Two Cisco ASAs are set up in a VPN load-balancing configuration to an environment where there are thousands of unique Cisco AnyConnect connections per day. Which scalable IP address assignment…

When multiple ASAs in a load-balancing cluster assign addresses from the same subnet, a centralized DHCP server tracks all active leases and guarantees no IP is issued twice regardless of which ASA handles a given connection. Local pools and RADIUS pools on each ASA have no visibility into leases issued by peer devices, making DHCP the only method that inherently prevents overlap at scale.

Local address pools are managed independently on each ASA, meaning two ASAs can assign the same IP address from the same subnet to different clients simultaneously, causing overlap and routing failures.

RADIUS framed IP assigns a static IP per individual user account, which does not scale to thousands of unique daily connections involving dynamic or unknown users.

RADIUS address pools delegate pool selection to RADIUS but each pool is still assigned and tracked per ASA, which does not prevent the same address from being issued by two different ASAs sharing the same subnet.