10-08-2007 09:11 AM
Is it possible to setup 2 ASA 5520's in an active standby state and still take advantage of VPN load balancing or do each of the ASA's have to be independent to utilize VPN load balancing?
Thanks
Solved! Go to Solution.
10-08-2007 09:14 PM
Please rate if it helps
10-08-2007 09:14 PM
Yes..it is possble to setup 2 ASA 5520 in A/S mode. But Load balancing will not take place.
In Active/Active mode this facility can be availed.
10-08-2007 09:14 PM
Please rate if it helps
10-09-2007 08:11 AM
Thanks for the info
12-21-2007 11:03 AM
What about VPN Load Balancing specifically? In the document located here:
It says "Note: VPN failover is not supported on units that run in multiple context mode. VPN failover is available for Active/Standby Failover configurations only."
Active/Active requires multiple contexts. Therefore, VPN Failover will not work in Active/Active. But it does not say anything about VPN clustering or load balancing. Which is the functionality I believe he meant. VPN Clustering is covered here:
But it says in the Requirement sections "VPN users are able to connect to all ASAs with the use of their individually assigned public IP address."
It's saying that each ASA having it's own individually assigned public IP is a requirement for VPN clustering. Therefore, how could it be possible using Active/Active failover?
08-22-2008 01:43 PM
Confirmed and tested
You can not do VPN load balancing if you have failover enabled. If VPN load balancing is enabled and then you enable failover, VPN load balancing databases loses the standby peer.
The following statement in cisco's ASA config guide is NOT true:
"The security appliance also provides load balancing, which is different from failover. Both failover and load balancing can exist on the same configuration."
And I'm sure they are referring to VPN load balancing and not to Active/Active load balancing, because the URL link after that statement goes directly to the VPN load balancing section of the ASA configuration guide
This means that if a customer wants to get a pair of ASAs for firewalls and also wants to use SSL VPN, he must buy twice as many SSL VPN licenses. The only other way is to get a second pair of ASAs just for VPN.
I've asked many cisco folks about this and no one seems to know when this licensing issue is going to get resolved. Many of my customers shy away from SSL VPN just because of this issue.
12-23-2008 12:56 AM
I'm not sure it is a license question. I can use WebVPN on the standby unit. I just have to give it the correct URL https://v.x.y.z/+CSCOE+/logon.html
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide