Alteon Application Switch Operating System Application Guide
Virtual Private Network Load Balancing
692
Document
ID:
RDWR-ALOS-V2900_AG1302
Figure 116: Basic Frame Flow
The basic steps for this example configuration are as follows:
1. The client prepares to send traffic to the destination real server (with IP address E10).
2. The VPN client software encrypts the packet and sends it to the cluster IP address (D3) of the
VPN devices.
3. Alteon 1 makes an entry in the session table and forwards the packet to VPN Device 1.
Note:
Radware recommends using the hash load-balancing metric to select the VPN device.
4. VPN Device 1 strips the IP header and decrypts the encrypted IP header.
5. Alteon 2 forwards the packet to the real server.
If an entry is found, the frame is forwarded normally. If an entry is not found, Alteon determines
which VPN device processed the frame by performing a lookup with the source MAC address of the
frame. If the MAC address matches a MAC address of a VPN device, Alteon adds an entry to the
session table so that reverse traffic is redirected to the same VPN device.
VPN Load-Balancing Persistence
VPN load-balancing persistence ensures that VPN sessions that exist in a load-balanced environment
retain their persistence with the load-balanced server.
Since both the ISAKMP and IPSec protocols are used in a VPN environment, load balancing such an
environment involves maintaining persistence for two protocols. For each user VPN login, the
security associations must be established and key exchanges performed using the ISAKMP protocol
before the IPSec protocols can be sent securely. Alteon redirects the ISAKMP request to a load-
balanced VPN server and creates a session. Subsequent ISAKMP requests are sent to this session.
When the associated IPSec session arrives, Alteon looks for the associated ISAKMP session using
