Using "backup server list" in Anyconnect XML for client failover

[tryingtofixit]

confused in setting up "backup server list" in the anyconnect XML vs the "backup servers".

The cisco docs indicate that "backup server list" overwrites the "backup servers."

Using Radius auth, no ldap here 

I have two endpoints d1.vpn.com and d2.vpn.com

In the backup server list config the primary set as d1.vpn.com and in backup server list, d2.vpn.com is on top, with d1.vpn.com on bottom.

Details for back up servers have form the asdm details are: 

d2.vpn.com

d1.vpn.com

I am setting up the ASA that will be hosting d1.vpn.com  with d2.vpn.com as its backup.

The cisco docs don't help that much.   am I on the right track here? 

[ccieexpert]

take a look at this:

https://community.cisco.com/t5/vpn/anyconnect-profile-editor-server-list-and-backup-servers/td-p/4154167

this might clear it out..

[tryingtofixit]

still clear as mud!   And they are mentioning LDAP in the listed link.  I need my local AnyConnect clients to connect to d1vpn.com, if that fails, then go to d2vpn.com.  I am not using IP's but FQDN for my "backup server list" servers' addresses. 

[BlakeBratu]

The global 'backup servers' option in the AnyConnect XML profile is universal for each server list entry. If you create a backup server list specific to the server list entry, that will take precedence.

If I take the global backup server list and it's a list for blake1.com and blake2.com, each server list entry in that XML profile will use those server lists if the primarily defined FQDN is not available.

If I take a server list entry and create my own backup server list in that entry, that list will take precedence over the global backup server list.

Both entries function the way you want it to work (failing over to d2vpn.com if d1vpn.com is not available).

[tryingtofixit]

do I need to repeat d1vpn.com in the backup server list if it is defined as the primary fqdn?

Why would I want to use the server backup list over the "backup servers". 

Thanks!

what do most customers use? 

[tryingtofixit]

do I need to repeat d1vpn.com in the backup server list if it is defined as the primary fqdn? Why would I want to use the server backup list over the "backup servers". 

what do most customers use? 

thanks 

[BlakeBratu]

Hi @tryingtofixit, your primary FQDN should not be in the backup server list.

The 'backup servers' list is global, and applies to all server list entries. The 'backup server list', found in the server list, is specifically for that server list entry. It ignores the global backup server list.

For simplicity, I'd suggest just using the backup server list found in the server list entry.

Here's an example of how it should be configured:

[tryingtofixit]

thank you so much for the screen shot.  Next. we are going to migrate vpn users off our old primary to d1vpn.com till we can make the same changes to our old primary now reborn as "d2vpn.com".  Seems to me I should have d2vpn.com as the primary and d1vpn.com as the backup. this way anyconnect will not see a d2vpn.com and connect to d1vpn.com.  once I get d2vpn.com up and going, I can deactivate my profiles on d1vpn.com simulating a failure and clients will have to connect to d2vpn.comn.   Or is there a better way? 

[ccieexpert]

the global backup servers are if you have a lot of vpn headends and dont want to configure backups for each headend. But for 2 headend, mentioning in the host entry is better.

Keep in mind that if you keep d2 as primary and its offline, it can take 30 seconds or more to timeout and then failvoer to backup peer, which is not ideal... i would suggest you change your logical names in the profile primary and backup and point to d1 and d2 (you can change that later when d2 is online).

Also it is perfectly fine to put both d1 and d2 in your profile as separate entries (and each other as backup).. just create logical entries for them d1=primary d2=backup so users can see it.. and also change the profile logical name when things change.

Dont have your config, but you can easily test this for getting a feel by just putting a single user in a different group policy and use this new profile, before rolling it out globally. That way you can test how you can change profile settings and see the impact.

[BlakeBratu]

So to clarify, d2vpn.com is primary, d1vpn.com is secondary. You want to have users try to connect to d2vpn.com, and fail to d1vpn.com in the meantime? Once you get d2vpn.com up, users will connect to that FQDN immediately?

That should work, I believe. @ccieexpert has some deeper insight on why it might not be the best option, though.

[ccieexpert]

My main concern is the huge delay 30+ second is the primary headend is not alive until it will switch to backup. that will happen for each connection attempt and each user..

so i would either switch the logical names and point the user to the active unit directly or put both in the drop down list as primary and backup and let users pick one or the other. you can still have backup peers configured for both..