Process of reconnecting for a VPN user

[kostasthedelegate]

Hello 

I have two ASA that are used for VPN 

There is load balancing. 

I would like to know when a client disconnects if he will reconnect automatically. 

Thanks and regards, 

Konstantinos

[Rob Ingram]

Hi,
If the user clicks the disconnect button, then the session is terminated and will not automatically reconnect, they will need to re-authenticate. If the users' session is interrupted then yes the client will automatically attempt to reconnect.

HTH

[kostasthedelegate]

Hello,

Yes, I did not specify!!
I was thinking that the client disconnects not on his own, but due to another fact i.e. the asa is down.

[Rob Ingram]

If you are using an ASA VPN Load Balancer then the user sessions are not synced between the devices in the virtual cluster. So if the ASA you are connected to fails then the users would need to reconnect to the virtual cluster and re-authenticate.

If you have an Active/Standby HA pair then the session will failover to the other ASA and the user will not require to re-authenticate.

[kostasthedelegate]

I am in the first case.
Right the sessions are not synced between the ASA.
So if the first ASA of the cluster (higher priority) is down then we will not have any connection.
In the case that the second ASA is down we will have connection to the first ASA of the cluster.
Right?

[Rob Ingram]

When a client connects, the master determines the load across the VPN cluster and redirects the client connection to the least loaded ASA, distributing the user load across all of the ASAs in the virtual cluster. If the master fails, then another ASA will take up the master role, so you should always be able to authenticate.

[kostasthedelegate]

Ok that's great.
Is there a document I could consult on these?

[Rob Ingram · Accepted solution]

These links should help.

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118078-technote-vpn-00.html

https://www.cisco.com/c/en/us/td/docs/security/asa/asa99/configuration/vpn/asa-99-vpn-config/vpn-ha.html#ID-2186-000003f0