Next, we'll explore enabling high availability for our VPN infrastructure.
Process is pretty much similar to the NPS server high availability in
that we're going to deploy additional VPN servers,
and then once we've done that,
we will export the VPN configuration from our functioning first or primary
server, and we'll import that on the remaining servers.
We'll need to perform some additional configuration,
though,
because importing and exporting the configuration
doesn't bring all of the settings over,
so there are some optimizations that we do and some finetuning of some of
the security settings that don't come over in that export.
So we'll do that as well.
And then finally, we will enable load balancing.
Administrators have the options when it comes to load balancing VPN servers.
You can use NLB, or the network load balancing, service.
This is a part of Windows, it's a role or a feature built into Windows server,
or you could use an external load balancer,
which is really the preferred method.
The NLB is nice because, again, it is included in Windows,
there is no additional cost to use it,
no additional software or hardware you have to install or configure or deploy.
The challenge with NLB is it does provide limited functionality.
It doesn't have quite the visibility control that you
do with an external load balancer, and also,
there is a fundamental flaw, I think, in NLB,
which is that it's broadcast‑based,
so each node in the cluster will actually perform a
broadcast heartbeat message every second,
so that's a lot of noise on the wire, and of course,
that increases exponentially when you have multiple nodes in the cluster,
so it kind of has an upward limit to it of about 8 nodes functionally speaking,
I think you can get more, but once you get past about 8 nodes in an NLB cluster,
you get to that point of diminishing returns.
The broadcast traffic just becomes so overwhelming that you
don't get a lot of advantage to going past that.
Now, an external load balancer, of course,
those are,
these are available from a variety of third‑parties and
they do come with an additional cost.
I mean,
there are some free versions and maybe that would
suffice in really small deployments, but most often if you need any sort of,
you know, measurable throughput and performance,
you're probably going to have to end up paying for something.
They are available in physical or virtual appliance platforms.
I've deployed virtual appliances countless times.
They work fantastic.
External load balancers do provide advanced functionality.
You do have more fine‑grained control over session persistence and
load balancing algorithms and things like that.
And typically, they operate at Layer 3 through 7,
so they're not broadcast‑based,
and so you get much better performance and so forth
with an external load balancer,
and it's for that reason that I wholeheartedly recommend that if
you're going to use a load balancer for your VPN infrastructure that
you use an external load balancer because that's going to be the
best administrative experience, it's also going to provide you the best performance.