Concept Guide
Microsoft Network Load Balancing
Network load balancing (NLB) is a clustering functionality that is implemented by Microsoft on Windows 2000 Server and Windows Server 
2003 operating systems (OSs). NLB uses a distributed methodology or pattern to equally split and balance the network trac load across a 
set of servers that are part of the cluster or group. NLB combines the servers into a single multicast group and attempts to use the 
standard multicast IP or unicast IP addresses and MAC addresses to transmit of network trac. At the same time, NLB also uses a single 
virtual IP address for all clients as the destination IP address, which enables servers to join the same multicast group that is transparent to 
the clients (the clients do not notice the addition of new servers to the group). The clients use a cluster IP address to connect to the 
server. To avoid overloading and eective performance of the servers for optimal processing of data packets, NLB enables ooding of 
trac over the virtual local area network (VLAN) ports (for Unicast mode) or a subset of ports in a VLAN (for Multicast mode.)
NLB functions in two modes, Unicast mode and Multicast mode. Congure the cluster IP address and the associated cluster MAC address 
in the NLB application running on the Windows Server.
• In Unicast mode, when the server IP address attempts to be resolved to the MAC address using the address resolution protocol (ARP), 
the switch determines whether the ARP reply, obtained from the server, is an NLB type. The switch then maps the IP address (cluster 
IP) with the MAC address (cluster MAC address).
• In Multicast mode, the cluster IP address maps to a cluster multicast MAC address you congured using a static ARP command. 
After the NLB entry is learned, the trac forwards to all the servers in the VLAN corresponding to the cluster virtual IP address.
NLB Unicast Mode Scenario
Consider a topology in which you congure four servers, S1 through S4, as a cluster or a farm. This set of servers connects to a Layer 3 
switch, which connects to the end-clients. The servers contain a single IP address (IP-cluster address of 172.16.2.20) and a single unicast 
MAC address (MAC-Cluster address of 00-bf-ac-10-00-01) for load-balancing. Because multiple ports on a switch cannot learn a single 
MAC address, the servers are assigned MAC addresseses of MAC-s1 to MAC-s4), respectively, on S1 through S4 in addition to the MAC 
cluster address. All the servers of the cluster belong to VLAN1.
In Unicast NLB mode, the following sequence of events occurs:
• The switch sends an ARP request to resolve the IP address to the cluster MAC address.
• The ARP servers send an ARP response with the MAC cluster address in the ARP header and a MAC address of MAC-s1/s2/s3/s4 (for 
servers S1 through S4) in the Ethernet header.
• The switch associates the IP address with the MAC cluster address with the last ARP response it obtains. Assume that the last ARP 
reply is obtained from MAC-s4 (assuming that the ARP response with MAC-s4 is received as the last one). The interface associated 
with server, S4, is added to the ARP table.
• With NLB enabled, after learning the NLB ARP entry, all the subsequent trac oods on all ports in VLAN1.
To perform load-balancing, NLB, forwards the data frame to all the servers.
NLB Multicast Mode Scenario
Consider a topology in which you congure four servers, S1 through S4, as a cluster or a farm. This set of servers connects to a Layer 3 
switch, which connects to the end-clients. They contain a single multicast MAC address (MAC-Cluster: 03-00-5E-11-11-11).
In Multicast NLB mode, congure a static ARP configuration command to associate the cluster IP address with a multicast 
cluster MAC address.
29
Microsoft Network Load Balancing 577










