with Microsoft NLB

Deployment Mode

Unicast Mode

Multicast Mode

IGMP Mode

Cisco ACI as a Layer 2 Network, With External Router as Layer 3 Gateway

Supported on leaf switch models with -EX, -FX, -FX2 or -FX3 at the end of the switch name.

Supported on leaf switch models with -EX, -FX, -FX2 or -FX3 at the end of the switch name, as well as leaf switch models that do not have a suffix at the end of the switch name.

Supported on leaf switch models with -EX, -FX, -FX2 or -FX3 at the end of the switch name, as well as leaf switch models that do not have a suffix at the end of the switch name. However, Microsoft NLB traffic is not scoped by IGMP, but rather is flooded instead.

Cisco ACI as a Layer 3 Gateway

Supported on release 4.1 and later.

Supported on release 4.1 and later.

Supported on release 4.1 and later.

General configuration tasks

Beginning with release 4.1, configuring the fabric to connect Microsoft NLB servers consists of the following general tasks:

  • Configuring the VRF in egress or ingress mode.

  • Configuring a bridge domain (BD) for the Microsoft NLB servers, with L2 unknown unicast in flooding mode and not in hardware-proxy mode.

  • Defining an EPG for all the Microsoft NLB servers that share the same VIP and associating it with the BD.

  • Entering the Microsoft NLB VIP as a subnet under the EPG.

  • Configuring a contract between the Microsoft NLB EPG (provider) and the client EPG (consumer).

Microsoft network load balancing guidelines and limitations

Provides essential configuration rules and support limitations for Microsoft network load balancing (NLB) to ensure successful integration with the network fabric.

The following guidelines and limitations apply to Microsoft network load balancing (NLB) configurations:

  • In a bridge domain's Policy > Advanced/Troubleshooting properties, you must disable the Drop ARP with Multicast SMAC knob if the Microsoft NLB VIP address is configured under any EPG in that bridge domain.

  • Microsoft NLB is not supported when a bridge domain's multi-destination flooding is set to drop .

  • For an existing bridge domain that is created before the upgrade, Drop ARP with Multicast SMAC knob is disabled by default. For bridge domains created after the upgrade, this knob is enabled by default. If you create a bridge domain for the Microsoft NLB after the upgrade you must disable this knob for Microsoft NLB to work.

  • Layer 3 multicast is not supported (you cannot enable PIM on the Microsoft NLB bridge domain).

  • For IGMP, the allowable mode group is IPv4 (IPv6 is not supported).

  • Only Cisco Nexus 9000 series switches with names that end in EX and later are supported.

  • Shared services and microsegment (uSeg) EPGs are supported with Microsoft NLB.

  • Cisco ACI Multi-Site is currently not supported.

  • You must configure Microsoft NLB in layer 2 unknown unicast flooding mode.

  • You should configure Microsoft NLB bridge domain with the default SVI MAC address. Under layer 3 configurations, you should configure the bridge domain MAC address with the default setting of 00:22:BD:F8:19:FF. Do not modify this default SVI MAC address for the Microsoft NLB bridge domain.

  • There is a hardware limit of 128 Microsoft NLB VIPs per fabric.

  • Virtualized servers that are configured for Microsoft NLB can connect to Cisco ACI with static binding in all modes (unicast, multicast, and IGMP).

  • Virtualized servers that are configured for Microsoft NLB can connect to Cisco ACI through VMM integration in unicast mode and IGMP mode.

  • Microsoft NLB unicast mode is not supported with VMM integration behind Cisco UCS B-Series Blade Servers in end-host mode.

If you configure the bridge domain for hardware-proxy instead, Cisco ACI raises a fault, which is cleared by fixing the bridge domain configuration. If you leave the bridge domain incorrectly configured for hardware-proxy, ACI tries to get the faulty configuration up every 30 seconds, which is an unnecessary overhead for the switch.

Microsoft NLB in unicast mode relies on unknown unicast flooding for delivery of cluster-bound packets. Unicast mode will not work on Cisco UCS B-Series Blade Servers when the fabric interconnect is in end-host mode, because unknown unicast frames are not flooded as required by this mode. For more details on the layer 2 forwarding behavior of Cisco UCS B-Series Blade Servers in end-host mode, see: https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/unified-computing/whitepaper_c11-701962.html

Configuring Microsoft NLB in unicast mode using the GUI

This task configures Microsoft NLB to flood all of the ports in the bridge domain.

Before you begin

Have the following information available before proceeding with these procedures:

  • Microsoft NLB cluster VIP

  • Microsoft NLB cluster MAC address

Procedure

Step 1

In the Navigation pane, choose Tenant > tenant_name > Application Profiles > application_profile_name > Application EPGs > application_EPG_name > Subnets .

Step 2

Right-click Subnets and select Create EPG Subnet .

Step 3

In the Create EPG Subnet dialog box, fill in the following fields:

  1. In the Default Gateway IP field, enter the Microsoft NLB cluster VIP.

    For example, 192.0.2.1/32 .

  2. In the Scope area, for shared services, check Shared between VRFs .

    Uncheck Private to VRF , if it is selected.

  3. Under Subnet Control , check the No Default SVI Gateway check box.

  4. In the Type Behind Subnet area, click EpNlb .

    The Mode field appears.

