FF TMG 2010: Configure Network Load Balancing Across Enterprise Array Members

Gallery

Posted on by

NLB is an wonderful in built TMG feature you can utilize to balance high network traffic. you can configure network load balancing across up to eight FF TMG array members.
Windows Server 2012 Step by Step

The following is an example of FF TMG 2010 NLB Configuration.  

image

To configure network load balancing among FF TMG 2010 enterprise array members, Open FF TMG enterprise Management server console, Click on the Networking Node>Select preferred networks. For this article, I have chosen internal networks for load balancing.

 1

Click on Enable Network Load Balancing Integration, you will be presented with NLB Integration Wizard, Click Next.

2

Select Internal>Click Configure NLB Settings

3

Type Primary virtual IP (VIP), Select Unicast, Click OK. note that VIP will be similar IP range of internal networks of both TMG servers. VIP will be registered as a DNS record in DNS server once you click finish.

4

5

click Finish. Click OK.

6

Apply Changes. Click Ok.

7

To Change or add additional VIP, Click on Networking node>Right Click on Internal Network>Click Property>Click NLB Tab

8

Change FF TMG Client configuration to new VIP. Client proxy address will be new VIP.

11

Now you have finished configuring NLB. To test NLB, open internet explorer, add VIP as new proxy address and browse bing.com.

13

14

To test that you are able to browse internet using VIP proxy address if one NLB node fails, reboot one TMG server while you keep surfing internet on a client. you will experience slow browsing though depending on your load. you will see following error in TMG EMS but once all array members are up and running it will sync itself.

9

10

Important!    you can centrally manage up to 15 EMS x 200 arrays per EMS x 50 TMG servers per array that is in total 150,000 TMG servers. 

Relevant Articles:

FF TMG 2010: Configure ISP Redundancy— Step by Step

Install and configure Forefront TMG 2010 Enterprise Management Server (EMS) for centralized Management (part II)—Step by Step

Install and configure Forefront TMG 2010 Enterprise Management Server (EMS) for centralized Management—Step by Step

Install and configure Forefront TMG step by step

Forefront Threat Management Gateway (TMG) 2010

Configure back to back perimeter step by step

Configure reverse proxy step by step

22 thoughts on “FF TMG 2010: Configure Network Load Balancing Across Enterprise Array Members”

  1. Hi , thanks for this article . i wondering , you ve give the exampe for outgoing NLB ,but for the incomming connexiont ; can FF tmg handel incomming requests from ( a routerto the VIP) in external interfaces ? hwo do we can to configure it ?

    Like

    Reply ↓

  2. Hi,

    Its wonderful article but how i configure if i have only two servers and i need redundancy(load balancing) between them ……………………..

    Like

    Reply ↓

  3. Hi, i have the same question. I have only 2 TMG enterprice without EMS. should i create first an array then create the NLB ? and if i want to create same settings for internal and external ? with some services published ?

    thanks 😉

    Like

    Reply ↓

  4. Hi. Do you perhaps know what can cause high receive errors on the Network Load Balanced Network cards on the array members. I have 2 array members.

    Like

    Reply ↓

  5. Sir,
    i have one Ems server(one nic card on ems) tmg1 server tmg2 server(both servers have to nic card one for internal and other for external) i have import the policy and on ems on array and join both servers to the array now i am trying to create the EMS policy which is above on array and try to link it on array but its not working how i can do that please tell me.

    Like

    Reply ↓

  9. Nice Blog thank us for sharing information about the TMG issue .
    We have an issue with NLB getting error ( RPC services unavailable) while join host another array node server
    we have 2 TMG nodes and 1 EMS server both 2 nodes have been successfully joined to EMS array ,I am trying to enable NLB for both nodes in TMG console and i have enabled and check the NLB manage the another node has not join to cluster RPC error
    As i was go through the comments in the blog NLB manager is not required to manager but when i enabled NLB in TMG console its trying to add using NLB manager and getting error (RPC service )
    Workaround :
    I disabled RPC filter in Enterprise and system array and get re- solved the RPC error but when i disabled RPC error both nodes getting configuration error in EMS server not sync
    could you please provide more details how we need to work with NLB

    Like

    Reply ↓

  10. How do I create full redudancy using two tmg 2010 (configured as three leg firewall, Internal, external and dmz). and how to install ssl certificates as well publish websites, exchange 2010, owa etc. have no problem doing all the se on a single server??

    Regards

    Like

    Reply ↓

    • I have showned NLB for public network. But you can configure it for all three network.
      Install web server certificate into Web server and same certificate inot TMG Server. Publish web services using Firewall Policy>Publish Exchange or Websites

      Like

      Reply ↓

  12. Hi,

    when I select internal network or perimeter, the virtual IP is not defined and “Configure NLB Settings…” button is gray. What to do?!?

    thanks

    Like

    Reply ↓

      • Ok, it was my problem 🙂 Spoofing was not enabled.
        But now Ihave another problem. After I create NLB, the RDP session to specific tmg server doesn’t work anymore 😦

        Any idea?

        Like

Leave a comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.