Load Balancing in EasyVPN

Posted on 2011-04-25
Last Modified: 2012-05-11

I have a scenario that i need to create EasyVPN Client load balancing with a cisco ASA 5505 and 2 ADSL modems.
A cisco ASA 5510 FW is kept as EasyVPN Server in Head Office. there are two other sites , there cisco ASA5505 FW is kept as vpnclients.
Now in each site i need to add extra ADSL Modem with a new line. i.e there will be one FW and two internet lines. How can I balance the load of VPN traffic in these two lines by dividing users ( IP ) into two IP pools.

There will not be any change in Head office. Only one internet line will be used.

please advise…
Question by:ashraf2002
    LVL 76

    Expert Comment

    LVL 79

    Expert Comment

    You cannot do it. The ASA will not load-balance over dual ISP lines, and only one VPN tunnel will be established. You can do redundant, failover VPN, but not load-balancing.

    Author Comment

    Ok.. thats fine..

    since the FW is in routed mode , can i use 2 interfaces as outside ( lets say outside1 and outside2 ). then create vpn tunnel in each.

    Now lets forget about Load Balancing... instead we will classify the users in two groups ( IP pools ) and each will be routed to Outside interfaces... like group A will take outside1 path and Group B will take outside2 path.

    is it possible to configure like this..?
    LVL 79

    Accepted Solution

    No. There is only 1 default route and you must select Path 1 or 2 for the default.
    You can create multiple site-site VPN tunnels using static routes to the endpoints, but you cannot route to the same remote network over multiple routes.
    What you describe is similar to Source-based or Policy-based routing and the ASA is simply not capable of this feature.

    Author Comment

    OK.. so what would you recommend for this scenario...

    Author Comment

    Should i have a seperate FW.. for each line..?? or is it possible with contexts.. ??

    Author Closing Comment

    It was good...

    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    Join & Write a Comment

    Suggested Solutions

    Title # Comments Views Activity
    Same AnyConnect URL across two datacenters 3 36
    VPN access 5 38
    Cisco VPN gateway issue 6 58
    Android IPSec Tunnel to Cisco ASA? 2 48
    Using Windows 2008 RRAS, I was able to successfully VPN into the network, but I was having problems restricting my test user from accessing certain things on the network.  I used Google in order to try to find out how to stop people from accessing c…
    Like many others, when I created a Windows 2008 RRAS VPN server, I connected via PPTP, and still do, but there are problems that can arise from solely using PPTP.  One particular problem was that the CFO of the company used a Virgin Broadband Wirele…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

    728 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    19 Experts available now in Live!

    Get 1:1 Help Now