Configure load balancers to use multiple Internet Access on-premises gateways as the authentication proxy

When configuring the authentication proxy to be used for Internet Access services, you may choose to use multiple on-premises gateways located behind a load balancer in order to ensure high service availability. The load balancer evenly dispatches authentication requests to the on-premises gateways and adjusts request distribution if one or more on-premises gateways becomes unavailable.

Once a load balancer is deployed and connected to multiple on-premises gateways, you may specify the FQDN or IP address of your load balancer by going to Zero Trust Secure Access → Secure Access Configuration → Internet Access and AI Service Access Configuration → Global Settings and clicking Single Sign-On with Active Directory (On-Premises). For more information, see Configuring NTLM or Kerberos single sign-on with Active Directory (on-premises).

The following common load balancers can be used to configure multiple on-premises gateways for use as the authentication proxy:

• Nginx
• HAProxy
• F5 BIG-IP LTM
• LVS (Linux Virtual Server)
• DNS Round Robin