ASA LOAD BALANCE

HELLO,
ANYONE KNOWS WHAT DEVICE TO USE TO DO ASA LOAD BALANCING?
THANKS

no.
i have 2 physical asa5520. we are thingking of creating 2 context on each asa and configure the ff
asa1
context A - active
context B - passive
asa2
context A - passive
context B - active
thereby we will be having 2 asa's with diff ip address on the outside.
we want the traffic comming in to our web servers to be load balance bet this 2 asa's
thanks

Similar Messages

ASA load balance per destination

Hello,
I have an ASA with version 8.4.4.1 connected via a switch to two routers and I have two default routes on the ASA pointing to the two routers.
The question is : Does the ASA load balance the traffic onto the two routers per-destination or per-packet?
As in routers, CEF load balances the connection per-destination by default. So, what about the ASA regardless of the hardware.
Regards,
George

No. Everything will go to lowest cost route. Matthew

ASA Load-Balancing intriguing question

I have a setup where the inside interface may be in the same private subnet, but the outside interfaces, are most likely in different public subnets.
For example. inside on both ASA: 192.168.1.1 and 192.168.1.2 /24 and the public connected even to two different ISPs.
My guess is that I would probably lose the possibility for failover of the master for load-balancing, in case this ASA goes down, but nevertheless, I would be still interested in that users connect to the same public ip, and that the master gives the fqdn of the other ASA, and balance their Anyconnect entry into the network between both ASAs. Does this works this way?
I mean, does this vpn load-balance feature talks only accross the inside network, or it needs to have same outside subnet mask? Is it a trick of the mask in the interface?
If not, is there a way around that? like this, if use a bogus outside interface and tunnel it somehow to the other outside in the other ASA, will still the offering of fqdn be on, so that the client connects to the other "real" public IP?

you cant route based on source ip with firewall only with router possiable by PBR
you can make to static routes each one point to deffrent router with deffrent metric
in this case it will make the topology like active standby which not good in your case
but you can use sub interfaces on your ASA intis case make each subinterface in deffrent subnet and deffrent security level
and let each subinterface use deffrent hsrp instance
or there is another way
IF you dont use VPN on your ASA u can achive it by useing multiple context
in multiple context you gonna separate your firewall virtualy
so if you have two vlans in your inside network (two deffrent subnets)
then each subnet will use deffrent firewall virtually
u goona divide the internal interface to two subinterfaces
and you can use one outside interface shred between the context or also separate it to two subinterfaces
and allocate those interface to each context
so you gonna deal with each context as deffrent firewall
and you can use deffrent HSRP instance on each context
but with multiple context you cant use VPN on the firewall
*****use the following method*****
THE OTHER WAY WHICH ALSO I SUGIST YOU TO TRY IT WHICH IS THE Transparent Firewall
in the case your firewall will operate in L2 mode
so you can use the routers HSRP IPS AS there is no firewall in the path
which i thnk helpful in you case aslo
in transperante mode the defaultgate way for your client will be the hsrp IP because the firewall will not have any IPs exept for managment
also the useres will be in the same IP subnet as the gateway in your case HSRP VIP
and also you can control the network security through the firewall normally
try this way and let me know
see the following link for configuration
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a008089f467.shtml
please, Rate if helpful

VPN load balancing and ASA !!!

Hi netpros,
I have a couple of questions about this and hope you might be able to assist me.
1.- Are VPN load balancing and failover (Active/Active) mutually exclusive ..? I mean they can't be used at the same time correct ..?
2.- How does the ASA handle the return traffic from the Internal LAN towards the remote client .. Because the cluster only requires ONE public virtual IP address, which will work for incoming packets .. but what about the return traffic which has knowledge of the DHCP scope's default gateway IP address only .. ? How gets the returned packet redirected from the default gateway IP address to the respective ASA internal IP address .?
3.- VPN load balancing only applies to remote clients using easy VPN technology (easy vpn client, hardware client , pIX using easy vpn client etc ) and does not work with static LAN-LAN tunnel .. correct ..?
Your comments are much appreciated

