• RSS
  • Twitter
  • FaceBook

Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

ISA 2006 NLB Problems

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA 2006 General] >> Installation and Planning >> ISA 2006 NLB Problems Page: [1] 2   next >   >>
Login
Message << Older Topic   Newer Topic >>
ISA 2006 NLB Problems - 19.Nov.2007 10:24:30 AM   
Mark Reyes

 

Posts: 15
Joined: 1.Jul.2005
Status: offline
Iím know this Topic has be discussed before, ButÖ.
 
I canít get it to work.
 
NLB in ISA 2006.
 
I have Two Windows 2003 Servers Named ISA54 & ISA55.
Each Server has ISA installed with the CSS being on both of them.
 
ISA54.int.net
NIC 1 (External) 10.5.26.54 (Gateway 10.5.26.1)
NIC 2 (Internal) 10.5.7.54 (No Gateway)
NIC 3 (Intra-Array) 192.168.7.54 (No Gateway)
 
ISA55.int.net
NIC 1 (External) 10.5.26.55 (Gateway 10.5.26.1)
NIC 2 (Internal) 10.5.7.55 (No Gateway)
NIC 3 (Intra-Array) 192.168.7.55 (No Gateway)
 
The Intra-Array NICs are connected via a Cross-over cable.
Each Server is joined to an AD domain.
DNS Entry resolves to the Intra-Array Networks Only.
 
I install ISA 2006 on ISA54 Create an Array called ISA
I modify the FW Rule Replicate Configuration Storage Server, to allow 192.168.7.55
I install ISA 2006 on ISA55, Join the Array called ISA
 
Setup as an Edge Firewall,
1st I create a new Network called Intra-Array, I add the 192.168.7.x network
2nd I Change the intra-array communication to the 192.168.7.x network on each server
3rd I set the alternate configuration storage server to ISA55.int.net
 
So Far, so good..
 
So I want to Enable NLB on the Internal Network, This is where everything gets screwed up. I have used ISAserver.org and http://www.microsoft.com/technet/isa/2006/nlb.mspx as References, but no avail.
 
This is what I do.
 
I go to > Networks > Related Tasks Enable Network Load Balancing Integration.
Select Next, Do not choose any of the networks, Click Next, Than Finish.
I highlight Internal Network > Properties. Go to NLB. Checkmark Enable NLB
Set the Primary VIP to 10.5.7.56, same Subnet as the dedicated Adapters. Click ok
I than Apply the Changes.
 
BAM, System dies. Get an Error Message saying that it can no longer communicate with the CSS on ISA54.int.net or ISA55.int.net.

 
I do an IPconfig on each server and I see that NLB was applied to each of the 10.5.7.x network Cards, with 10.5.7.56 being the Virtual IP.
 
Once NLB is enabled, I can no longer resolve the DNS entries for intra-array address.
I assumed the reason why I could no longer talk to the CSS was because I could not resolve the FQDN of the CSS servers.  So I added the Intra-Array Address to the Local Host file and I am able to resolve the Address, but I still get the error unable to communicate with CSS.


Shouldn't the CSS communicate on the 192.168.7.x network? That's what I set it to? Why, if I enable NLB on the 10.5.7.x network does it kill Communication to the CSS?


I have tried many different little changes here and there, but the above is the gist of it. I even created a Firewall rule to Allow all Protocols from "anywhere" to "anywhere" and nothing.  Iíve been working on this for 2 weeks, and right now Iím sucking up my pride and want my hand held.  :)
 
Anyone?


Thank you
-Mark
Post #: 1
RE: ISA 2006 NLB Problems - 26.Nov.2007 12:02:32 PM   
Mark Reyes

 

Posts: 15
Joined: 1.Jul.2005
Status: offline
It looks like when I enable NLB, I lose access to the AD, and therefore I am unable to connect to the CSS because it can not Authenticate my credentials. How do I setup NLB and Maintain communication with AD?

(in reply to Mark Reyes)
Post #: 2
RE: ISA 2006 NLB Problems - 27.Nov.2007 1:07:45 AM   
jabramo

 

Posts: 13
Joined: 26.Nov.2007
Status: offline
Hey Mark,

I have been having the same exact issues with our ISA servers. Identical issues and errors. I've contacted Microsoft ISA team and have been working on it for the past couple of days for almost 14 hours in total and have yet to identify the cause. I will post a reply to this issue once things get resolved.

Will keep you posted

(in reply to Mark Reyes)
Post #: 3
RE: ISA 2006 NLB Problems - 27.Nov.2007 7:16:34 AM   
Mark Reyes

 

Posts: 15
Joined: 1.Jul.2005
Status: offline
Wow, Thank you

I was going to Contact the Software Assurance Support today, but this will help greatly.

