Standby load balancer VM appliance reports high network usage

Products

• VMware vSphere ESXi

Issue/Introduction

• A standby Citrix (NetScaler) load balancer virtual machine may experience high network throughput, even when it is not actively processing load balancer traffic.
  
  
                             Standby load balancer                                                                                   Active load balancer 

This issue typically occurs after migrating other high-traffic virtual machines (such as HTTP Proxies) onto the same ESXi host and VLAN where the standby appliance reside.

Environment

Vmware vSphere ESXi

Cause

• This issue occurs when the NetScaler VMs and the high-traffic VMs (e.g., HTTP Proxies) reside on the same VLAN, and the vSwitch Port Group servicing that VLAN is configured with Promiscuous Mode set to "Accept"
• When Promiscuous Mode is enabled, the ESXi virtual switch operates similarly to a network hub rather than a switch. Therefore, it captures all traffic generated by other virtual machines on the same host and VLAN and mirrors a copy of every packet into the virtual NIC of any appliance including the standby Citrix (NetScaler) load balancer virtual machine listening on that port group.
• If high-traffic VMs like HTTP Proxies reside on the same host, the standby node receives a copy of all that traffic, leading to artificial network saturation and elevated host-level resource consumption.

Resolution

To stop unwanted traffic from being mirrored into the standby Citrix (NetScaler) load balancer virtual machine, adjust Promiscuous Mode Settings

1. Navigate to the vSphere Client.
2. Select the Port Group or vSphere Distributed Switch used by the load balancer virtual machine.
3. Go to Settings > Security.
4. Change Promiscuous Mode from Accept to Reject.
5. This instantly prevents the vSwitch from flooding the standby NIC with traffic intended for other destinations.

Additional Information

For more architectural details and in-depth information regarding virtual switch behavior and security policies (including Promiscuous Mode), refer to KB 324553.