Hi Gilbert ..
1.- Thanks I wanted to make sure.
2.- I know that .. my question is in regards the return packets .. for example if I have the below IP schema:
ASA1: Public 20.20.20.20
Private 192.168.1.1
ASA2: Public 20.20.20.21
Private 192.168.1.2
Cluster virutal IP: 20.20.20.10
Default gateway for segment 192.168.1.0 is 192.168.1.1
Let's say that a vpn client tries to connect and the cluster instructs the client to connect to ASA2 20.20.20.21. The packets reach the internal server at 192.168.1.100. The internal server then sends the return packets back to the client by forwarding them to its default gateway which is 192.168.1.1 (ASA1). Here is my question .. how does the cluster handles this because the return packet are supposed to be directed to ASA2 192.168.1.2
3.- Any idea about this one ..?
Cheers,

ASA 5520 VPN load balancing with Active/Standby failover on 2 devices only...

/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin-top:0in;
mso-para-margin-right:0in;
mso-para-margin-bottom:10.0pt;
mso-para-margin-left:0in;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
This topic has been beat to death, but I did not see a real answer. Here is configuration:
1) 2 x ASA 5520, running 8.2
2) Both ASA are in same outside and inside interface broadcast domains – common Ethernet on interfaces
3) Both ASA are running single context but are active/standby failovers of each other. There are no more ASA’s in the equation. Just these 2. NOTE: this is not a Active/Active failover configuration. This is simply a 1-context active/standby configuration.
4) I want to share VPN load among two devices and retain active/standby failover functionality. Can I use VPN load balancing feature?
This sounds trivial, but I cannot find a clear answer (without testing this); and many people are confusing the issue. Here are some examples of confusion. These do not apply to my scenario.
Active/Active failover is understood to mean only two ASA running multi-contexts. Context 1 is active on ASA1 Context 2 is active on ASA2. They are sharing failover information. Active/Active does not mean two independently configured ASA devices, which do not share failover communication, but do VPN load balancing. It is clear that this latter scenario will work and that both ASA are active, but they are not in the Active/Active configuration definition. Some people are calling VPN load balancing on two unique ASA’s “active/active”, but it is not
The other confusing thing I have seen is that VPN config guide for VPN load balancing mentions configuring separate IP address pools on the VPN devices, so that clients on ASA1 do not have IP address overlap with clients on ASA2. When you configure ip address pool on active ASA1, this gets replicated to standby ASA2. In other words, you cannot have two unique IP address pools on a ASA Active/Standby cluster. I guess I could draw addresses from external DHCP server, and then do some kind of routing. Perhaps this will work?
In any case, any experts out there that can answer question? TIA!

Wow, some good info posted here (both questions and some answers). I'm in a similar situation with a couple of vpn load-balanced pairs... my goal was to get active-standby failover up and running in each pair- then I ran into this thread and saw the first post about the unique IP addr pools (and obviously we can't have unique pools in an active-standby failover rig where the complete config is replicated). So it would seem that these two features are indeed mutually exclusive. Real nice initial post to call this out.
Now I'm wondering if the ASA could actually handle a single addr pool in an active-standby fo rig- *if* the code supported the exchange of addr pool status between the fo members (so they each would know what addrs have been farmed out from this single pool)? Can I get some feedback from folks on this? If this is viable, then I suppose we could submit a feature request to Cisco... not that this would necessarily be supported anytime soon, but it might be worth a try. And I'm also assuming we might need a vip on the inside int as well (not just on the outside), to properly flip the traffic on both sides if the failover occurs (note we're not currently doing this).
Finally, if a member fails in a std load-balanced vpn pair (w/o fo disabled), the remaining member must take over traffic hitting the vip addr (full time)... can someone tell me how this works? And when this pair is working normally (with both members up), do the two systems coordinate who owns the vip at any time to load-balance the traffic? Is this basically how their load-balancing scheme works?
Anyway, pretty cool thread... would really appreciate it if folks could give some feedback on some of the above.
Thanks much,
Mike

