topic Re: Cluster Load Sharing and IPSec VPN in R81.10 in Firewall and Security Management

Cluster Load Sharing and IPSec VPN in R81.10

Hllrdm — Wed, 15 Dec 2021 08:45:47 GMT

I want to enable Cluster Load Sharing on R81.10 using Mobile Access and IPSec VPN blades. When Cluster Load Sharing is enabled. It gives an error "ClusterXL in Load Sharing mode is not supported with IPSec VPN blade enabled.", But according to sk171421 this problem has already been resolved. Why does the error still persist and how can I fix it?

Re: Cluster Load Sharing and IPSec VPN in R81.10

Prabulingam_N1 — Wed, 15 Dec 2021 11:01:53 GMT

Hi,

You have to enable as per this sk162637

(Enabling the support for the ClusterXL Load Sharing mode on the Management Server)

Then try enabling ClusterLS mode in SmartConsole.

Rgs, Prabu

Re: Cluster Load Sharing and IPSec VPN in R81.10

boopathi — Wed, 27 Jul 2022 14:40:57 GMT

Hi,

Even after being enabled as per this SK162637, IPSec VPN Blade is not working. Any suggestion on this issue?

Regards,

Boopathi

Re: Cluster Load Sharing and IPSec VPN in R81.10

PhoneBoy — Wed, 27 Jul 2022 15:07:27 GMT

Define "not working" in more detail.
What precisely did you attempt to do?
What is the precise result you achieved?
Did you set the environment variable on the machine running SmartConsole as described in sk162637?

Re: Cluster Load Sharing and IPSec VPN in R81.10

boopathi — Wed, 27 Jul 2022 15:18:28 GMT

Currently, we are using S2S and RA VPN in our environment on the cluster with HA mode. Due to more load on the gateway, planning to switch load sharing mode so that gateway load will be equally shared but whenever I'm trying to switch load sharing mode from HA mode, the existing S2S and RA VPN are not working.

Did you set the environment variable on the machine running SmartConsole as described in sk162637? Yes.

Re: Cluster Load Sharing and IPSec VPN in R81.10

PhoneBoy — Thu, 28 Jul 2022 18:14:27 GMT

ClusterXL Load Sharing doesn't really result in "equally shared" especially if you end up needed to use Unicast Mode.

What are the precise detailed steps you took to switch from HA to Load Sharing?
And when you say "not working" what is the precise behavior observed?
What are you seeing in logs when it is "not working" if anything?
Screenshots of any and all of the above are likely to help.

Re: Cluster Load Sharing and IPSec VPN in R81.10

Mark_Papworth — Fri, 10 Mar 2023 18:53:05 GMT

I have a similar issue, after upgrading a ClusterXL load-sharing cluster from R80.10 to R81.10. I set both the environment variables as per SK162637 and was able to set the cluster to unicast load-sharing mode.

Remote access Mobile access VPN users cannot connect. They get this error: "Internal error; connection failed" after they are authenticated by Radius server. Logs on SmartConsole do not show any useful information.

In cluster HA mode users do not have issues connecting. Furthermore if I set either gateway administratively down so there is only one active member, users can connect OK. Only when both members are active do users have a problem.

Before the upgrade users had no problem connecting with both gateways active.

Re: Cluster Load Sharing and IPSec VPN in R81.10

PhoneBoy — Sat, 11 Mar 2023 01:36:32 GMT

A TAC case is recommended in this case.

Re: Cluster Load Sharing and IPSec VPN in R81.10

Mark_Papworth — Sat, 11 Mar 2023 01:37:18 GMT

I just found SK179828 and applied the workaround.

Load sharing mode is now working with all VPN users able to connect.

Re: Cluster Load Sharing and IPSec VPN in R81.10

boopathi — Mon, 13 Mar 2023 15:23:21 GMT

Yup, Load sharing mode is now working with all VPN users able to connect, and S2S VPN also working fine. But whenever configured with the new client machine, the VPN is not working after disabling the IKED, it's showing an internal error again.