Anyconnect backup server failover time

[CYKmb]

I have a VPN profile setup for Anyconnect with backup server configured. (AnyConnect Secure Mobility Client 4.10)

If the primary server is not available, the client fails over to the backup server and connects as expected.

The client takes over 60 seconds before it will even try to connect to the backup server.

Is there any way to set the connection timeout (not the authentication timeout, we haven't got that far yet!) to a smaller value.  Really, if the client can't get an IP response back from the host within about 5 seconds, it should consider that host dead and move on to the backup.

EDIT:  LOAD BALANCING IS NOT THE RIGHT SOLUTION FOR MY PROBLEM. 

[MHM Cisco World]

Maybe I am sorry if I dont full understand the issue here 

You use backup server in profile' and you dont use load balance ?

If above correct then the anyconnect user must detect dead of primary to shift to backup and this happened if ypu run keepalive or DPD and I think it by defualt run but ypu can tune if timer to make it faster detect primary server dead.

MHM

[CYKmb]

@MHM Cisco WorldIt's a bit of a unique scenario, where a remote user, depending on location and circumstances, may only be able to reach one of the available VPN gateways.  The secondary gateway is non-optimal for several reasons, and I would prefer if users didn't have to actually think about it.

I have looked at DPD, but that seems to be related to reconnecting a dead session, not related to the initial establishment of a connection.

I am little dismayed, although not overly surprised that an advanced networking product that has been around for this long still doesn't have a setting for connection timeouts, but here we are...

[MHM Cisco World]

DPD or Keepalive is use by ASA/FTD and anyconnect client to detect dead of peer. 
you can reduce the timer and check how it take long between shift from primary to backup. 
remember for any protocol IPSec SSL TCP ...etc there is mechanism to detect peer dead

MHM 

[tvotna]

Reducing DPD timers won't help AnyConnect to try another peer. This is obvious. As was pointed out at least 3 times on this thread there is no option to reduce connection timeout. From my experience it shouldn't be 60 seconds though. I remember that timeout was noticeable and GUI displayed how client tried one peer after another, but I don't think it took that long. TAC can collect captures / DART and tell exactly why the timeout is so long.

[ccieexpert]

do you realize that several engineers are taking time out of their busy schedule to help you..hope you appreciate that... but you dont clearly mentioned your constraints.. First of all like many said, there is no way to change the timeout.. i was an ex-TAC lead and expert on anyconnect, i dont recall the exact timeout, but they never implemented a configurable timeout setting AFAIK...the xml setting doesnt exist as per document. So you asked for other solutions... the ONLY other solution is load balancing whether you like it or no... DNS based load balancing is very cheap solution providers like cloudflare can provided. vpn.mydomain.com it can do backend tcp connection and provide a A record for the vpn server that is available. Other options are vpn load balancing builtin into ASA/FTD or external load balancer. Thats all for now

[CYKmb]

@ccieexpertI do appreciate your time.  I spend much of my day helping others as well, and I'm sure if we were to sit down together for beers we would get along just great, but I never asked for alternative solutions.  I asked how to adjust the timeout. My question was very concise:

If the primary server is not available, the client fails over to the backup server and connects as expected.

Is there any way to set the connection timeout?

---

I very quickly replied that Load Balancing was not a viable solution under the circumstances, and again someone suggested LB, and again, and again.  I'm OK with that, but you seem to be upset by the fact that you cannot solve my problem.  I did not ever ask for other solutions.  I only asked for how to adjust the connection timeout.  I am very aware of my problem space and my options, which is why my question was very specific.
I have often found that three different TAC "engineers" will provide three different answers and in the end I have to figure out the answer for myself, so one person saying "there's no setting" is pretty meaningless.  I have also often found that documentation is lacking, outdated, or just pure fantasy.

[ccieexpert]

I am not upset about anything... It was more of wanting to hear the contstraints and explaining why other solutions are not good.. If i were to design it today, i would go with a DNS load balancing. If you look at anyconnect implmentation on the client with backup server... It first tries Primary headend, if it it fails then goes to second headend.

DNS failover  - DNS server is monitoring primary and second headend at TCP/icmp/HTTPs level. If it fails, then primary headend is marked as down, and next DNS request it will give secondary headend ip address.

Its literally doing the samething as anyconnect client backup server, its just faster

But i rest my case...

[MHM Cisco World]

you use Anyconnect flexvpn with FW or router ?

if router share the config you use both GW
MHM

[CYKmb]

I am using Anyconnect with ASA firewall.