Network load balancing (NLB)

The servers in an NLB cluster share the load of incoming requests based on rules you can define. A server cluster is sometimes referred to as a server farm, it is a group of servers configured to respond to a single virtual IP address.


  • From the client perspective, a server cluster appears on the network as a single device with a single name and IP address (virtual IP address).
  • The server can filter traffic based on the the Port number.
  • Can assign each server a priority number.
  • Well suited to TCP/IP based application such as web servers and streaming media server where data can be easily replicated among the participating servers and is not changed by users.
  • Not advisable if data being accessed on the servers require exclusive access such as with database, file or print and email app.
  • NLB does not provide data replication, so the cluster administrator must use synchronization tools or manually make sure the data provided by cluster servers is consistent among all servers.


  • All hosts in the cluster must reside on the same subnet.
  • Within each cluster, all network adapters must be either multicast or unicast. You cannot have some nodes configured as multicast while other nodes are configured as unicast
    within a single cluster. We discuss multicast and unicast configuration later in the lesson.
  • If unicast mode is used, the network adapter that is used to handle client-to-cluster traffic must support changing its media access control (MAC) address.
  • The IP addresses assigned to the nodes must be static.
  • The Networking services to be load balanced must be installed and configured identically.
  • Use a domain controller as a cluster server isn’t recommended.

Ideally, you should use two nics, one for communication with network clients, and one dedicated for communications among cluster members.

Tasks to create an NLB cluster

Before these steps, you need to configure a zone for the FQDN specified for the cluster name and A records for each server.

  • Create a new cluster
  • Select a host and network interface to participate in the cluster:First enter the name(Not IP address, so you need to make sure the DNS server can resolve it ) of the server where you are running the NLB. If you have more than one NIC, you should choose the one that is to be used to communicate with client computers. If you are using two NICs, you should remove the dedicated IP address.
  • Configure the host priority/host ID:up to 32 servers can be supported,priority value can be 1 to 32, the cluster member with the lowest priority handles all cluster traffic that isn’t associated with a port rule. Every server in a cluster must have a unique priority value.
  • Set the cluster IP address:
    The virtual IP address that represent all the cluster host. A DNS host record should exist for the cluster name(full internet name) mapped to this address.
  • Set the full internet name
  • Set the cluster name and operation mode
  • Configure port rules
  • Configure DNS record for the cluster
  • Add additional servers to the cluster


cluster parameters
Cluster IP configuration:
  • IP address and subnet mask: the virtual IP address that represent all the cluster host.
  • Full internet name: the FQDN assigned to the cluster, you must have an entry in DNS server that resolves the full internet name to the cluster IP address.
  • Network address: cluster’s MAC address (virtual MAC address).
Cluster operation mode:
  • Unicast: In this mode, each packet is sent to a single network destination identified by a unique address. In other words, a host sends packets to a single computer. Note that the network adapter that is used to handle client-to-cluster traffic must support changing its media access control (MAC) address.
    When you configure an NLB cluster to use unicast mode, NLB replaces the network card’s original MAC address and all cluster hosts use the same unicast MAC address. When you use unicast mode with a single network adapter on each node, the computer can communicate only with other computers within the same subnet. If you perform management tasks on the computer, you need to perform these tasks on a computer that is on the same TCP/IP subnet as the node, or you have to use a second network adapter and address. Lastly, if you use unicast mode, you can use separate virtual local area networks (VLANs) for cluster traffic and management traffic.
  • Multicast: preferred, packets are sent to multiple computers simultaneously in a single transmission from the source. In other words, when a host sends packets using multicasting, a single set of packets is sent to all computers at once. Copies are automatically created on routers, when the packet needs to go to different subnets. When an NLB host is in multicast mode, each NLB network adapter has two MAC addresses (the original MAC address and the virtual MAC address). However, when using multicast mode, some routers might see a unicast IP address with a multicast MAC address as an invalid packet and reject the update to the ARP table. If this happens, the network administrators might need to manually add ARP entries to the router.

In summary, if your system has two network cards, you should use unicast. If a server has only a single network card, you should use multicast mode.

  • IGMP: is a special form of multicast mode that prevents the network switch from flooding with traffic. When you use IGMP multicast mode, traffic is forwarded only through the
    switch ports that are part of the NLB cluster. However, to use IGMP multicast mode, you need switch hardware that supports IGMP multicast mode.
Port rules

Port rules specify how NLB directs traffic based on the port and protocol.


When you configure the port rules, you configure the following:
• The virtual IP address that the rule should apply to.
• The TCP or UDP port range that this rule should apply to.
• The protocols that this rule should apply to, including TCP, UDP, or both.
• The filtering mode that specifies how the cluster handles traffic, which is described by the port range and the protocols.

The filter mode specifies which hosts can respond to requests. The filter mode includes the following:

Multiple hosts: Permits all cluster hosts to actively respond to client requests. NLB nodes respond according to the weight assigned to each node. Because this allows the customizing of the affinity and load balancing, it is the most common mode used. Multiple host filtering increases availability and scalability, because you can increase capacity by adding nodes, and the cluster continues to function in the event of node failure.

Affinity determines how the servers are going to balance the load. You use affinity settings when you use multiple hosts filter mode. If you choose the multiple host filtering mode, you can then configure the affinity. When you configure affinity, you can choose one of the three options:

None: Any cluster node responds to any client request, even if the client is reconnecting after an interruption. This option is suitable for stateless application, where the server that is servicing the request does not have to remember the previous events to complete the request. As a result, the client can jump from one server to another within the cluster without problem.

Single: A single cluster node handles all requests from a single client. This option is useful for stateful applications where the status of a process or transaction is maintained through the entire connection including when using SSL and e-commerce shopping cart applications.

Network: A single node responds to all requests from a class C network (a network with a subnet of, often found when used with multiple proxy servers. This type of server is often used with cookie-based affinity or when a common database or session state server is used.

Single host: Allows only one cluster host (the host with the highest priority) in the cluster to actively respond to client requests. If the host fails, the host with the next highest priority takes over for the failed host. It is usually used to configure one host as the primary server and other hosts as backup servers. Single host rules increase availability, but do not increase scalability.

Disable: Prevents the cluster from responding to a specific type of client traffic.

Host configuration:

To remove a node, you can perform a stop or a drainstop action.

The stop action terminates all existing connections to the cluster node and stops the NLB service.

The drainstop action blocks all new connections without terminating existing sessions. Therefore, to perform maintenance on an NLB node, which needs to be temporarily removed from the NLB cluster, you should choose drainstop so that connections are not prematurely stopped before the requests are completed. To control the host, you right-click the node, click Control Host, and select the appropriate option (Start, Stop, Drainstop, Suspend, or Resume).