Hi all,

I have a 3 node tmg array with NLB. For the past week my node #1 is getting about 1 or 2 web proxy requests and the others about 100 each.

Can someone help troubleshooting this issue 

Kind regards,

Lus

As the post lack a bit of detail of what you have done so far, I'll start with the obvious.

- Did anything change right about the time when the problem started? OS update? Driver updates?

- The node isn't drainstopped?

- Has the loadfactor been changed?

- Have you tried restarting the node?

- Eventlogs? Alerts?

I do realize that you may very well have tried/checked this but we need to know.

Hi,

Thanks for the quick reply. Here's the answers:

- No OS updates or drives. We had a tmg / firewall / switch physical move, but nothing change regarding ip address. The other 2 nodes are working fine, i just have this balancing issue.

- No drainstopped;

- Loadfactor is 100 for all 3 nodes

- Restarted several times

- No Eventlogs and alerts regarding this issue

Any idea?

Is CARP enabled? Do you use tmg firewall client or wpad?

Hello,

CARP is disabled.

Not using tmg firewall client or wpad for this array. I have web chaining from other array.  Just notice that the problem is for 1 node (of 3).

Kind regards,

You mention that you did some network changes, I'd start by looking at the switches then.

NLB can cause issues with swtiches unless correctly configured. First step is to see what mode NLB is operating in, unicast or multicast and then verify switch configuration accordingly.

Hello again,

Found some strange info about arp in the affected node. Using arp-a in this node i don't see the same static addresses.

For the good nodes, i see in each interface, via arp -a, address 224.1.1.1 as static. For the affected node, i don't see this address.

My NLB is unicast and i think this multicast address 224.1.1.1 is normal to have in all tmg nodes, maybe to talk with each other.

Any idea ?

Hello,

Any news from my last post ?

Kind regards,