{"id":20,"date":"2009-04-16T23:21:59","date_gmt":"2009-04-16T22:21:59","guid":{"rendered":"https:\/\/harun.se\/blog\/?p=20"},"modified":"2010-09-23T22:33:10","modified_gmt":"2010-09-23T21:33:10","slug":"how-to-configure-cisco-switches-for-nlb","status":"publish","type":"post","link":"https:\/\/harun.se\/blog\/?p=20","title":{"rendered":"How to configure Cisco Catalyst Switches for NLB"},"content":{"rendered":"<h2><a name=\"intro\"><span style=\"color: #ffffff;\">Introduction<\/span><\/a><span style=\"color: #ffffff;\"> <\/span><\/h2>\n<p><span style=\"color: #ffffff;\">This document describes how to configure Cisco Catalyst switches to interact with Microsoft Network Load Balancing (NLB).<\/span><\/p>\n<h2><a name=\"prereq\"><span style=\"color: #ffffff;\">Prerequisites<\/span><\/a><span style=\"color: #ffffff;\"> <\/span><\/h2>\n<h3><a name=\"req\"><span style=\"color: #ffffff;\">Requirements<\/span><\/a><span style=\"color: #ffffff;\"> <\/span><\/h3>\n<p><span style=\"color: #ffffff;\">There are no specific requirements for this document.<\/span><\/p>\n<h3><a name=\"hw\"><span style=\"color: #ffffff;\">Components Used<\/span><\/a><span style=\"color: #ffffff;\"> <\/span><\/h3>\n<p><span style=\"color: #ffffff;\">The information in this document is based on these software and hardware versions: <\/span><\/p>\n<ul>\n<li><span style=\"color: #ffffff;\">Catalyst 6500 switch running Cisco IOS<sup><span style=\"font-size: x-small;\">\u00ae<\/span><\/sup> Software <\/span><\/li>\n<li><span style=\"color: #ffffff;\">Catalyst 4500 switch running Cisco IOS<sup><span style=\"font-size: x-small;\">\u00ae<\/span><\/sup> Software <\/span><\/li>\n<li><span style=\"color: #ffffff;\">Catalyst 3550 switch running Cisco IOS<sup><span style=\"font-size: x-small;\">\u00ae<\/span><\/sup> Software <\/span><\/li>\n<li><span style=\"color: #ffffff;\">Catalyst 3560 switch running Cisco IOS<sup><span style=\"font-size: x-small;\">\u00ae<\/span><\/sup> Software <\/span><\/li>\n<li><span style=\"color: #ffffff;\">Catalyst 3750 switch running Cisco IOS<sup><span style=\"font-size: x-small;\">\u00ae<\/span><\/sup> Software <\/span><\/li>\n<li><span style=\"color: #ffffff;\">Microsoft Windows 2000\/2003 Servers<\/span><\/li>\n<\/ul>\n<p><span style=\"color: #ffffff;\">The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.<\/span><\/p>\n<h3><a name=\"conv\"><span style=\"color: #ffffff;\">Conventions<\/span><\/a><span style=\"color: #ffffff;\"> <\/span><\/h3>\n<p><span style=\"color: #ffffff;\">Refer to the <\/span><a href=\"http:\/\/www.cisco.com\/en\/US\/tech\/tk801\/tk36\/technologies_tech_note09186a0080121ac5.shtml\"><span style=\"color: #ffffff;\">Cisco Technical Tips Conventions<\/span><\/a><span style=\"color: #ffffff;\"> for more information on document conventions.<\/span><\/p>\n<h2><a name=\"backinfo\"><span style=\"color: #ffffff;\">Background Information<\/span><\/a><span style=\"color: #ffffff;\"> <\/span><\/h2>\n<p><span style=\"color: #ffffff;\">Network Load Balancing (NLB) technology can be used to distribute client requests across a set of servers. In order to make sure clients always experience acceptable performance levels, Windows NLB is often used to ensure that you can add additional servers to scale out stateless applications, such as IIS-based web servers, as client load increases. In addition, it reduces downtime caused by servers that malfunction. End users will never know that a particular member server in the Windows NLB is or has been down.<\/span><\/p>\n<p><span style=\"color: #ffffff;\">Network Load Balancing is a clustering technology offered by Microsoft as part of all Windows 2000 Server and Windows Server 2003 family operating systems. NLB uses a distributed algorithm to load balance network traffic across a number of servers.<\/span><\/p>\n<p><span style=\"color: #ffffff;\">NLB bundles the servers into one multicast group and tries to use the standard multicast IP and MAC address. At the same time, it provides a single virtual IP for all clients as the destination IP, which means servers join the same multicast group, and the clients will not know anything about it. They use normal unicast access to the VIP.