Cluster Load Sharing and IPSec VPN in R81.10

[Hllrdm]

I want to enable Cluster Load Sharing on R81.10 using Mobile Access and IPSec VPN blades. When Cluster Load Sharing is enabled. It gives an error "ClusterXL in Load Sharing mode is not supported with IPSec VPN blade enabled.", But according to sk171421 this problem has already been resolved. Why does the error still persist and how can I fix it?

[Prabulingam_N1 · Accepted solution]

Hi,

You have to enable as per this sk162637

(Enabling the support for the ClusterXL Load Sharing mode on the Management Server)

Then try enabling ClusterLS mode in SmartConsole.

Rgs, Prabu

[boopathi]

Hi, 

Even after being enabled as per this SK162637, IPSec VPN Blade is not working. Any suggestion on this issue?

Regards,

Boopathi

[PhoneBoy]

Define "not working" in more detail.
What precisely did you attempt to do?
What is the precise result you achieved?
Did you set the environment variable on the machine running SmartConsole as described in sk162637?

[boopathi]

Currently, we are using S2S and RA VPN in our environment on the cluster with HA mode. Due to more load on the gateway, planning to switch load sharing mode so that gateway load will be equally shared but whenever I'm trying to switch load sharing mode from HA mode, the existing S2S and RA VPN are not working.

Did you set the environment variable on the machine running SmartConsole as described in sk162637? Yes.

[PhoneBoy]

ClusterXL Load Sharing doesn't really result in "equally shared" especially if you end up needed to use Unicast Mode.

What are the precise detailed steps you took to switch from HA to Load Sharing?
And when you say "not working" what is the precise behavior observed?
What are you seeing in logs when it is "not working" if anything?
Screenshots of any and all of the above are likely to help.

[Mark_Papworth]

I have a similar issue, after upgrading a ClusterXL load-sharing cluster from R80.10 to R81.10. I set both the environment variables as per SK162637 and was able to set the cluster to unicast load-sharing mode.

Remote access Mobile access VPN users cannot connect. They get this error: "Internal error; connection failed" after they are authenticated by Radius server. Logs on SmartConsole do not show any useful information.

In cluster HA mode users do not have issues connecting. Furthermore if I set either gateway administratively down so there is only one active member, users can connect OK. Only when both members are active do users have a problem.

Before the upgrade users had no problem connecting with both gateways active.

[PhoneBoy]

A TAC case is recommended in this case.

[Mark_Papworth]

I just found SK179828 and applied the workaround.

Load sharing mode is now working with all VPN users able to connect.

[boopathi]

Yup, Load sharing mode is now working with all VPN users able to connect, and S2S VPN also working fine. But whenever configured with the new client machine, the VPN is not working after disabling the IKED, it's showing an internal error again.