cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
524
Views
0
Helpful
1
Replies

VPN load balancing

johnd2310
Level 8
Level 8

Hi all,

My understanding is that to configure load balancing, the inside interfaces need to on the same subnet and the outside interfaces need to be on the same subnet.

Is it possible to have the inside interfaces on  different subnets e.g.

Asa1

outside 192.168.1.1/24

inside   192.168.2.1/24

Asa2

outside 192.168.1.2/24

inside   192.168.3.1/24

Thanks

John

**Please rate posts you find helpful**
1 Reply 1

ankaushi
Cisco Employee
Cisco Employee

If you have a remote-access configuration in which you are using two or more security appliances or VPN Concentrators connected on the same network to handle remote sessions, you can configure these devices to share their session load. This feature is called load balancing. To implement load balancing, group together logically two or more devices on the same private LAN-to-LAN network, private subnet, and public subnet into a virtual cluster.

The way how load balancing works is:

-The phase 1 negotiation is done on the virtual master.
- An ike re-direct packet with the IP of a slave device was sent by the virtual master to the client.
- The client will start a new phase 1 and 2 negotiation on the slave device just like a standalone vpn connection.

You can also have a configuration that combines both Load-Balancing and Failover. For illustration, the client connects to the IP address of the cluster and is redirected to the least-loaded ASA in the cluster. If that ASA goes down, the standby unit takes over immediately, and there is no impact to the client's tunnel.

Note:Only the Active units participate in Load Balancing. Should the Active unit of a FO-pair go down, then its Standby mate would become active and then join the Load Balancing cluster mechanism to distribute the VPN session load.

Here's a link on Load balancing on ASA:

http://www.cisco.com/en/US/docs/security/asa/asa72/asdm52/selected_procedures/asdm_lb.html

Thanks & Regards,

Anshul

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: