I have two Win2k3 Terminal Severs that are clustered using Windows NLB. Each server has a single NIC in it, so the NLB is using multicast mode.
I need to install the Cisco VPN client on the servers (for a specific application).
When I install the VPN software it breaks the NL cluster. I can understand why it does this, but that doesn't help me fix it.
I am looking for possible solutions ?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
To answer the questions:
RobWill - I'm aware of split tunneling. The issue is that the VPN client blocks the NLB cluster from working just when you install it, without connecting to any tunnels.
TheCleaner - I can elaborate. It's an accounting firm. They run a TS environment and the method for submitting stuff to certain govt sites is via the VPN client. This isn't a manual process, the accounting software uses the VPN client to automate the submission. If I install an extra NIC, do you know if there is any way of telling the Cisco VPN client to only use ONE of the NICs. It's been a while since I bothered to read the screens on the installer as I clicked "next", but I don't recall any option to bind to only one NIC ?
Thanks.
In regards to the routing. You can add static routes in your local OS routing table telling it to route traffic bound for those remote institutions using the VPN out the new NIC.
I'm honestly not sure on this though if you say it breaks the NLB cluster during install.
Is it possible to open a case with Cisco on this?
Well, according to this other EE question, someone else called Cisco on an NLB issue and it was resolved by altering the MTU size to account for the packet overhead.
One way you can tell if the MTU size is too large by default would be to:
ping address -l 1500 -f
If you get "packet needs to be fragmented" then change 1500 to 1480, then 1460, etc. in increments of 20 until it no longer gets fragmented. That would give you a good indication of proper MTU size.
Also found an online article that said:
The other NLB mode is multicast mode. Microsoft would prefer to set the default mode to multicast, but there are problems because certain Cisco devices dont allow multicast MAC addresses to be associated with a unicast IP address and the Cisco device will not insert a multicast MAC address its ARP table if its associated with a unicast IP address.
and here: http://technet2.microsoft.
"Some routers require a static ARP entry because they do not support the resolution of unicast IP addresses to multicast media access control addresses. For example, Cisco routers require an ARP (address resolution protocol) entry for every virtual IP address. While Network Load Balancing uses Level 2 Multicast for the delivery of packets, Cisco's interpretation of the RFCs is that Multicast is for IP Multicast. So, when the router doesn't see a Multicast IP address, it does not automatically create an ARP entry, and one has to manually have to add it on the router."
So, according to that you can probably call Cisco, but it seems like your options could be to create a static ARP entry for the multicast address (which would mean it will probably need one for the default cluster and one for the address it gets over the VPN client tunnel), or switch to unicast mode.
Business Accounts
Answer for Membership
by: RobWillPosted on 2008-02-07 at 06:28:56ID: 20840941
You mention; "I can understand why it does this", so you are probably aware that by default the Cisco client, for security reasons, blocks all traffic with other PC/servers on the same LAN, creating a tunnel only allowing traffic between it and the Cisco VPN router. The way to resolve this is to enable split-tunneling, but it can only be done by the Cisco admin, in the VPN configuration of the router.
Sorry I am not a Cisco guy, and cannot help with the actual configuration. You may want to post a question or link in the Cisco forum. Or, if if you are not thee Cisco administrator, contact them and see if they are willing to do so. Also, if both terminal servers will need to use the Cisco client at the same time, from the same public IP, they will also have to configure NAT-T on the Cisco router.