Multi-Geography Load-Balancing on ASA

Hi all,
I have two buildings in two diferent locations each one with a Cisco ASA5520 to provide VPN access. I want to configure load-balancing between them but I can´t have both outside interfaces in the same subnet. Reading the document: http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805fda25.shtml, it is stated that "All devices in the virtual cluster must be on the same outside and inside IP subnets" but then, I have some slides from a Cisco Networkers training (26-29 Jan 2009) titled "Deploying Remote Access with SSL VPNs" written by Nadhem J. AlFardan where it sais that it is posible to configure two ASA one in London and one in New York in a cluster to provide load balancing between them.
Does anyone have configured load-balancing between two ASA not sharing the same outside and inside subnetworks? Is there any documentation addressing this issue?
Thanks

Good Question ... I have the same issue ... Can someone please help us? I also looked into Load Balancing utilizing the ASA cluster but unfortunatly realized that "All devices in the virtual cluster must be on the same outside and inside IP subnets" and now I have to come up with another solution ...

ASA Vpn load balancing and failover

Hello all.
We have two asa5520 configured as primary and standby unit in failover configuration, and all is working properly.
Is it possible, with this configuration (failover), to configure vpn load balancing/clustering?
Thanks
Daniele

Hi Wajih,
I am testing this right now. In my case, I want A and B are failover pairs with A as the primary, (A+B) together as one member in cluster with other ASAs C and D. Here is what I found out:
1, After the active/standby working, configure the load banlancing in the master, the cluster IP worked.
2, after "no fail ac" in A, cluster IP stopped working. Seems the vpn load banlance configuration wasn't copied over to the standby B.
3, In the active (now it's the secondary B), manually configure vpn load banlancing, then the cluster IP worked.
4, "no fail ac" in the B and make the the primary A active, the cluster IP still worked.
5, after "no fail ac" in A, cluster IP stopped working. show vpn load and found out the load banlance was disabled.
6, "no fail ac" in the B and make the the primary A active, the cluster IP then worked.
Based on above, the secondary B's VPN load banlance will be disabled when B becomes active in failover role. If that's true, these two features can't work together. Or maybe there is some configuration I'm missing -- maybe having C or D as the cluster master will help. The ASAs are 5510 with 8.4(2)
Thanks,
Rick.

Load Balancing using Virtual IP on DMZ interface of 5520 ASA

We want to achieve a load balancing scenario using Virtual IP on DMZ interface on a Cisco ASA 5520.
The IPs we are going to use on DMZ are 10.15.1.2 and 10.15.1.3
These IPs are going to be NATted to all inside IPs.
Lets say our outside IP is X.X.X.X
This IP points to 10.15.1.2 and 10.15.1.3 with .2 being the primary and .3 being the secondary.
When I hit the outside IP, it should point me to .2 and that .2 should take me to the inside IPs.
I need configuration assistance with that.

Hi Pratik,
The ASA does not support having 1 global/translated IP address on the outside mapped to multiple local/real IP addresses on the DMZ. If it did, the ASA would have no way of deciding if traffic destined to X.X.X.X is really meant for 10.15.1.2 or 10.15.1.3. For this scenario, you should use a dedicated load balancer or a router that supports policy-based routing.
-Mike

ASA and vpn load balancing

Hi,
I am configuring 2 ASA5540 for internet trafic inside to outside ,
outside to inside (web,smtp) but also vpn load balancing for client to site , site to site and webvpn.
In the doc I can configure them for internet trafic as Active/Standby or Active/active.
for vpn : I can use vpn load balancing
But no information if I want to use the active/passif and vpn load balancing together.
Any thoughts on which way to go? what is the best thing to do ?
Regards

