An organization wants to distribute remote access VPN load across 12 VPN headend locations supporting 25,000 simultaneous users. Which load balancing method meets this requirement?

Deploying one VPN profile per site requires clients to be pre-assigned or manually select a specific headend profile and does not constitute automatic or dynamic load balancing across multiple locations.

DNS-based load balancing resolves a single VPN hostname to different headend IP addresses using policies such as round-robin, geographic proximity, or weighted distribution, directing each connecting client to an available headend. This approach scales independently of headend architecture across any number of separate sites, making it suitable for 12 locations handling a total of 25,000 simultaneous users without requiring a shared cluster or virtual IP.

AnyConnect native load balancing requires all participating ASA devices to form a cluster sharing a single virtual IP address, which does not extend across 12 independent geographically distributed headend locations.

Equal cost multipath (ECMP) is a routing-layer mechanism that distributes packets across equal-cost forwarding paths and is not a mechanism for balancing VPN session establishment across separate headend appliances.