Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

Silver

VPN load balancing

Hi all,

My understanding is that to configure load balancing, the inside interfaces need to on the same subnet and the outside interfaces need to be on the same subnet.

Is it possible to have the inside interfaces on  different subnets e.g.

Asa1

outside 192.168.1.1/24

inside   192.168.2.1/24

Asa2

outside 192.168.1.2/24

inside   192.168.3.1/24

Thanks

John

1 REPLY
Cisco Employee

Re: VPN load balancing

If you have a remote-access configuration in which you are using two or more security appliances or VPN Concentrators connected on the same network to handle remote sessions, you can configure these devices to share their session load. This feature is called load balancing. To implement load balancing, group together logically two or more devices on the same private LAN-to-LAN network, private subnet, and public subnet into a virtual cluster.

The way how load balancing works is:

-The phase 1 negotiation is done on the virtual master.
- An ike re-direct packet with the IP of a slave device was sent by the virtual master to the client.
- The client will start a new phase 1 and 2 negotiation on the slave device just like a standalone vpn connection.

You can also have a configuration that combines both Load-Balancing and Failover. For illustration, the client connects to the IP address of the cluster and is redirected to the least-loaded ASA in the cluster. If that ASA goes down, the standby unit takes over immediately, and there is no impact to the client's tunnel.

Note:Only the Active units participate in Load Balancing. Should the Active unit of a FO-pair go down, then its Standby mate would become active and then join the Load Balancing cluster mechanism to distribute the VPN session load.

Here's a link on Load balancing on ASA:

http://www.cisco.com/en/US/docs/security/asa/asa72/asdm52/selected_procedures/asdm_lb.html

Thanks & Regards,

Anshul

214
Views
0
Helpful
1
Replies