68-23
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter68 Configuring IKE, Load Balancing, and NAC
Configuring Load Balancing
Configuring Load Balancing
If you have a remote-client configuration in which you are using two or more ASAs connected to the
same network to handle remote sessions, you can configure these devices to share their session load. This
feature is called load balancing. Load balancing directs session traffic to the least loaded device, thus
distributing the load among all devices. It makes efficient use of system resources and provides increased
performance anodize availability.
Note To use VPN load balancing, you must have an ASA Model 5510 with a Plus license or an ASA Model
5520 or higher. VPN load balancing also requires an active 3DES/AES license. The security appliance
checks for the existence of this crypto license before enabling load balancing. If it does not detect an
active 3DES or AES license, the security appliance prevents the enabling of load balancing and also
prevents internal configuration of 3DES by the load balancing system unless the license permits this
usage.
The following sections explain load balancing:
•Eligible Clients
•Enabling Load Balancing
•Creating Virtual Clusters
•Geographical Load Balancing
•Comparing Load Balancing to Failover
•Load Balancing Prerequisites

Eligible Clients

Load balancing is effective only on remote sessions initiated with the following clients:
•Cisco AnyConnect VPN Client (Release 2.0 and later)
•Cisco VPN Client (Release 3.0 and later)
•Cisco ASA 5505 Security Appliance (when acting as an Easy VPN client)
•Cisco VPN 3002 Hardware Client (Release 3.5 or later)
•Cisco PIX 501/506E when acting as an Easy VPN client
•IOS EZVPN Client devices supporting IKE-redirect (IOS 831/871)
•Clientless SSL VPN (not a client)
Load balancing works with IPsec clients and SSL VPN client and clientless sessions. All other VPN
connection types (L2TP, PPTP, L2TP/IPsec), including LAN-to-LAN, can connect to an ASA on which
load balancing is enabled, but they cannot participate in load balancing.

Enabling Load Balancing

This pane lets you enable load balancing on the ASA. Enabling load balancing involves:
•Configuring the load-balancing cluster by establishing a common virtual cluster IP address, UDP
port (if necessary), and IPsec shared secret for the cluster. These values are identical for every device
in the cluster.