Recently, I had the opportunity to deploy the Loadbalancer.org load balancer as part of an enterprise Always On VPN deployment. In the past, I’ve published guidance for using F5 BIG-IP, Citrix ADC (formerly NetScaler), and Kemp LoadMaster, so in this post, I’ll provide guidance for configuring Loadbalancer.org for Always On VPN.

IKEv2

Open the Loadbalancer.org management console and follow the steps below to configure Always On VPN load balancing on the appliance.

Create Virtual Service

Create a layer 4 virtual service for IKEv2.

1. Click Cluster Configuration.
2. Click Layer 4 – Virtual Services.
3. Click Add a new Virtual Service.
4. Enter a descriptive name for the virtual service in the Label field.
5. Enter the virtual IP address (VIP) for the service in the IP Address field.
6. Enter 500,4500 in the Ports field.
7. Select UDP from the Protocol drop-down list.
8. Select NAT from the Forwarding Method drop-down list.
9. Click Update.

Add Real Servers

Add real servers to the virtual service.

1. Click Layer 4 – Real Servers.
2. Click Add a new Real Server next to the IKEv2 virtual service.
3. Enter a descriptive name for the real server in the Label field.
4. Enter the IP address of the real server in the Real Server IP Address field.
5. Click Update.
6. Repeat these steps for each additional VPN server in the cluster.

SSTP

Follow the steps below to configure SSTP load balancing on the appliance.

Create Virtual Service

Create a layer 4 virtual service for SSTP.

1. Click Cluster Configuration.
2. Click Layer 4 – Virtual Services.
3. Click Add a new Virtual Service.
4. Enter a descriptive name for the virtual service in the Label field.
5. Enter the virtual IP address (VIP) for the service in the IP Address field.
6. Enter 443 in the Ports field.
7. Select TCP from the Protocol drop-down list.
8. Select NAT from the Forwarding Method drop-down list.
9. Click Update.

Configure Virtual Service Health Check

Update the health check method for the SSTP virtual service.

1. Click Layer 4 – Virtual Services.
2. Click Modify on the SSTP virtual service.
3. Select Negotiate from the Check Type drop-down list in the Health Checks section.
4. Enter 443 in the Check Port field.
5. Select HTTPS from the Protocol drop-down list.
6. Enter /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ in the Request to send field.
7. Enter 401 in the Response expected field.
8. Click Update.

Note: Using the Negotiate health check type for the SSTP monitor on Loadbalancer.org appliances requires version 8.13.0 or later. Administrators can use the External script option when using earlier releases of Loadbalancer.org appliances. An SSTP health check script for Loadbalancer.org can be found here.

Add Real Servers

Add real servers to the virtual service.

1. Click Layer 4 – Real Servers.
2. Click Add a new Real Server next to the SSTP virtual service.
3. Enter a descriptive name for the real server in the Label field.
4. Enter the IP address of the real server in the Real Server IP Address field.
5. Click Update.
6. Repeat these steps for each additional VPN server in the cluster.

Review

Once complete, click System Overview to view the overall health of your VPN servers.

Summary

The Loadbalancer.org appliance is an efficient, cost-effective, and easy-to-configure load-balancing solution that works well with Always On VPN implementations. It’s available as a physical or virtual appliance. There’s also a cloud-based version. It also includes advanced features such as TLS offload, web application firewall (WAF), global server load balancing (GSLB), and more. If you are looking for a layer 4-7 load balancer for Always On VPN and other workloads, be sure to check them out.

Additional Information

Loadbalancer.org Virtual Appliance

SSTP Health Check Script for Loadbalancer.org