<\/span><\/p>\n<p><span style=\"color: #ffffff;\">You can configure NLB to work in one of these modes:<\/span><\/p>\n<ul>\n<li><a href=\"#um\"><span style=\"color: #ffffff;\">Unicast Mode<\/span><\/a><span style=\"color: #ffffff;\"> <\/span><\/li>\n<li><a href=\"#mm\"><span style=\"color: #ffffff;\">Multicast Mode<\/span><\/a><span style=\"color: #ffffff;\"> <\/span><\/li>\n<\/ul>\n<h3><a name=\"um\"><span style=\"color: #ffffff;\">Unicast Mode<\/span><\/a><span style=\"color: #ffffff;\"> <\/span><\/h3>\n<p><span style=\"color: #ffffff;\">The NLB default setting is unicast mode. In unicast mode, NLB replaces the actual MAC address of each server in the cluster to a common NLB MAC address. When all the server in the cluster have the same MAC address, all packets forwarded to that address are sent to all members of the cluster. However, a problem with this configuration is when the servers NLB cluster are connected to the same switch, you cannot have two ports on the switch register the same MAC address. NLB solves this problem by masking the cluster MAC address. The switch looks at the source MAC address in the Ethernet frame header in order to learn which MAC addresses are associated with its ports. NLB creates a bogus MAC address and assigns that bogus MAC address to each server in the NLB cluster. NLB assigns each NLB server a different bogus MAC address based on the host ID of the member. This address appears in the Ethernet frame header. <\/span><\/p>\n<p><span style=\"color: #ffffff;\">For example, the NLB cluster MAC address is 00-bf-ac-10-00-01. NLB in unicast mode takes the cluster MAC address and, for each cluster member, NLB changes the second octet so that it consists of the NLB member\u2019s host ID. For example, server number 1 as the bogus MAC address 00-01-ac-10-00-01, host ID number 2 has the bogus MAC address 00-02-ac-10-00-01, so on. If a unique MAC address is registered on each switch port, packets are not delivered to all members of the array; rather packets should still be sent to the individual switch ports based on the MAC address assigned to that port. To make frames delivered to all members of the NLB cluster when each switch port connected to an NLB cluster member registers a different MAC address it uses an ARP broadcast are used. When the router sends an ARP request for the MAC address of the virtual IP address, the reply contains an ARP header with the actual NLB cluster MAC address 00-bf-ac-10-00-01, as per the example given above and not the bogus MAC address. <\/span><\/p>\n<p><span style=\"color: #ffffff;\">The clients use the MAC address in the ARP header, not the Ethernet header. The switch uses the MAC address in the Ethernet header, not the ARP header. The issue is when a client sends a packet to the NLB cluster with destination MAC address as cluster MAC address 00-bf-ac-10-00-01, the switch looks at the CAM table for the MAC address 00-bf-ac-10-00-01. Since there is no port registered with the NLB cluster MAC address 00-bf-ac-10-00-01, the frame is delivered to all switch ports. This introduces <em>switch flooding<\/em>. Switch flooding causes issues when significant amount of traffic is flowing and also when having other servers on the same switch. A solution to switch flooding is to put a simple hub in front of the NLB cluster members and then uplink the hub to a switch port. This solution does not even need to mask the NLB cluster MAC address because the single switch port connected to the hub learns the NLB cluster MAC address. This avoids the problem of two switch ports registering the same MAC address. When the client sends packets to the NLB cluster MAC address, the packets go directly to the switch port connected to the hub and then to the NLB cluster members. <\/span><\/p>\n<h3><a name=\"mm\"><span style=\"color: #ffffff;\">Multicast Mode<\/span><\/a><span style=\"color: #ffffff;\"> <\/span><\/h3>\n<p><span style=\"color: #ffffff;\">Another solution is to use multicast mode in MS NLB configuration GUI instead of Unicast mode. In Multicast Mode, the system admin clicks the IGMP Multicast button in