Thanks
-Mark

(in reply to jabramo)
Post #: 4
RE: ISA 2006 NLB Problems - 28.Nov.2007 9:13:23 AM   
jabramo

 

Posts: 13
Joined: 26.Nov.2007
Status: offline
Ok, here it is,

As I mentioned in my previous reply, I have been facing the same exact issues dealing with ISA NLB. Over the past 4 days with Microsoft Engineering team spending over 3 hours of being on the phone, running every possible tool from Microsoft and sniffing the network, log the entries and etc... etc... etc..., we got to where the issue was.

Problem; Nortel Passport Switch.

Nortel Passport Switch Layer2/3 do not support Unicast. Packets could only get to the switch and then they would drop. This is because the switch does not support registering the MAC address of the VIP.

So, to guide other ISA administrators who have just a patch of haid left, please hang on to your hair and don't pull them all and that includes myself. Before you do that,  make sure you have confirmed with your vendor that your switches do support Unicast and if not, look for other alternatives such as having to replace or patch or .....

I hope this helped.

(in reply to Mark Reyes)
Post #: 5
RE: ISA 2006 NLB Problems - 28.Nov.2007 9:37:22 AM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Ha! Very good info.

BTW -- does the switch support multicast mode?

Thanks!
Tom

_____________________________

Thomas W Shinder, M.D.

(in reply to jabramo)
Post #: 6
RE: ISA 2006 NLB Problems - 28.Nov.2007 9:45:45 AM   
Mark Reyes

 

Posts: 15
Joined: 1.Jul.2005
Status: offline
I confered with my Switch folks and they said that Switch is not a Switch if it doesn't support Unicast.

(in reply to tshinder)
Post #: 7
RE: ISA 2006 NLB Problems - 28.Nov.2007 9:51:27 AM   
Jason Jones

 

Posts: 4663
Joined: 30.Jul.2002
From: United Kingdom
Status: offline
Hey Mark,
 
If that doesn't fix it, are you aware of the changes you need to make when you enable NLB on servers that also host the CSS role?
 
This covers it:
 
Multiple Network Adapters and NLB
In a complex network topology with NLB enabled, multiple ISA Server array members may be connected through more than one network adapter, and the Configuration Storage server may be installed on one of the array members. In this case, a request to connect from an array member to the Configuration Storage server may fail.
In this scenario, to ensure that the connection requests do not fail, perform the following steps:

1. Create a new Domain Name System (DNS) entry pointing to the IP address on the intra-array network of the Configuration Storage server.

2. Register the intra-array name in the Kerberos database using the Setspn.exe tool.

3. Change the array properties to use the new DNS entry. 

For example, in the scenario where the Configuration Storage server is installed on a computer named fw1.contoso.com, register fw1a.contoso.com, where fw1a.contoso.com is pointing to the intra-array IP address of the Configuration Storage server.
To register the new name in the Kerberos database, run these commands:

setspn -a ldap/fw1a.contoso.com FW1
setspn -a ldap/fw1a.contoso.com:2171 FW1 

Modify the Configuration Storage server array property, to fw1a.contoso.com.
 
Hope this helps!
 
Cheers
 
JJ
 

_____________________________

Jason Jones | Forefront MVP | Silversands Ltd
My Blogs: http://blog.msedge.org.uk/ and http://blog.msfirewall.org.uk/

(in reply to tshinder)
Post #: 8
RE: ISA 2006 NLB Problems - 28.Nov.2007 9:51:43 AM   
jabramo

 

Posts: 13
Joined: 26.Nov.2007
Status: offline
The switch does support Multicast. However, it's not a feasable appraoch at this time. If we alter one switch in the organization, then it means we have to do them all approx about 400 of them. I'm not sure if its worth changing the infrastructure network configuration for the sake of two ISA servers.

For those who have the same issues with Unicast and switches, I would recommend looking at the product from EMC called: RainWall or RainConnect. That would probably do the job or look at different models of the passport or cisco switches that support unicast. Also ensure there is the latest firmware on the switches before you implement the NLB.

(in reply to tshinder)
Post #: 9
RE: ISA 2006 NLB Problems - 28.Nov.2007 9:53:20 AM   
Mark Reyes

 

Posts: 15
Joined: 1.Jul.2005
Status: offline
Thanks Jason,

But I did do that prior to posting on this message board.

(in reply to Jason Jones)
Post #: 10
RE: ISA 2006 NLB Problems - 28.Nov.2007 10:14:07 AM   
Jason Jones

 

Posts: 4663
Joined: 30.Jul.2002
From: United Kingdom
Status: offline
Hmmm...that has fixed it for every issue I have seen. You 100% sure you got it right as the help/FAQ has wrong setspn entries - my post above has the correct ones...