Hi,
I think that you cannot use an Active/Active configuration for VPN connections as it is stated on Cisco's documentation: "Note: VPN failover is not supported on units that run in multiple context mode as VPN is not supported in multiple context. VPN failover is available only for Active/Standby Failover configurations in single context configurations" available at http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080834058.shtml
Hope it helps

Cisco ACE - Firewall load balancing

I am using two sets of ACE load balancers for load balancing traffic across two firewalls (firewall load balancing).
The solution works fine. I have a virtual address of 0.0.0.0 in either direction to match traffci going from the internal users to the internet and vice versa.
The problem is that when I try to manage the load-balanced firewalls (either using SSH (or) HTTPS) from outside, then that connection also gets load balanced and when I try to connect to FW1 then sometimes this connection ends up on FW2 and vice versa and the connection gets dropped. I have a workaround in place where i am using a virtual address per firewall to connect to the real IP address of the firewall.
Is there any other way of managing firewalls (which are defined as real-servers) in a FWLB setup.
Attached is the configuration of the external ACE which has the two firewalls defined as the real-servers.
access-list ALL line 8 extended permit ip any any
probe icmp ICMP-Probe
interval 15
passdetect interval 60
rserver host FW1-ASA
ip address 10.11.71.10
inservice
rserver host FW2
ip address 10.11.71.11
inservice
serverfarm host Firewalls
transparent
predictor leastconns
rserver FW1-ASA
    inservice
rserver FW2
    inservice
serverfarm host Firewalls-NO-LB
rserver FW1-ASA
    inservice
serverfarm host Firewalls-NO-LB1
rserver FW2
    inservice
sticky ip-netmask 255.255.255.255 address source new-sticky
timeout activeconns
serverfarm Firewalls
This is my workaround for connection to the IP address of the firewalls (for management)
class-map match-any FW-Real
2 match virtual-address 10.11.71.254 any
class-map match-any FW-Real2
2 match virtual-address 10.11.71.253 any
class-map type management match-any Remote-Access
201 match protocol telnet any
202 match protocol http any
203 match protocol https any
204 match protocol ssh any
205 match protocol snmp any
206 match protocol icmp any
class-map match-any fwlb
2 match virtual-address 0.0.0.0 0.0.0.0 any
policy-map type management first-match Remote-Management-Policy
class Remote-Access
    permit
policy-map type loadbalance first-match FWLB-No-LB
class class-default
    serverfarm Firewalls-NO-LB
policy-map type loadbalance first-match FWLB-No-LB1
class class-default
    serverfarm Firewalls-NO-LB1
policy-map type loadbalance first-match FWLB-l7slb
class class-default
    serverfarm Firewalls
policy-map multi-match Firewall-No-LB
class FW-Real
    loadbalance vip inservice
    loadbalance policy FWLB-No-LB
policy-map multi-match Firewall-No-LB1
class FW-Real2
    loadbalance vip inservice
    loadbalance policy FWLB-No-LB1
policy-map multi-match int70
class fwlb
    loadbalance vip inservice
    loadbalance policy FWLB-l7slb
interface vlan 70
description "Client side"
ip address 10.11.70.2 255.255.255.0
no icmp-guard
access-group input ALL
access-group output ALL
service-policy input Remote-Management-Policy
service-policy input Firewall-No-LB --> connect to the real IP address of the firewall for management
service-policy input Firewall-No-LB1 --> connect to the real IP address of the firewall for management
service-policy input int70
no shutdown
interface vlan 71
description "Firewall side"
ip address 10.11.71.2 255.255.255.0
mac-sticky enable
no icmp-guard
access-group input ALL
access-group output ALL
service-policy input Remote-Management-Policy
no shutdown