the MS NLB configuration GUI. This choice instructs the cluster members to respond to ARPs for their virtual address using a multicast MAC address for example 0300.5e11.1111 and to send IGMP Membership Report packets. If IGMP snooping is enabled on the local switch, it snoops the IGMP packets that pass through it. In this way, when a client ARPs for the cluster\u2019s virtual IP address, the cluster responds with multicast MAC for example 0300.5e11.1111. When the client sends the packet to 0300.5e11.1111, the local switch forwards the packet out each of the ports connected to the cluster members. In this case, there is no chance of flooding the ARP packet out of all the ports. The issue with the multicast mode is virtual IP address becomes unreachable when accessed from outside the local subnet because Cisco devices do not accept an arp reply for a unicast IP address that contains a multicast MAC address. So the MAC portion of the ARP entry shows as <em>incomplete<\/em>. (Issue the command <strong>show arp<\/strong> to view the output.) As there is no MAC portion in the arp reply, the ARP entry never appeared in the ARP table. It eventually quit ARPing and returned an ICMP Host unreachable to the clients. In order to override this, use static ARP entry to populate the ARP table as given below. In theory, this allows the Cisco device to populate its mac-address-table. For example, if the virtual ip address is 172.16.63.241 and multicast mac address is 0300.5e11.1111, use this command in order to populate the ARP table statically:<\/span><\/p>\n<blockquote>\n<pre><span style=\"color: #ffffff;\"><strong>arp 172.16.63.241 0300.5e11.1111<\/strong>\r\n<\/span><\/pre>\n<\/blockquote>\n<p><span style=\"color: #ffffff;\">However, since the incoming packets have a unicast destination IP address and multicast destination MAC the Cisco device ignores this entry and process-switches each cluster-bound packets. In order to avoid this process switching, insert a static mac-address-table entry as given below in order to switch cluster-bound packets in hardware.<\/span><\/p>\n<blockquote>\n<pre><span style=\"color: #ffffff;\"><strong>mac-address-table static 0300.5e11.1111 vlan 200 interface\r\n\t fa2\/3 fa2\/4<\/strong>\r\n<\/span><\/pre>\n<\/blockquote>\n<p><span style=\"color: #ffffff;\"><strong>Note:\u00a0<\/strong>For Cisco Catalyst 6000\/6500 series switches, you must add the <em>disable-snopping<\/em> parameter. For example: <\/span><\/p>\n<blockquote>\n<pre><span style=\"color: #ffffff;\"><strong>mac-address-table static 0300.5e11.1111 vlan 200\r\n\t\tinterface fa2\/3 fa2\/4 disable-snooping<\/strong>\r\n<\/span><\/pre>\n<\/blockquote>\n<p><span style=\"color: #ffffff;\">The <strong><span style=\"font-style: italic; font-weight: normal;\">disable-snooping<\/span> <\/strong>parameter is essential and applicable only for Cisco Catalyst 6000\/6500 series switches. Without this statement, the behavior is not affected.<\/span><\/p>\n<h2><a name=\"conf\"><span style=\"color: #ffffff;\">Configure<\/span><\/a><span style=\"color: #ffffff;\"> <\/span><\/h2>\n<p><span style=\"color: #ffffff;\">In this section, you are presented with the information to configure the features described in this document. <\/span><\/p>\n<p><span style=\"color: #ffffff;\"><strong>Note:\u00a0<\/strong>Use the <\/span><a href=\"http:\/\/www.cisco.com\/pcgi-bin\/Support\/Cmdlookup\/home.pl\"><span style=\"color: #ffffff;\">Command Lookup Tool<\/span><\/a><span style=\"color: #ffffff;\"> ( <a href=\"http:\/\/tools.cisco.com\/RPF\/register\/register.do\">registered<\/a> customers only) to obtain more information on the commands used in this section.<\/span><\/p>\n<h3><a name=\"diag\"><span style=\"color: #ffffff;\">Network Diagram<\/span><\/a><span style=\"color: #ffffff;\"> <\/span><\/h3>\n<p><span style=\"color: #ffffff;\">This document uses this network setup:<\/span><\/p>\n<p><span style=\"color: #ffffff;\"><img src=\"http:\/\/www.cisco.com\/image\/gif\/paws\/107995\/microsoft_nlb.gif\" border=\"0\" alt=\"\/image\/gif\/paws\/107995\/microsoft_nlb.gif\" \/> <\/span><\/p>\n<h3><a name=\"configs\"><span style=\"color: #ffffff;\">Configurations<\/span><\/a><span style=\"color: #ffffff;\"> <\/span><\/h3>\n<p><span style=\"color: #ffffff;\">This document uses the Catalyst 6509 configuration described in this section.