The setspn stuff is normally the bit that causes problems...

Cheers

JJ

_____________________________

Jason Jones | Forefront MVP | Silversands Ltd
My Blogs: http://blog.msedge.org.uk/ and http://blog.msfirewall.org.uk/

(in reply to Mark Reyes)
Post #: 11
RE: ISA 2006 NLB Problems - 28.Nov.2007 10:18:50 AM   
Jason Jones

 

Posts: 4663
Joined: 30.Jul.2002
From: United Kingdom
Status: offline
How are the ISA interfaces physcially attached to the internal network? Are they into a single switch or across two switches?

Are the internal interfaces using ports assigned to a dedicated VLAN?

Have you tried placing both ISA interfaces into a hub which then uplinks to a switch? The following will help explain this step: http://technet2.microsoft.com/windowsserver/en/library/884c727d-6083-4265-ac1d-b5e66b68281a1033.mspx?mfr=true

Cheers

JJ

_____________________________

Jason Jones | Forefront MVP | Silversands Ltd
My Blogs: http://blog.msedge.org.uk/ and http://blog.msfirewall.org.uk/

(in reply to Jason Jones)
Post #: 12
RE: ISA 2006 NLB Problems - 28.Nov.2007 12:16:36 PM   
Jason Jones

 

Posts: 4663
Joined: 30.Jul.2002
From: United Kingdom
Status: offline
As another idea...

How about moving the CSS roles to other servers? Persoanlly I try to avoid placing the CSS on the ISA nodes and it is not best practice...

If even you don't want to do this long-term it will help identify if this is the issue or just NLB specific

Cheers

JJ

_____________________________

Jason Jones | Forefront MVP | Silversands Ltd
My Blogs: http://blog.msedge.org.uk/ and http://blog.msfirewall.org.uk/

(in reply to Jason Jones)
Post #: 13
RE: ISA 2006 NLB Problems - 28.Nov.2007 2:08:50 PM   
Mark Reyes

 

Posts: 15
Joined: 1.Jul.2005
Status: offline
Jabramo

That appears to be problem, After Twisting the arm of my network folks it appears that the Nortel 8600 Also is an unsupported Nortel Product that does not allow unicast NLB traffic. I moved over to Nortel NSF and that product appears to support this.

as soon as I moved over, I was able to correctly communicate with the CSS.

thanks!
-Mark

(in reply to jabramo)
Post #: 14
RE: ISA 2006 NLB Problems - 28.Nov.2007 2:23:32 PM   
jabramo

 

Posts: 13
Joined: 26.Nov.2007
Status: offline
Excellent news Mark,

I'm glad things are working now. I'm waiting for an immediate solution from my side to replace the switch from 8600 to 5500.

Cheers

(in reply to Mark Reyes)
Post #: 15
RE: ISA 2006 NLB Problems - 28.Nov.2007 2:31:31 PM   
Mark Reyes

 

Posts: 15
Joined: 1.Jul.2005
Status: offline
Out of curiosity, what code version are you running on the 8600?

(in reply to jabramo)
Post #: 16
RE: ISA 2006 NLB Problems - 28.Nov.2007 2:32:00 PM   
jabramo

 

Posts: 13
Joined: 26.Nov.2007
Status: offline
Correction to my posting.

The switch does not support Unicast in away that it does not register the MAC address of VIP in the ARP Cache.

(in reply to jabramo)
Post #: 17
RE: ISA 2006 NLB Problems - 28.Nov.2007 2:34:33 PM   
jabramo

 

Posts: 13
Joined: 26.Nov.2007
Status: offline
I don't know. I have to ask the Infrastructure support guys. Were you able to run NLB aside from connecting to CSS? Did you do any testing to see if your workstation or client workstations can go out with the VIP?

(in reply to Mark Reyes)
Post #: 18
RE: ISA 2006 NLB Problems - 28.Nov.2007 2:38:57 PM   
Mark Reyes

 

Posts: 15
Joined: 1.Jul.2005
Status: offline
Nope,  all network traffic would stop once it was enabled, and clients would not be able to communicate with them while in Unicast mode.

(in reply to jabramo)
Post #: 19
RE: ISA 2006 NLB Problems - 28.Nov.2007 2:40:11 PM   
Mark Reyes

 

Posts: 15
Joined: 1.Jul.2005
Status: offline
We are running Version 4.1.0.0 btw.

(in reply to Mark Reyes)
Post #: 20

Page:   [1] 2   next >   >> << Older Topic    Newer Topic >>
All Forums >> [ISA 2006 General] >> Installation and Planning >> ISA 2006 NLB Problems Page: [1] 2   next >   >>
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts