66-7
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter66 Setting General VPN Parameters
Understanding Load Balancing
Comparing Load Balancing to Failover
Both load balancing and failover are high-availability features, but they function differently and have
different requirements. In some circumstances you can use both load balancing and failover. The
following sections describe the differences between these features.

Load Balancing

Load balancing is a mechanism for equitably distributing remote-access VPN traffic among the devices
in a virtual cluster. It is based on simple distribution of traffic without taking into account throughput or
other factors. A load-balancing cluster consists of two or more devices, one is the virtual master, and the
other devices are the backup. These devices do not need to be of the exact same type, or have identical
software versions or configurations.
All active devices in a virtual cluster carry session loads. Load balancing directs traffic to the
least-loaded device in the cluster, distributing the load among all devices. It makes efficient use of
system resources and provides increased performance and high availability.

Failover

A failover configuration requires two identical ASAs connected to each other through a dedicated
failover link and, optionally, a stateful failover link. The health of the active interfaces and units is
monitored to determine when specific failover conditions are met. If those conditions occur, failover
occurs. Failover supports both VPN and firewall configurations.
The ASA supports two failover configurations: Active/Active failover and Active/Standby failover. VPN
connections run only in Active/Standby, single routed mode. Active/Active failover requires a
multicontext mode, so does not support VPN connections.
With Active/Active failover, both units can pass network traffic. This is not true load balancing, although
it might appear to have the same effect. When failover occurs, the remaining active unit takes over
passing the combined traffic, based on the configured parameters. Therefore, when configuring
Active/Active failover, you must make sure that the combined traffic for both units is within the capacity
of each unit.
With Active/Standby failover, only one unit passes traffic, while the other unit waits in a standby state
and does not pass tra ffic. Active/Standby failover lets you use a second ASA to take over the functions
of a failed unit. When the active unit fails, it changes to the standby state, while the standby unit changes
to the active state. The unit that becomes active assumes the IP addresses (or, for transparent firewall,
the management IP address) and MAC addresses of the failed unit and begins passing traffic. The unit
that is now in standby state takes over the standby IP addresses of the active unit. If an active unit fails,
the standby takes over without any interruption to the client VPN tunnel.
Implementing Load Balancing
Enabling load balancing involves:
•Configuring the load-balancing cluster by establishing a common virtual cluster IP address, UDP
port (if necessary), and IPsec shared secret for the cluster. You configure these values identically for
every device in the cluster.
•Configuring the participating device by enabling load balancing on the device and defining
device-specific properties. These values vary from device to device.