Always On VPN Load Balancing

Most Always On VPN deployments need more than one VPN server, either for capacity or for redundancy. Placing Windows Server Routing and Remote Access Service (RRAS) servers behind a load balancer spreads client connections across them and keeps users connected when a server fails or is taken down for maintenance. This page covers the requirements for load balancing Always On VPN, why I recommend a dedicated load balancer instead of Windows Network Load Balancing (NLB), and my configuration guides for popular load balancers.

Last updated: November 9, 2026

Load Balancing Requirements

Always On VPN uses two protocols with different load balancing requirements, as described in the following sections.

IKEv2

IKEv2 uses UDP ports 500 and 4500. The load balancer must keep each client on the same server for the life of its connection, using source IP persistence (affinity), because the IKEv2 security associations exist on only one server. IKEv2 also exchanges large certificate payloads that are often fragmented, so the load balancer must handle IP fragments correctly, or IKEv2 fragmentation must be used. When many clients connect from behind the same NAT device, they share one public IP address, which affects how evenly persistence spreads connections. Learn more in Always On VPN IKEv2 Load Balancing and NAT and Always On VPN IKEv2 Features and Limitations.

SSTP

SSTP uses TCP port 443 and runs over TLS, so it load balances much like other HTTPS traffic. Each SSTP connection is a single TCP session, so persistence is less of a concern than with IKEv2. The load balancer can pass TLS through to the RRAS servers or terminate it (TLS offload), which requires additional RRAS configuration. Learn more in Always On VPN SSTP Load Balancing and SSL Offload and Always On VPN SSL Certificate Requirements for SSTP.

Health Checks and Failover

The load balancer should monitor each RRAS server and stop sending new connections to a server that isn’t responding. Clients connected to a failed server reconnect and are directed to a healthy one. For more on how clients behave when a server becomes unavailable, see Always On VPN Servers and Failover.

Network Policy Server (NPS)

If Network Policy Server (NPS) authenticates VPN clients, it needs redundancy too, or a single NPS outage will block every new connection. See Always On VPN and Network Policy Server (NPS) Load Balancing.

Windows Network Load Balancing (NLB)

Windows Server includes Network Load Balancing (NLB), which can cluster RRAS servers without additional hardware or licensing. I don’t recommend it for most deployments, for the following reasons.

  • In unicast mode, NLB floods cluster traffic to every switch port on the network segment, and multicast mode requires switch configuration that many network teams won’t allow.
  • It offers little visibility into or control over traffic, and it is difficult to troubleshoot.
  • It doesn’t work in Azure or other public clouds.
  • NLB supports up to 32 hosts, but DirectAccess supports no more than 8 servers in an NLB cluster.

A dedicated load balancer, physical or virtual, provides better performance, visibility, and health monitoring. If you’re still running DirectAccess on NLB, see Migrating DirectAccess from NLB to External Load Balancer.

Load Balancer Configuration Guides

I’ve published step-by-step guides for configuring the following load balancers with Always On VPN. Guides for DirectAccess, which Microsoft deprecated in June 2024, are included for organizations still running it.

F5 BIG-IP

The F5 BIG-IP is widely deployed in enterprise environments and supports load balancing for both Always On VPN protocols. My F5 BIG-IP guides include the following.

NetScaler ADC

NetScaler ADC, known as Citrix ADC from 2018 to 2023, supports load balancing for both Always On VPN protocols. My NetScaler guides include the following.

Progress Kemp LoadMaster

The Kemp LoadMaster, part of Progress since 2021, is available as a hardware or virtual appliance, including in Azure. My Kemp LoadMaster guides include the following.

Loadbalancer.org

Loadbalancer.org appliances also support Always On VPN load balancing. See Always On VPN Load Balancing with Loadbalancer.org.

Azure and Multisite Deployments

Windows NLB doesn’t work in Azure, so RRAS servers deployed there need Azure Load Balancer or a third-party virtual appliance. Microsoft doesn’t officially support RRAS on Azure virtual machines, so review the alternatives before deploying there. For redundancy across sites, DNS-based global server load balancing, such as Azure Traffic Manager, directs clients to a healthy site. The following articles cover these scenarios.

How I Can Help

I help organizations design and deploy highly available Always On VPN infrastructure. My services include the following.

Learn more about all of my consulting services.

Additional Information

The following resources provide more information about Always On VPN infrastructure.

Start a Conversation

Planning a highly available Always On VPN deployment? Tell me about your environment, and I’ll follow up, typically within one business day.

← Back

Thank you for your response. ✨