We then advertised the LAN subnets to our neighbors and made sure the ASA is their next hop. The BGP feature added was maximum-paths to allow for per session load balancing. We need the static routes for the secondary tunnels because our default route is pointintg towards ISP 1. Many customers are dealing with COVID-19 and need a quick solution to allow their employees to work from home securely. Cisco has put together packages to he. Cisco ASA server load balancing 4 posts Bombay. Seniorius Lurkius Registered: Apr 25, 2007. Posted: Tue Sep 08, 2009 3:04 pm Hi. I have a Cisco ASA 5520 active/active HA configuration. The ASA distributes the traffics to all Interfaces, which means you have the functioning Load balancing, furthermore if you lost one or two Interface the whole traffics will be distribute to the Interfaces which are available. If you run the Port Channel on the ASA then you are permitted to make up to 200 VLANs.

With code 9.7 released Cisco decided to add two VERY important features. Route based VPN with VTIs, and bridge groups! This article will show a quick configuration of a route based VPN with ASAs! Previously to do something like this you would need to build a GRE tunnel over IPSEC with a second router terminating GRE.

[SOLVED] ISP Load Balancing With ASA Routers 5500-X Possible ...

Notice: Currently OSPF, and EIGRP are not yet supported to run over the tunnel interface. Even with the static neighborship command. The tunnel interface won’t turn to a point-to-point link. So as of 2/19/2017 we must use BGP to advertise over this tunnel. Or we can just use static routes. Also BFD is not supported on the tunnel interfaces yet.

Update: as of 9.9.2 BGP is still the only supported protocol, which is not really an issue as we can always redistribute

I was able to get this to work with 0 packet loss!

Here’s a tease of an up VTI!

Cisco Asa Vpn Load Balancing

Network Diagram:

First of all let’s apply some good practice config’s to make this tunnel a little more stable and perform better.

Apply the following to both ASA’s:

the first command clamps the TCP MSS/payload to 1350 bytes, and the second command keeps stateful connections even if the vpn temporarily drops.

North ASA config:

South ASA config:

Note: As of code 9.8.1 IKEv2 is now supported as well, if you’re interested in the IKEv2 version for the config, please see below:
assume this is just one side and the wan on the other ASA’s WAN IP is 2.0.0.2 in the below example.

Let’s discuss the config above. There’s a lot going on here. Eachtunnel interface gets its own tunnel-group. They are sharing an ipsec profile. The VTI’s subnets are 10.10.10.0/24 and 10.10.11.0/24. With the VTIs up we now have point to point links we can route over to the other side. Static OSPF or EIGRP neighborships would fit best here. However like I said above they are not supported yet. Thus we need to use BGP. We then configured BGP with private ASNs. We then advertised the LAN subnets to our neighbors and made sure the ASA is their next hop. The BGP feature added was maximum-paths to allow for per session load balancing. We need the static routes for the secondary tunnels because our default route is pointintg towards ISP 1. If we don’t have it then our secondary tunnels will need to renegotiate and failover won’t be so smooth.

Here’s what the routing table looks like now from the North ASA. Notice the BGP route listed twice? That’s because we enabled multipath/maximum paths.

Asa Load Balancing Nat

Now let’s test failing over the tunnel interfaces by shutting down the WAN.

Notice the second tunnel is still up

We get no ping loss to a host on the other wend of the other ASA, 10.0.1.10.

Cisco Asa Load Balancing Enrolled Certificate

Cisco documentation for reference