--- title: Running the Load-balance a Ivanti Connect Secure Wizard slug: ps/help/en_us/vtm/userguide/running-the-load-balance-a-ivanti-connect-secure-wizard docTags: createdAt: 2026-08-02T07:48:41.955Z --- To run the wizard, click the “Wizards” drop-down menu in the tool bar, then select “Load-balance Ivanti Connect Secure”. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/IJLXnAYDLKyxuc84tT-Et_vtm-pcs-wizardrun.png" position="flex-start" size="80" width="907" height="264" initialPath="images/vtm-pcs-wizardrun.png" githubPath="HTML5/ps-vtm-userguide/images/vtm-pcs-wizardrun.png" showCaption="false" indent="1"} The Virtual Traffic Manager displays the first page of the wizard. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/eyYJ8LJNYS1AvYoESvQue_vtm-pcs-wiz1.png" position="flex-start" size="71" width="705" height="515" initialPath="images/vtm-pcs-wiz1.png" githubPath="HTML5/ps-vtm-userguide/images/vtm-pcs-wiz1.png" showCaption="false" indent="1"} Click **Next** to continue. :::hint{type="info"} On each wizard page, use **Cancel** to cancel the wizard without making any changes to the Virtual Traffic Manager. Use **Back** to return to the previous page and **Next** to continue on to the next page. ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/63xvzqqXtY3CjMOzo80Xv_vtm-pcs-wiz2.png" position="flex-start" size="71" width="705" height="515" initialPath="images/vtm-pcs-wiz2.png" githubPath="HTML5/ps-vtm-userguide/images/vtm-pcs-wiz2.png" showCaption="false" indent="1"} The Virtual Traffic Manager uses the identifier you provider here as a prefix for all configuration objects it creates through this process. Type an identifying name and click **Next** to continue. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/iQgUwdPQdkGacgGSxbVvX_vtm-pcs-wiz3.png" position="flex-start" size="71" width="705" height="515" initialPath="images/vtm-pcs-wiz3.png" githubPath="HTML5/ps-vtm-userguide/images/vtm-pcs-wiz3.png" showCaption="false" indent="1"} Use this page to determine if you want your VPN service to listen on all IP addresses hosted by the Virtual Traffic Manager, or to instead use a previously-defined Traffic IP group. IP addresses assigned to the front-end network interfaces on your Virtual Traffic Managers might not be suitable to use when you publish your VPN service. In the event of a hardware or system failure in your Virtual Traffic Manager cluster, your services would become partially or wholly unavailable. The Virtual Traffic Manager’s fault tolerance capability allows you to configure Traffic IP addresses. These IP addresses are not tied to individual Virtual Traffic Manager instances, and the cluster ensures that each IP address is fully available, even if some of the Virtual Traffic Manager instances have failed. Traffic IP addresses are arranged into a Traffic IP group. You define the group as spanning some or all of your Virtual Traffic Manager instances. Group members negotiate between themselves to share out the Traffic IP addresses, and each Virtual Traffic Manager then raises the IP address (or IP addresses) allocated to it. To learn more about Traffic IP addresses and groups, see [Traffic IP Groups and Fault Tolerance](docId\:Gn-vc9JZkdR0ikpq82kTj). Select an option from the list and click **Next** to continue. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/a9OwFY2Lqk0emJzNgyqeC_vtm-pcs-wiz4.png" position="flex-start" size="71" width="705" height="515" initialPath="images/vtm-pcs-wiz4.png" githubPath="HTML5/ps-vtm-userguide/images/vtm-pcs-wiz4.png" showCaption="false" indent="1"} The Virtual Traffic Manager uses the value you specify here to configure the ESP mode UDP streaming virtual server. Make sure the port number you specify matches the UDP port setting on your PCS instances. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/rN9nGa2tb5eSITpFGk5K7_vtm-pcs-wiz5.png" position="flex-start" size="71" width="705" height="515" initialPath="images/vtm-pcs-wiz5.png" githubPath="HTML5/ps-vtm-userguide/images/vtm-pcs-wiz5.png" showCaption="false" indent="1"} Use this setting to configure the Virtual Traffic Manager to ensure requests sent over HTTP are redirected to a secure HTTPS endpoint. Ivanti recommends consulting the network security policies of your organization before enabling this option. Click **Next** to continue. