Scenario:

We have a head office running three terminal servers (A, B & C).
Server A is used by senior management when they are working away from the office and is lightly utilised.
B & C are part of a Microsoft Network Load Balancing Cluster connected via a Ethernet Hub to our switched network and are used by the employees in our 20 regional offices. They have their own cluster address of 192.168.10.7. Between the two servers there are normally around 60-65 users logged in at any one time, with between 2 and 5 users per regional office.

The regional offices are connected to the head office by xDSL over a MPLS network. The head office is connected to the MPLS via a 10Mb Leased Line which is operating well below capacity. As far as we and our ISP can tell, the connectivity within the MPLS is good. Ping times from the sites to the head office are between 10-40ms and judging by the ISP MRTG graphs, none of the lines are anywhere near being saturated.

Problem:
Users of the NLB cluster (Servers B & C) report intermittent poor application performance (lag when typing in Outlook or Word etc, slow window switching). Some days it seems fine, other days all sites report a general slowdown. However, when head office users log on to the NLB IP address from the local LAN we do not experience any of the symptoms reported by the end users.

Our first thought was that this must be network related, but the WAN performance seems stable (Pings of <40ms across the board) with no packet loss observed. What also throws this theory out is that a remote user who is experiencing poor performance on the cluster is having no problems on if they log into server A which is not part of the cluster.

My dilemma is that if it were the servers that were overloaded then users on the local LAN would experience the same issues as the remote users. Conversely, if the network was to blame then the users would have slowdown on both the single server (A) and the Cluster (B&C). All servers are in the same subnet and on the same VLAN.

Any ideas greatly appreciated as this has really got me stumped.