MAC addresses with clusters and NLB

I thought I had posted a message about this once, but it has
mysteriously disappeared...or my newsreader didn't actually post it...

In any case, I'm searching for more detailed information on the
behavior and use of MAC addresses in active/passive clusters and NLB
clusters. Specifically, I need to know if the MAC address changes when
an active/passive cluster fails over, and if the MAC address changes
for an NLB cluster. Do they all use a single virtual MAC? I am
troubleshooting some connectivity problems with an active/passive
cluster and an NLB cluster behind a firewall and need to rule out all
possible causes.

Also, I have seen some posting indicating that a cluster's virtual IP
address is a sort of "receive only" IP address, and that traffic that
originates from/is generated by a cluster node doesn't use the cluster
virtual IP, but instead uses the cluster node's IP address. Is this
true? Can't this play tricks with firewall NAT rules?

TIA for your help, and sorry if this shows up as a duplicate posting.

--
Scott Lowe

There are a bunch of docs that might help.

Go to the KB and use "cluster mac address" as a search term.

--

Always try the MS KB first before posting.
MS KB: http://support.microsoft.com/default...;EN-US;KBHOWTO
And the answer could have already been posted, so try searching this and other newsgroups first.
----
Mark-Allen Perry
ALPHA Systems
Marly, Switzerland
mark-allen_AT_mvps_DOT_org

"Scott Lowe" <(E-Mail Removed)> wrote in message news:(E-Mail Removed)...
I thought I had posted a message about this once, but it has
mysteriously disappeared...or my newsreader didn't actually post it...

In any case, I'm searching for more detailed information on the
behavior and use of MAC addresses in active/passive clusters and NLB
clusters. Specifically, I need to know if the MAC address changes when
an active/passive cluster fails over, and if the MAC address changes
for an NLB cluster. Do they all use a single virtual MAC? I am
troubleshooting some connectivity problems with an active/passive
cluster and an NLB cluster behind a firewall and need to rule out all
possible causes.

Also, I have seen some posting indicating that a cluster's virtual IP
address is a sort of "receive only" IP address, and that traffic that
originates from/is generated by a cluster node doesn't use the cluster
virtual IP, but instead uses the cluster node's IP address. Is this
true? Can't this play tricks with firewall NAT rules?

TIA for your help, and sorry if this shows up as a duplicate posting.

--
Scott Lowe

On 2004-11-29 20:02:08 -0500, Scott Lowe <(E-Mail Removed)> said:

> In any case, I'm searching for more detailed information on the
> behavior and use of MAC addresses in active/passive clusters and NLB
> clusters. Specifically, I need to know if the MAC address changes when
> an active/passive cluster fails over, and if the MAC address changes
> for an NLB cluster. Do they all use a single virtual MAC? I am
> troubleshooting some connectivity problems with an active/passive
> cluster and an NLB cluster behind a firewall and need to rule out all
> possible causes.
>

I wanted to post a quick follow-up here in the event that someone else
runs into a similar problem later.

My customer was experiencing two key problems.

1. First, when attempting to bring up an NLB cluster of web servers,
the web site was inaccessible from outside their firewall. This was an
easy fix--clear the ARP cache and clear the static NAT translations so
that the firewall could associate the new "fake" MAC address created by
the NLB cluster correctly. (Clearing the NAT translations probably
wasn't necessary, but it didn't hurt either.)

2. Second, the customer had an active/passive SQL cluster that was
inaccessible while connected to a VPN. It turns out that the public
and private NICs were both 10.x.x.x addresses, and the subnet mask on
the private NIC caused the routing table to think that the VPN
addresses were local to the private NIC (the crossover heartbeat NIC)
and did not need to be routed through the VPN. Changing the subnet
mask on the private NIC changed the routing table so that VPN
connections were recognized as remote, and then VPN connectivity was
restored. (Note that my original suspicion, pertaining to MAC
addresses on the cluster, were not correct.)

I hope this information helps others.

--
Scott Lowe