topic MEP and LoadDistribution in SASE and Remote Access

MEP and LoadDistribution

Wolfgang — Wed, 18 Sep 2024 07:19:27 GMT

We enabled MEP (MultipleEntryPoints) and LoadDistribution for RemoteAccess VPN (implicit MEP, no configuration via trac_client.ttm file)

It's working but the load is different, we have 80% of the users on one gateway and 20% on the other. Response times of both gateways are the same.

Do we have any chance to define the load or make a decision for the clients? We want to split the load more equal on both gateways.

How is the process which gateway is used ?

Re: MEP and LoadDistribution

emmap — Wed, 18 Sep 2024 07:26:48 GMT

When you enable implicit load distribution, the load distribution is dynamic and the remote client randomly selects a Security Gateway. As far as I know, there's no mechanism to report back to the endpoint which gateway they should connect to in order to load balance things granularly. If one of the gateways is being overloaded with this configuration, you might be better off disabling the load balancing and using First To Respond instead, as the less loaded gateway is more likely to receive the connection that way (assuming latency is equal).

Options are explained here:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/Content/Topics-VPNRG/MEP.htm?TocPath=Multiple%20Entry%20Points%20for%20Remote%20Access%20VPNs%7C_____0#Multiple_Entry_Points_for_Remote_Access_VPNs

Re: MEP and LoadDistribution

Wolfgang — Wed, 18 Sep 2024 07:46:41 GMT

@emmap thanks, that's what we did first, "first to respond"-option. But always the "overloaded" gateway was choosen by the clients.