<\/span><\/p>\n<table border=\"1\" cellspacing=\"1\" cellpadding=\"3\" width=\"60%\" bgcolor=\"#ffffff\">\n<tbody>\n<tr>\n<th><span style=\"color: #000000;\">Configuration Using Catalyst 6509 <\/span><\/th>\n<\/tr>\n<tr>\n<td bgcolor=\"#ffffff\">\n<pre><span style=\"color: #000000;\">Cat6K#<strong>show running-config<\/strong>\r\n Building configuration...\r\n!\r\nversion 12.1\r\nservice timestamps debug uptime\r\nservice timestamps log uptime\r\nno service password-encryption\r\n!\r\nhostname Cat6K\r\n!\r\nboot buffersize 126968\r\nboot system flash slot0:c6sup11-jsv-mz.121-8a.E.bin\r\n!\r\nredundancy\r\n main-cpu\r\n  auto-sync standard\r\nip subnet-zero\r\n!\r\n!\r\ninterface GigabitEthernet1\/1\r\n no ip address\r\n shutdown\r\n!\r\ninterface GigabitEthernet1\/2\r\n no ip address\r\n shutdown\r\n!\r\ninterface FastEthernet2\/1\r\n description \"Uplink to the Default Gateway\"\r\n no ip address\r\n switchport\r\n switchport access vlan 100\r\n!\r\ninterface FastEthernet2\/2\r\n no ip address\r\n shutdown\r\n!\r\ninterface FastEthernet2\/3\r\n description \"Connection to Microsoft server\"\r\n no ip address\r\n switchport\r\n switchport access vlan 200\r\n!\r\ninterface FastEthernet2\/4\r\n description \"Connection to Microsoft server\"\r\n no ip address\r\n switchport\r\n switchport access vlan 200\r\n!\r\ninterface FastEthernet2\/5\r\n no ip address\r\n shutdown\r\n!\r\ninterface FastEthernet2\/48\r\n no ip address\r\n shutdown\r\n!\r\ninterface Vlan1\r\n no ip address\r\n shutdown\r\n!\r\n<\/span><span style=\"color: #000000;\"><strong>mac-address-table static 0300.5e11.1111 vlan 200 interface fa2\/3 fa2\/4 disable-snooping\r\n<\/strong>\r\n<\/span><em>\r\n<span style=\"color: #ffffff;\"><span style=\"color: #0000ff;\">! --- Creating a static entry in the switch for the multicast virtual mac.<\/span>\r\n<\/span><\/em><span style=\"color: #ffffff;\">\r\n<\/span><em>\r\n<span style=\"color: #ffffff;\"><span style=\"color: #0000ff;\">! --- fa2\/3 &amp; fa2\/4 are the ports connected to server.<\/span>\r\n<\/span><\/em>\r\n<em>\r\n<span style=\"color: #ffffff;\"><span style=\"color: #0000ff;\">!--- The disable-snooping is applicable only for Cisco Catalyst 6000\/6500 series switches<\/span>\r\n<\/span><\/em>\r\n\r\n<span style=\"color: #ffffff;\"><strong><span style=\"color: #000000;\">arp 172.16.63.241 0300.5e11.1111<\/span><\/strong>\r\n<\/span><em>\r\n<span style=\"color: #ffffff;\"><span style=\"color: #0000ff;\">! --- 172.16.63.241 is the Virtual IP of 2 servers<\/span>\r\n<\/span><\/em>\r\n\r\n<span style=\"color: #000000;\">interface Vlan100\r\n ip address 172.17.63.240 255.255.255.192\r\n<\/span><em>\r\n<span style=\"color: #ffffff;\"><span style=\"color: #0000ff;\">!--- Client Side Vlan <\/span>\r\n<\/span><\/em>\r\n<span style=\"color: #000000;\">!\r\ninterface Vlan200\r\n ip address 10.1.1.250 255.255.255.0\r\n<\/span><em>\r\n<span style=\"color: #ffffff;\"><span style=\"color: #0000ff;\">!--- Server Vlan<\/span>\r\n<\/span><\/em>\r\n<em>\r\n<span style=\"color: #ffffff;\"><span style=\"color: #0000ff;\">!--- Important: Configure the default gateway <\/span>\r\n<\/span><\/em><span style=\"color: #ffffff;\">\r\n<\/span><em>\r\n<span style=\"color: #ffffff;\"><span style=\"color: #0000ff;\">!--- of the Microsoft Server to this address.<\/span>\r\n<\/span><\/em>\r\n<span style=\"color: #000000;\">!\r\nip classless\r\nip route 0.0.0.0 0.0.0.0 172.16.63.193\r\nno ip http server\r\n!\r\nline con 0\r\nline vty 0 4\r\n login\r\n!\r\nend<\/span><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u00a0<\/p>\n<p><span style=\"color: #ffffff;\"><strong>Note:\u00a0<\/strong>Ensure that you use the multicast mode on the NLB cluster. Cisco recommends that you do not use multicast MAC addresses that begin with 01 because they are known to have a conflict with the IGMP setup.<\/span><\/p>\n<h2><a name=\"veri\"><span style=\"color: #ffffff;\">Verify<\/span><\/a><span style=\"color: #ffffff;\"> <\/span><\/h2>\n<p><span style=\"color: #ffffff;\">Use this section to confirm that your configuration works properly.