Hello,
as i know, there is no others ways.
You can only reduce your configuration by puting all your class undert the same policy-map:
policy-map multi-match int70
class FW-Real
    loadbalance vip inservice
    loadbalance policy FWLB-No-LB
class FW-Real2
    loadbalance vip inservice
    loadbalance policy FWLB-No-LB1
class fwlb
    loadbalance vip inservice
    loadbalance policy FWLB-l7slb
interface vlan 70
description "Client side"
ip address 10.11.70.2 255.255.255.0
no icmp-guard
access-group input ALL
access-group output ALL
service-policy input Remote-Management-Policy
service-policy input int70
no shutdown

Having an issue with vpn load balancing certificate on the vip

Hi all,
I am setting up vpn load balancing in a lab. I have two asa's running 8.6. I created a ucc cert from our internal CA that has the vip as the CN in the cert and the two ASA's themselves as subject alternative names. I used open ssl to create the request. In each asa I am using encryption between the ASA's to encrypt the psk's. Since this is a lab and I do not have the DNS servers at my disposal I've added the hostnames and addresses of each ASA to the config in the ASA's. The problem I have is that when I connect to the vip I get a cert error saying the cert doesn't match the name on the site. See below:
"The security certificate presented by this website was issued for a different website's address."
I have a hostfile on my lab pc connected directly to the outside of the ASA that can resolve the name of the vip but when I browse to the vip I get the cert error. If I click proceed anyway the asa redirects me and the page opens without error on one of the two ASA's.
Does any one know what the CN of the cert should be for vpn load balancing. I thought the CN would be the vip but sometinhg is not right.
Any help is appreciated.
Thanks.

Issue resolved. Switched the order of the trustpoints on the outside and vpn load balance.

Dual ISP load balancing with 2 routers and 2 FW without using BGP

Hi all,
Based on the attachment diagram, is the design viable?
Do anyone has a similar deployment before and can you share with me the config guide to this because I'm at lost on a few configs:
1. On core switch A and B, I understood we need to have a default route pointing to the firewall interface. For this case, I have different IPs for the same context on both the firewalls.
So, how should the config be?
CoreSW_A(config)#ip route 0.0.0.0 0.0.0.0 192.168.1.110
CoreSW_A(config)#ip route 0.0.0.0 0.0.0.0 192.168.1.111
I don't think the above will work as the core switch will load balance the traffic to both firewalls even if one of the context is on standby mode?
2. The area from the firewall to the internet would all be public IP. Thus, if i put a switch in between the firewall and the router, then i would waste some public IP addresses but if i remove the switch, I would not have enough ports on the ASA firewall. What is the best recommended solution for this?
3. How do I load balance traffic to both R1 and R2 to their respective ISPs without using BGP? I may be using only a 2811 router.
Thanks alot!!.. really much looking forward for some guidance and tips on this as I havent found any guides on this deployment yet.. mostly are LAN HA.

For policy based routing, I would need to create route maps on the core switch itself right?
Correct me if I'm wrong, if i use route-maps, i would be assigning e.g. internal network A to go through firewall context A and internal network B to go through firewall context B.
Context A will only have path to Router A and context B will only have path to Router B. But if router B goes down, network B won't be able to access the Internet, right?
I'm not sure whether it's a PI or PA for this as the ISP will assign us a block of IP address, for example 202.111.1.8/29 (these IPs can be used for webservers, etc). There will also be a public IP of /30 on the serial interface to connect to their router.
Thanks alot..

Load balancing with an ASA5510

We have an ASA5510 with two ADSL lines connected and the auto fail-over set up - this is all tested and if the main line fails, the backup line is used in it's place - no problem there.
However, I'd like to increase our connection speed, and one way I've done this in the past is to add a couple of extra ADSL lines to a router that is capable of load balancing.
I'm aware that the ASA5510 does not load balance (seems a waste as we've got the backup line just sitting there doing nothing!), but would it be feasible to add another router in front of the ASA device to perform this load balancing function?
If Yes - any suggestions as to what device I might use?
If No - what would be the issues that would prevent me from doing this?

