When Anyconnect premium connections exceeded, will AC client move to next server?

[dmooreami]

We have AnyConnect premium which is limited to 100 concurrent users.

When the 101 user tries to connect will the Anyconnect CLIENT (mac or pc) be rejected and move on to the next AnyConnect Server list on the client?I know that if an Anyconnect server or service  is down, the A/C client will auto-redirect to the next one.

Is this the case with you exceed licensed users?

[Cristian Matei]

Hi,

    Never ran into this exact setup (new sessions coming in when the number of max sessions has been reached), but i would say that in this case, because it will receive a "Reject" from the ASA, it will not try a backup server; a backup server is, technically speaking, tried when the primary VPN gateway is not alive, does not respond.

    What you can do is configure 100 users to have the primary ASA to be ASA1, and fallback ASA2, and the other users to have primary ASA to be ASA2, and fallback ASA1.

Regards,

Cristian Matei.

[dmooreami]

I spoke with a CCIE Security.

He said that connection 101 will be rejected, and the A/C will move down to the next VPN server

[Cristian Matei]

Hi,

   Test it out.

Regards,

Cristian Matei.

[Marvin Rhoads]

He was wrong. :)

A responsive server without any available license will fail as @Cristian Matei noted. There is no mechanism to move to the next server in the available connection profile as long as the first server is responding.

That said, if the licenses are AnyConnect 4.x type the server will allocate sessions up to the maximum allowed on the platform, no matter how many were purchased. It is up to the admin to ensure they are compliant with the purchased number of licenses (per unique user).