  5. From the Mode drop-down list, choose NLB in unicast mode .

    The MAC Address field appears.

  6. In the MAC Address field, enter the Microsoft NLB cluster MAC address.

    For example, 00:01:02:03:04:05 .

Step 4

Click Submit .

Configure Microsoft NLB in multicast mode using the GUI

This task configures Microsoft NLB to flood only on certain ports in the bridge domain.

Before you begin

Have the following information available before proceeding with these procedures:

  • Microsoft NLB cluster VIP

  • Microsoft NLB cluster MAC address

Procedure

Step 1

In the Navigation pane, choose Tenant > tenant_name > Application Profiles > application_profile_name > Application EPGs > application_EPG_name > Subnets .

Step 2

Right-click Subnets and select Create EPG Subnet .

Step 3

In the Create EPG Subnet dialog box, fill in the following fields:

  1. In the Default Gateway IP field, enter the Microsoft NLB cluster VIP.

    For example, 192.0.2.1/32 .

  2. In the Scope area, for shared services, check Shared between VRFs .

    Uncheck Private to VRF , if it is selected.

  3. Under Subnet Control , check the No Default SVI Gateway check box.

  4. In the Type Behind Subnet area, click MSNLB .

    The Mode field appears.

  5. From the Mode drop-down list, choose NLB in static multicast mode .

    The MAC Address field appears.

  6. In the MAC Address field, enter the Microsoft NLB cluster MAC address.

    For the Microsoft NLB cluster MAC address for the multicast mode, the cluster MAC address has to start with 03 .

    For example, 03:BF:01:02:03:04 .

  7. Copy the Microsoft NLB cluster MAC address that you entered in this field for the multicast mode.

Step 4

Click Submit .

Step 5

In the Navigation pane, choose Tenant tenant_name > Application Profiles > application_profile_name > Application EPGs > application_EPG_name > Static Ports > static_port .

Choose the static port that you want to configure Microsoft NLB to flood onto in the bridge domain.

Step 6

On the Static Path page for this port, fill in the following field:

  1. In the NLB Static Group area, click + (Create), then paste the MAC address that you copied from 3.g into the Mac Address field.

  2. Click Update underneath the Mac Address field.

Step 7

In the Static Path page, click Submit .

Any traffic to this Microsoft NLB cluster MAC address will now go out on this static port.

Configure Microsoft NLB in IGMP mode using the GUI

Before you begin

Have the following information available before proceeding with these procedures:

  • Microsoft NLB cluster VIP

This task configures Microsoft NLB to flood only on certain ports in the bridge domain.

Procedure

Step 1

In the Navigation pane, choose Tenant > tenant_name > Application Profiles > application_profile_name > Application EPGs > application_EPG_name > Subnets .

Step 2

Right-click Subnets and select Create EPG Subnet .

Step 3

In the Create EPG Subnet dialog box, fill in the following fields:

  1. In the Default Gateway IP field, enter the Microsoft NLB cluster VIP.

    For example, 192.0.2.1/32 .

  2. In the Scope area, for shared services, check Shared between VRFs .

    Uncheck Private to VRF , if it is selected.

  3. Under Subnet Control , check the No Default SVI Gateway check box.

  4. In the Type Behind Subnet area, click EpNlb .

    The Mode field appears.

  5. From the Mode drop-down list, choose NLB in IGMP mode .

    The Group Id field appears.

  6. In the Group Id field, enter the Microsoft NLB multicast group address.

    For the Microsoft NLB multicast group address, the last two octets of the address correspond to the last two octets of the instance cluster IP address. For example, if the instance cluster IP address is 10.20.30.40 , then the Microsoft NLB multicast group address that you would enter into this field might be 239.255.30.40 .

Step 4

Click Submit .

Traffic to the Microsoft NLB cluster VIP will be flooded to the outgoing interface list that is either configured statically from the APIC or dynamically based on IGMP joins from the NLB cluster.

Step 5

Determine if you want to have a static join or a dynamic join.

You can have a combination of static joins and dynamic joins, where some ports can have a static join and other ports can have a dynamic join.

  • Dynamic Join: In the dynamic join, the join is sent by the Microsoft NLB cluster on the respective ports, then the switch dynamically comes up with that outgoing interface list.

  • Static Join: In the static join, traffic to the Microsoft NLB cluster VIP will go to the ports that you configure in the following steps.

    If you want to have a static join:

    1. Copy the Microsoft NLB multicast group address that you entered in the Group Id field in 3.f .

    2. In the Navigation pane, choose Tenant > tenant_name > Application Profiles > application_profile_name > Application EPGs > application_EPG_name > Static Ports > static_port .

      Choose the static port that you want to configure Microsoft NLB to flood onto in the bridge domain.

    3. On the Static Path page for this port, fill in the following field:

      • In the IGMP Snoop Static Group area, click + (Create), then paste the group address that you copied from 3.f into the Group Address field.

      • Click Update underneath the Group Address field.

    4. In the Static Path page, click Submit .

IGMP snooping is enabled by default on the bridge domain because the IGMP snooping policy default that is associated with the bridge domain has Enabled as the administrative state of the policy. For more information, see Configure an IGMP snooping policy using the GUI .