<\/span><\/p>\n<p><span style=\"color: #ffffff;\">The <\/span><a href=\"https:\/\/www.cisco.com\/cgi-bin\/Support\/OutputInterpreter\/home.pl\"><span style=\"color: #ffffff;\">Output Interpreter Tool<\/span><\/a><span style=\"color: #ffffff;\"> ( <a href=\"http:\/\/tools.cisco.com\/RPF\/register\/register.do\">registered<\/a> customers only) (OIT) supports certain <strong>show<\/strong> commands. Use the OIT to view an analysis of <strong>show<\/strong> command output.<\/span><\/p>\n<ul>\n<li><span style=\"color: #ffffff;\"><strong>show mac-address-table<\/strong>\u2014Displays a specific MAC address table static and dynamic entry or the MAC address table static and dynamic entries on a specific interface or VLAN.<\/span><br \/>\n<blockquote>\n<pre><span style=\"color: #ffffff;\">Cat6K#<strong>show mac-address-table 0300.5e11.1111<\/strong>\r\n\r\n          Mac Address Table\r\n-------------------------------------------\r\n\r\nVlan    Mac Address       Type        Ports\r\n----    -----------      --------     -----\r\n200    0300.5e11.1111     STATIC    Fa2\/3 Fa2\/4<\/span><\/pre>\n<\/blockquote>\n<\/li>\n<li><span style=\"color: #ffffff;\"><strong>show ip arp<\/strong>\u2014Displays the Address Resolution Protocol (ARP) cache.<\/span><br \/>\n<blockquote>\n<pre><span style=\"color: #ffffff;\">Cat6K#<strong>show ip arp<\/strong>\r\nProtocol  Address          Age (min)  Hardware Addr   Type   Interface\r\nInternet  172.16.1.1            -     0300.5e11.1111  ARPA   Vlan200\r\n<h2><a name=\"related\">Related Information<\/a><\/h2>\r\n<ul>\r\n\t<li><a href=\"http:\/\/support.microsoft.com\/default.aspx?scid=kb;en-us;193602?referring_site=bodynav\" target=\"_blank\"><span style=\"color: #ffff00;\">Configuration options for WLBS hosts connected to layer 2 switches<\/span><\/a><span style=\"color: #ffff00;\"> <\/span><\/li>\r\n\t<li><a href=\"http:\/\/www.cisco.com\/en\/US\/tech\/tk870\/tk877\/tk880\/technologies_tech_note09186a008011b481.shtml?referring_site=bodynav\" target=\"_blank\"><span style=\"color: #ffff00;\">MS Windows Load Balancing Server: Issues with Switching and Routing<\/span><\/a><span style=\"color: #ffff00;\"> <\/span><\/li>\r\n\t<li><a href=\"http:\/\/www.cisco.com\/cisco\/web\/support\/index.html?referring_site=bodynav\" target=\"_blank\"><span style=\"color: #ffff00;\">Technical Support &amp; Documentation - Cisco Systems<\/span><\/a><span style=\"color: #ffff00;\"> <\/span><\/li>\r\n<\/ul>\r\n<\/span><\/pre>\n<\/blockquote>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Introduction This document describes how to configure Cisco Catalyst switches to interact with Microsoft Network Load Balancing (NLB). Prerequisites Requirements There are no specific requirements for this document. Components Used The information in this document is based on these software and hardware versions: Catalyst 6500 switch running Cisco IOS\u00ae Software Catalyst 4500 switch running Cisco [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[5],"tags":[],"_links":{"self":[{"href":"https:\/\/harun.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/20"}],"collection":[{"href":"https:\/\/harun.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/harun.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/harun.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/harun.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=20"}],"version-history":[{"count":16,"href":"https:\/\/harun.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/20\/revisions"}],"predecessor-version":[{"id":66,"href":"https:\/\/harun.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/20\/revisions\/66"}],"wp:attachment":[{"href":"https:\/\/harun.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=20"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/harun.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=20"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/harun.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=20"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}