SSLVPN authentication via another RSA server not working

[Mike Farnschlaeder]

A customer of us configured a addiitional RSA-Server in "Remote Access VPN" -> "AAA/Local Users" -> "AAA Server Groups".

He the configured "Accounting Mode -> "Simultaneous", but this is not working.

Only the first server will be asked in this group and not both of them. When changing the order of the two servers, the first one will always be choosen.

How can i fix this?

ASA5515

ASA Version 9.4.(1) , ASDM 7.4.(3)

Thanks in advance.

[jan.nielsen]

I believe the ASA only uses AAA group for redundancy, not load-balancing.

[Mike Farnschlaeder]

I just found this:

Generally in failover scenarios we create AAA server group on ASA. The security appliance contacts the first server in the group. If that server is unavailable, the security appliance contacts the next server in the group, if configured. If all servers in the group are unavailable, the security appliance tries the local database if you configured it as a fallback method (management authentication and authorization only). If you do not have a fallback method, the security appliance continues to try the AAA Servers

[jan.nielsen]

Yes, like i said, ASA uses the aaa group for redundancy, and does not load-balance the requests between multiple servers in a aaa group. If you need this i would suggest using a load balancer