VPN load balancing

Unanswered Question
Feb 16th, 2010
User Badges:
  • Silver, 250 points or more

Hi all,

My understanding is that to configure load balancing, the inside interfaces need to on the same subnet and the outside interfaces need to be on the same subnet.

Is it possible to have the inside interfaces on  different subnets e.g.









  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
ankaushi Sat, 02/20/2010 - 04:48
User Badges:
  • Cisco Employee,

If you have a remote-access configuration in which you are using two or more security appliances or VPN Concentrators connected on the same network to handle remote sessions, you can configure these devices to share their session load. This feature is called load balancing. To implement load balancing, group together logically two or more devices on the same private LAN-to-LAN network, private subnet, and public subnet into a virtual cluster.

The way how load balancing works is:

-The phase 1 negotiation is done on the virtual master.
- An ike re-direct packet with the IP of a slave device was sent by the virtual master to the client.
- The client will start a new phase 1 and 2 negotiation on the slave device just like a standalone vpn connection.

You can also have a configuration that combines both Load-Balancing and Failover. For illustration, the client connects to the IP address of the cluster and is redirected to the least-loaded ASA in the cluster. If that ASA goes down, the standby unit takes over immediately, and there is no impact to the client's tunnel.

Note:Only the Active units participate in Load Balancing. Should the Active unit of a FO-pair go down, then its Standby mate would become active and then join the Load Balancing cluster mechanism to distribute the VPN session load.

Here's a link on Load balancing on ASA:


Thanks & Regards,



This Discussion