Forum Discussion
ElvisS
Nimbostratus
NimbostratusGTM - Cisco Webvpn
Has anyone put 2 Cisco VPN concentrators behind GTM's for load balancing/fault tolerance? If so, any tips on getting the health monitor to work? New to health monitoring and the probe is failing. Any help would be greatly appreciated.
- JRahm
Admin
what probe are you using? Also, is this a pix, IOS-based, or a 3xxx? 
ElvisSI am using an HTTPS probe using port 8443. This is the port that we use for users to log in to webvpn web page. This is an ASA5520 with ASA version 8 software.- ElvisSI am using an HTTPS probe using port 8443. This is the port that we use for users to log in to webvpn web page. This is an ASA5520 with ASA version 8 software.
- JRahmIs you ASA acl configured to allow requests from your GTM on that port?
- ElvisSThere are no restriction on who can access this service. I am new to configuring the HTTPS probe. What is the approriate send string to scan the page for certain content?
- JRahmGET / is the default, I'd start there with no receive string just to make sure that works.
- ElvisSWhen I just use the GET / request the GTM lists the state as timeout. Int the concentrator logs I can see the traffic from the GTM hitting the correct address. Are there any other tests that I can do on the GTM? If I do an nmap scan on that port and it shows the port as open.
- JRahmis the GTM getting a response with the monitor? You could enable additional logging by setting the debug variable in the bigpipe database to see what's going on: b db bigd.debug enable
- ElvisSDoes this affect performance in any way?
Swack_89304I'm trying to do this now as well. Is it possible to have GTM load-balance between Cisco ASA WebVPN appliances (AnyConnect VPN) by monitoring the CPU usage and/or number of existing connections on a given ASA? I was reading in the GTM manual about SNMP monitor but I'm new to this realm and would appreciate any help.Thanks!
Patrick