Thanks for the prompt response Simon
Had a look at the RV016 which seems like it would fit the bill and give us plenty of scope for expansion. I've not set up load balancing on a Cisco before - does it just work (ie auto-detect the connections), or do I need to be aware of licencing etc (as seems to be the case with a lot of cisco features)
With regard to port forwarding, the ASA is already configured and working OK, so I was intending to just push all traffic through to it - my thinkimg being that it's easier to have the config in one place. Is this likely to cause any issues?

Load balancing Internet and Site to Site VPN's across Multiple ISP.

Hi Everyone,
We are currently connected to a single ISP with different Internet related services like mail, web, dns and IPSEC site to site VPN's running. We would be adding another ISP and do load balancing across these multiple links. We are using Cisco ASA firewall.
Can anyone suggest a load balancer which can not only provide load balancing of the links but failover as well for mail,web and IPSEC Site to Site VPN's. I came across Peplink that can achieve this but I guess I will have to decommision our ASA in order to install Peplink.
Check attached diagram, this will be our proposed design.
Regards

Hi Sundeep,
The simplest solution would be to put an IOS router (or two with HSRP) between the ASA and the ISPs and do policy-based routing for your flows between the 2 ISPs. Otherwise, any load balancer should work fine with the ASA. If failover of the load balancer is a requirement, you'll need to look at product specific documentation for whichever solution you choose.
-Mike

Lync Edge DNS Load Balancing call failure to PBX

Hi, I have an issue with a Lync 2013 Implementation involving Edge Servers and PBX calls.
We are trying to configure 2 Edge Servers using DNS Load Balancing. We configured both servers on the topology builder, assign the correct IPs, have 6 Public IPs, 3 for each Edge. Configure NATs behind an ASA firewall, then configured the name of the edge
pool and added each Edge IP for that name on the internal DNS, also checked every port and route to make sure everything works.
All the tests related directly to Lync works, IM, Presence, Audio and Video Conferencing, Desktop Sharing, etc. However, when testing out calls from the PBX System to an Lync External client through the Edge Servers, the call rings, but never connects.
Inside the network, everything works fine, even when using only 1 Edge Server and removing the other one from the topology the call connects to the external user from the internal PBX phone. I even tried it out using one Edge first and then the other to
make sure all ports were open and everything works fine using either one, but only one at the time, not both.
The issue is only present via peer to peer call, if I first make a meet now and invite the external client, the call works.
Am I missing something with the implementation of DNS Load Balancing.
The A Host records on the public DNS have 2 IPs for each record related to Lync Edge Services, example:
access.domain.com 200.10.10.11
200.10.10.12
audiovideo.domain.com 200.10.10.13
200.10.10.14
webconf.domain.com 200.10.10.15
200.10.10.16
Each IP is NAT'd to their respective service in its respective Edge Server. When testing I check that the DNS records are correctly responding from outside.
Any ideas on this particular issue?
Thanks once again!
Eduardo Rojas

Hi Edurojma,
The fact that the call rings, and then drops on answering indicates this is most likely an AV routing issue.
You advised that if you create a conference first through meet now, and then invite the participant, that the call works. But this doesn't work peer to peer.
Can I please ask that you check your static routes on your Edge server. The above sounds like the Edge has a route to your Front End server (which would be hosting the conference, hence the success), but doesn't have a route to the subnet that the client
is residing on (hence the failure).
Your Edge server needs to have routes to every subnet that is in use on your internal network.
I might be going down the wrong track, but this is quite a common problem for implementations where specific routes have been defined rather than catch all routes for every possible private subnet.
Check your edge can route to that phones subnet.
Kind regards
Ben
Blog:www.gecko-studio.co.uk/
Twitter:
LinkedIn:
Facebook:
Note: If you find a post informative, please mark it so using the arrow to the left. If it answers a question you've asked, please mark the thread as answered to aid others when they're looking for solutions to similar problems
or queries.

ASA LOAD BALANCE

Similar Messages

Maybe you are looking for