Comments on Me, Myself and ISA Blog (MSFirewall.org.uk): Resource Guide for Using Microsoft NLB with ISA Se...

Hi Moe, You only need static ARP entries for the ...

2012-01-11T23:12:18.346Z

Hi Moe,

You only need static ARP entries for the VIPs, not the NIC dedicated IP addresses.

The VIP is not used as the source IP address for outbound traffic; each node will use its own dedicated IP address as the source and hence you will need two static ARP entries.

Cheers

JJ

Hi Jason, Great Stuff. I need your advice for ou...

2012-01-09T18:04:37.629Z

Hi Jason,

Great Stuff.

I need your advice for our setup consisting of 2 tmg 2010 servers configured as multicast nlb. The internal nics of the array (facing clients) and the external nics are connected in different vlans on the same cisco 4507 core.

Internal Nics: 10.10.10.1, 10.10.10.2
Internal VIP: 10.10.10.3

External Nics: 10.10.100.1,

Hi Rick, Yeah, a lot of the content is still very...

2011-12-21T01:14:32.901Z

Hi Rick,

Yeah, a lot of the content is still very much valid for TMG as little has changed with regard to NLB.

The biggest change is that you can now deploy a small standalone array using NLB as opposed to have to use Enterprise arrays in ISA.

Cheers

JJ

Sensational work Jason! You mentioned that the art...

2011-12-20T20:51:09.569Z

Sensational work Jason!
You mentioned that the article relates primarily to ISA 2006 as TMG was pretty new back then. I take it the concepts and guidance and designs will be the same really as TMG seems only to offer the NLB improvements that come with windows 2008 , 2008 R2?
Rick

IGMP snooping is a feature of the switch and takes...

2011-03-04T01:04:17.354Z

IGMP snooping is a feature of the switch and takes place internally on switches; it is not a protocol feature. IGMP snooping allows a switch to only forward multicast traffic to the links that have solicited them and consequently reduces multicast flooding.

Regarding the 'multicast with IGMP' operat...

2011-02-27T19:21:29.020Z

Regarding the 'multicast with IGMP' operational mode, does only the switch need to support IGMP spoofing or do all the servers and devices that are also connected to the switch need to support this IGMP spoofing?

Hi Patrick, Most layer-3 switches allow you to cr...

2011-02-03T14:59:55.087Z

Hi Patrick,

Most layer-3 switches allow you to create a layer 2 VLAN that is suitable for use with NLB. In order to pass traffic in and out of this VLAN you can normally assign it an IP address for this purpose. In the Cisco world this is called a Switch Virtual Interface (SVI) but terminology differs for other switch manufacturers.

This achieves what you need, but contains

HI JJ, We are also thinking about implementing TM...

2011-02-03T13:20:58.800Z

HI JJ,

We are also thinking about implementing TMG 2010 Integrated NLB in Unicast mode on a dedicated VLAN. But what will happen if we made that dedicated VLAN Rout-able (Virtual Interface for the dedicated VLAN on the switch with basic router Functions). The reason for this question is that we don't understand if you put the NLB in Unicast on a dedicated VLAN, how clients can

You either need to use dedicated VLANs (my prefere...

2010-12-11T00:39:30.063Z

You either need to use dedicated VLANs (my preference) or move to multicast (ideally with IGMP if you can support it.

If you remove the MaskSourceMAC feature, the switch will associate the NLB virtual MAC address with a single switch port and consequently all VIP traffic will only reach one server. If this server fails, traffic will not reach the other server. If place a dumb hub

Hi JJ, Thanks for your help... As far my underst...

2010-12-10T05:48:56.539Z

Hi JJ,

Thanks for your help...

As far my understand in that Blog ariticle follows if using NLB Unicast Mode in ISA Server

As of now i am using NLB Unicast mode in my case....

To resolve this issue.......

a) create dedicated VLANs to isolate NLB enabled interfaces Or

b) disabling the MaskSourceMAC feature that is inherent

Jason. Thank you.

2010-06-15T18:28:24.857+01:00

Jason.
Thank you.

NLB is IP address based, so domain name settings s...

2010-06-15T15:59:30.272+01:00

NLB is IP address based, so domain name settings should be irrelevant.

Jason, thanks for your response and expert advice....

2010-06-15T03:14:09.378+01:00

Jason, thanks for your response and expert advice.On the VIP, will I have any issues using VIP that is in a different namespace than the host servers? For example, I have 2 domain controllers, ISA, CSS, Arrays installed with dns say server1.local (192.168.1.2) and server2.local (192.168.1.3). Now I create a VIP (192.168.1.4)using NLB and register it with my internal dns as proxy.domain.org. Will

Hi Isaac, Yes, you can use a crossover; although ...

2010-06-11T14:24:57.943+01:00

Hi Isaac,

Yes, you can use a crossover; although the use of a hub/switch is recommended to reduce event log errors when rebooting array members.

Yes, you can create multiple NLB VIPs on each network to meet your needs. I tend to dedicate the primary VIP as the network default gateway and then use additional VIPs for assignment to web listeners.

Cheers

JJ

Thanks for this great information. Quick question:...

2010-06-10T05:51:37.481+01:00

Thanks for this great information. Quick question: I am planning on setting upi two ISA 2006 for web publishing and will be placed in the DMZ. I plan to install CSS, DC, DNS on each of the arrays. I want to use one NIC for NLB and the second NIC for Intra-Array communications. Can I use a crossover cable for intra array communications between the two servers without connecting to the switch?