I just configured our first cluster of Microsoft servers using Multicast NLB.
The gateway of the VLAN is a Cisco 5540 and the servers are connected on a Cisco 3750 stack.
In order to let the ASA forward the frames for this multicast group I had to set the static arp resolution to the Multicast MAC address of this cluster.
No static MAC entry on our switches.
All works fine and multicast is working but...
1) Using wireshark on our NLB nodes I found that frames are destinated to the unicast mac address of the machine. IF I ping from the ASA to the Cluster IP, the ICMP is sent just to ALL the NLB nodes.
2) All frames originated from the NBL nodes has the unicast (physical) MAC address.
2) Other hosts in the same VLAN do not receive any broadcast related to this cluster (multicast is working)
3) on our Cisco 3750 stack, the Multicast MAC address is not in the CAM.
Since just NLB nodes are receiving this traffic, my question is:
HOW can the multicast work if the switch doesn't know anything regarding this cluster?!
I really thought you were using the IGMP option because of your statement:
Without the IGMP option, NLB uses a locally administered Multicast MAC address with the format 03:BF:<IP-Address-of-the-Cluster>. Thus this is not an IANA-assingend multicast MAC address (01-00-5E), IGMP snopping cannot avoid the flooding of those frames throughout the entire VLAN, which is the only way a switch can handle such frames. The recommendation for avoiding/containing this flooding is the configuration of static MAC entries for the multicast Cluster MAC (binding it exclusively to the required ports). Those static entries then also will be listed in the "show mac address-table" output.
With the IGMP option, you can make use of IGMP snooping in order to avoid the flooding, so static MAC entries are not required in this case and the multicast cluster MAC can be learned dynamically by IGMP snooping. It should then be listed in the "show mac address-table multicast" output.