Recently, I had the opportunity to deploy the Loadbalancer.org load balancer as part of an enterprise Always On VPN deployment. In the past, I’ve published guidance for using F5 BIG-IP, Citrix ADC (formerly NetScaler), and Kemp LoadMaster, so in this post, I’ll provide guidance for configuring Loadbalancer.org for Always On VPN.
IKEv2
Open the Loadbalancer.org management console and follow the steps below to configure Always On VPN load balancing on the appliance.
Create Virtual Service
Create a layer 4 virtual service for IKEv2.
- Click Cluster Configuration.
- Click Layer 4 – Virtual Services.
- Click Add a new Virtual Service.
- Enter a descriptive name for the virtual service in the Label field.
- Enter the virtual IP address (VIP) for the service in the IP Address field.
- Enter 500,4500 in the Ports field.
- Select UDP from the Protocol drop-down list.
- Select NAT from the Forwarding Method drop-down list.
- Click Update.
Add Real Servers
Add real servers to the virtual service.
- Click Layer 4 – Real Servers.
- Click Add a new Real Server next to the IKEv2 virtual service.
- Enter a descriptive name for the real server in the Label field.
- Enter the IP address of the real server in the Real Server IP Address field.
- Click Update.
- Repeat these steps for each additional VPN server in the cluster.
SSTP
Follow the steps below to configure SSTP load balancing on the appliance.
Create Virtual Service
Create a layer 4 virtual service for SSTP.
- Click Cluster Configuration.
- Click Layer 4 – Virtual Services.
- Click Add a new Virtual Service.
- Enter a descriptive name for the virtual service in the Label field.
- Enter the virtual IP address (VIP) for the service in the IP Address field.
- Enter 443 in the Ports field.
- Select TCP from the Protocol drop-down list.
- Select NAT from the Forwarding Method drop-down list.
- Click Update.
Configure Virtual Service Health Check
Update the health check method for the SSTP virtual service.
- Click Layer 4 – Virtual Services.
- Click Modify on the SSTP virtual service.
- Select Negotiate from the Check Type drop-down list in the Health Checks section.
- Enter 443 in the Check Port field.
- Select HTTPS from the Protocol drop-down list.
- Enter /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ in the Request to send field.
- Enter 401 in the Response expected field.
- Click Update.
Note: Using the Negotiate health check type for the SSTP monitor on Loadbalancer.org appliances requires version 8.13.0 or later. Administrators can use the External script option when using earlier releases of Loadbalancer.org appliances. An SSTP health check script for Loadbalancer.org can be found here.
Add Real Servers
Add real servers to the virtual service.
- Click Layer 4 – Real Servers.
- Click Add a new Real Server next to the SSTP virtual service.
- Enter a descriptive name for the real server in the Label field.
- Enter the IP address of the real server in the Real Server IP Address field.
- Click Update.
- Repeat these steps for each additional VPN server in the cluster.
Review
Once complete, click System Overview to view the overall health of your VPN servers.
Summary
The Loadbalancer.org appliance is an efficient, cost-effective, and easy-to-configure load-balancing solution that works well with Always On VPN implementations. It’s available as a physical or virtual appliance. There’s also a cloud-based version. It also includes advanced features such as TLS offload, web application firewall (WAF), global server load balancing (GSLB), and more. If you are looking for a layer 4-7 load balancer for Always On VPN and other workloads, be sure to check them out.
Over the last few weeks, I’ve worked with numerous organizations and individuals troubleshooting connectivity and performance issues associated with Windows 10 Always On VPN, and specifically connections using the Internet Key Exchange version 2 (IKEv2) VPN protocol. An issue that appears with some regularity is when Windows 10 clients fail to connect with error 809. In this scenario, the server will accept connections without issue for a period of time and then suddenly stop accepting requests. When this happens, existing connections continue to work without issue in most cases. Frequently this occurs with Windows Server Routing and Remote Access Service (RRAS) servers configured in a clustered array behind an External Load Balancer (ELB).
The Windows Server Routing and Remote Access Service (RRAS) includes support for the Secure Sockets Tunneling Protocol (SSTP), which is a Microsoft proprietary VPN protocol that uses SSL/TLS for security and privacy of VPN connections. The advantage of using SSTP for Always On VPN is that it is firewall friendly and ensures consistent remote connectivity even behind highly restrictive firewalls.
