AnyConnect SSL Load Balancing with Big IP

[Louis Gonzales]

Has been able to F5 GSLB to load balance AnyConnect SSL remote access VPN or is there a guide anywhere?  We currently have two ASAv50s deployed in our two main data centers and we want to be able to use our F5s with GSLB to load balance the traffic between them.

[balaji.bandi]

check some guide lines :

https://www.cisco.com/c/en/us/td/docs/security/asa/asa99/configuration/vpn/asa-99-vpn-config/vpn-ha.html#ID-2186-000003f0

[Sheraz.Salim]

Cisco already have a solution in place for this kind of scenarios. Therefore F5 wont be help for you. as you running ASAv50 VPN Load Balancing is supported.

Here and Here 

[Louis Gonzales]

Unless I'm reading this incorrectly the VPN load balancing option being talked about needs to have the ASAs located in the same inside and outside IP networks.  In our environment we have our ASAs located in two completely different data centers in different states.  From reading the documentation that I've found, in this scenario we would need to use some type of external DNS load balancing which we use Big IP GSLB.  I'm trying to find some type of guide for that setup, but I may need to find a more generic guide through Big IP.

[trodecke]

GSLB, aka DNS, is really just DNS so there's no trick there to load balancing a VPN connection.  All you would need to do is to add your pools to the same WIP, protocols aren't an issue there.  The real work takes place at the LTM level with what protocols you want to let through.  Since you mentioned SSL VPNs,  I believe you would just setup your Virtual Servers the same as any HTTPS website.  Those VSs would feed your DNS Pool and the Pools would be in your DNS WIP.  It can get more involved from there,  especially if you want to configure things so the users connect to the ASA that's closest to them.  That level of configuration is a bit beyond me and would probably require some professional services from F5.