1.1. Multicast mode with IGMP

1.1.1. Advantages
· No flooding of the VLAN
· Mutual communication between the NLB members is possible without an extra NIC (compared to Unicast mode)
1.1.2. Disadvantages
· It does not work automatically on all networkequiment (ex. Cisco). An IGMP querier has to be activated in the vlan to enable IGMP snooping
1.1.3. Causes
· on layer 2: When choosing multicast IGMP as NLB operation mode, the original MAC-adresses of the NLB members are not changed. The switch registers the NLB members in its MAC table with their original MAC-addresses.
· on layer 3: an arp-request to the NLB cluster or to an NLB member is always answered with MAC-address: 0100.5e7f.xxxx. This is an official (IANA) multicast MAC-address because it starts with 0100.5exxxx is the hex representation of the NLB-cluster IP-address. example: 89.17.67.197 has 0100.5e7f.43c5 in its ARP response. This MAC-address does not get registered automatically in a Cisco router or L3-switch because Cisco does not accept an ARP response which connects an Unicast IP adres with a multicast MAC-address.
1.1.4. Impact
· Cluster not reachable from behind routerThe cluster ip-address cannot be reached from behind a Cisco router or L3-switch
· FloodingAll switches wants to deliver packets for the NLB member or the NLB cluster to the 0100.5e7f-MAC address. This MAC-address is not registered on in the switches MAC-table. Therefore these packets are sent out on every port of every switch. This behaviour is called “flooding”.As a result every NLB member receives the trafic destined for the NLB cluster. This is how the cluster gets his work done.The downside of this behaviour is that all other members (other NLB’s or standalone servers) on the same VLAN also get spammed with this traffic.
1.1.5. Possible solutions:
· Cluster not reachable from behind Cisco router Adding a static entry in the ARP-table of the router makes the cluster available from behind the router
SWCOGD01(config)# arp 89.17.67.197 0100.5e7f.43c5 ARPA

· FloodingActivate “IGMP snooping” the VLAN. This requires switches that support “IGMP snooping”. On top of this, an IGMP querier has be activated in the vlan. For Cisco this can only be done on a layer 3 switch or router
ip multicast-routinginterface Vlan322ip pim dense-modeip igmp version 3

Multicasting on layer 2 can be looked upon as a dynamic vlan. NLB members in the server vlan can subscribe to a certain multicast stream.
To do this, they send an IGMP Join message to the connected switch. They want to see all traffic towards MAC-address 0100.5e7f.xxxx.xxxx. The switch remembers this by registering this dynamically into his MAC-table. The switch than forwards this to the IGMP querier. This querier is activated in the router of the server vlan. The querier periodically sends out queries to discover if the NLB members stay interested in the NLB multicast traffic. By doing so, all traffic to the NLB1 cluster is sent out only to switchports connected with an NLB1 member.
1.2. Conclusion
An Microsoft NLB is best run in the Multicast IGMP mode because:
· flooding is prevented so other server communication in the vlan is not disturbed
· it requires less administration
· it enables mutual communication between NLB members (as opposed to unicasting)