Palo Alto and Microsoft NLB multicast

[jeromecarrier]

Hi

I have an issue to contact the VIP of our Microsoft NLB.

We have a cluster of 2 PA-1410 (active/passive). On this cluster, I configured interface aggregate with sub-interfaces with ID vlan (ex :vlan10, vlan 50, vlan193..). Each IP of the interface VLAN is the gateway configured on my servers.

On the VLAN193, I have 2 Windows servers with NLB installed. On CLI on the FW, I'm able to ping the real IP of the NLB and the VIP when the source IP for the ping is the vlan interface of vlan10 or interface vlan50 or interface vlan193. From remote sites who access to the NLB via VPN Ipsec tunnel configured on the PA, I can ping the VIP. But from servers hosted on vlan10 or vlan50, I'm able to ping real IP but not the VIP. And there is no policy rule who dropped the trafic. 

Do you have an idea why I'm able to ping the VIP from all VLAN interface configured on the PA or from remote site via the VPN and not from servers hosted on the other vlan than NLB is hosted ?

BR    

[Adan_Mora]

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClX6CAK

[zGomez]

Adan_Mora is correct.  The reason why you can also find on microsoft website.  

Configure network infrastructure to support the NLB operation mode - Windows Server | Microsoft Lear...

I would accept adan_mora as solutioin.