Cisco ASA 5505 - Manual (Page 1414)

66-6
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 66 Setting General VPN Parameters
Understanding Load Balancing
If the user’s client’s revision number matches one of the specified revision numbers, there is no need to
update the client, and no notification message is sent to the user. VPN 3002 clients update without user
intervention and users receive no notification message.
Note If you specify the client-update type as windows (specifying all Windows-based platforms) and later
want to enter a client-update type of win9x or winnt for the same entity, you must first remove the
windows client type with the no form of the command, then use new client-update commands to specify
the new client types.
Understanding Load Balancing
If you have a remote-access configuration in which you are using two or more ASAs or VPN
Concentrators connected on the same network, you can configure these devices to share their session
load. This feature is called load balancing. To implement load balancing, you group together logically
two or more devices on the same private LAN-to-LAN network, private subnet, and public subnet into a
virtual cluster.
All devices in the virtual cluster carry session loads. Load balancing directs session traffic to the
least-loaded device in the cluster, which distributes the load among all devices. It makes efficient use of
system resources and provides increased performance and high availability.
One device in the virtual cluster, the virtual cluster master, directs incoming traffic to the other devices,
called backup devices. The virtual cluster master monitors all devices in the cluster, keeps track of how
busy each is, and distributes the session load accordingly. The role of virtual cluster master is not tied to
a physical device; it can shift among devices. For example, if the current virtual cluster master fails, one
of the backup devices in the cluster takes over that role and immediately becomes the new virtual cluster
master.
The virtual cluster appears to outside clients as a single virtual cluster IP address. This IP address is not
tied to a specific physical device. This address belongs to the current virtual cluster master, which makes
it virtual. A VPN client attempting to establish a connection connects first to this virtual cluster IP
address. The virtual cluster master then sends back to the client the public IP address of the least-loaded
available host in the cluster. In a second transaction (transparent to the user), the client connects directly
to that host. In this way, the virtual cluster master directs traffic evenly and efficiently across resources.
Note All clients other than the Cisco VPN client or the Cisco 3002 hardware client should connect directly to
the ASA as usual; they do not use the virtual cluster IP address.
If a machine in the cluster fails, the terminated sessions can immediately reconnect to the virtual cluster
IP address. The virtual cluster master then directs these connections to another active device in the
cluster. If the virtual cluster master itself fails, a backup device in the cluster immediately and
automatically takes over as the new virtual session master. Even if several devices in the cluster fail,
users can continue to connect to the cluster as long as any one device in the cluster is up and available.