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/qESmOJjhdiTrytTBvoaoJ_vtm-pcs-wiz6.png" position="flex-start" size="71" width="705" height="515" initialPath="images/vtm-pcs-wiz6.png" githubPath="HTML5/ps-vtm-userguide/images/vtm-pcs-wiz6.png" showCaption="false" indent="1"} Use this page to add your PCS cluster to the Virtual Traffic Manager. For each cluster member, type the hostname or IP address into the **Hostname** field and click **Add PCS instance** to add it to the list. To remove a PCS instance, select the corresponding list entry and click **Remove PCS instance**. Click **Next** to continue. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/4seVSIfiTrIyBLxHkuq_0_vtm-pcs-wiz7.png" position="flex-start" size="71" width="705" height="515" initialPath="images/vtm-pcs-wiz7.png" githubPath="HTML5/ps-vtm-userguide/images/vtm-pcs-wiz7.png" showCaption="false" indent="1"} Through a traditional load-balancing deployment, the Virtual Traffic Manager listens for incoming connections and balances them across your PCS instances. A PCS instance sees the incoming traffic as having originated from the Virtual Traffic Manager’s back-end IP address, and so sends a response back to the same address. The Virtual Traffic Manager then passes this response back to the client. In some circumstances, you might want to propagate the client IP address through to the PCS instance, such that PCS observes the connection as having originated from the client’s own IP address rather than the IP address of the Virtual Traffic Manager. This is known as IP transparency. To enable IP transparency on the VPN service, set **IP transparency** to “Yes”. ATTENTION With IP transparency enabled, PCS addresses its responses back to the IP address of the client that sent the request. However, for transparency to operate correctly, each PCS instance must route its responses back through the Virtual Traffic Manager that sent the request. Therefore, you must configure your PCS instances to use the Virtual Traffic Manager as the default gateway. To learn more about traffic routing with IP transparency, see [Essentials of Network Configuration](docId\:E75uZKY4nahCt2ufFLFq3). For details of how to configure PCS, see the documentation available on the Ivanti website ([www.ivanti.com](http://www.pulsesecure.net)). Click **Next** to continue. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/X54-6BPxrHiXtrqQvyp6Q_vtm-pcs-wiz8.png" position="flex-start" size="71" width="705" height="805" initialPath="images/vtm-pcs-wiz8.png" githubPath="HTML5/ps-vtm-userguide/images/vtm-pcs-wiz8.png" showCaption="false" indent="1"} This page displays a summary of the proposed Virtual Traffic Manager settings. Click **Cancel** to quit the wizard without making any changes, click **Back** to return to the previous page, or click **Finish** to complete the wizard and configure the Virtual Traffic Manager. After the wizard has completed all configuration, the Virtual Traffic Manager Home Page is updated to show all running services. ### Weighted Load Balancing with Service Discovery For Ivanti Connect Secure release 9.1R3 and later, the Virtual Traffic Manager can optionally use Service Discovery to query the number of free license seats on each ICS instance in your deployment. The Virtual Traffic Manager can then use this information with weighted load balancing to avoid over-provisioning a single ICS instance. The Virtual Traffic Manager uses the ICS healthcheck API to discover the number of free license seats, and in turn to bias new connections to devices that report they have a greater license capacity. To use this feature, first make sure your ICS instances are configured to accept healthcheck requests from your Virtual Traffic Manager’s back-end IP address. For details, see the Ivanti Connect Secure documentation on the Ivanti Technical Publications website ([https://www.ivanti.com/support/product-documentation](https://www.pulsesecure.net/techpubs)). To start using the healthcheck API, reconfigure your ICS pools in the Virtual Traffic Manager Admin UI to use the built-in Service Discovery plug-in. Select the Service Discovery sub-section (click **Services > Pools > Edit > Service Discovery**) and complete the following required configuration items: | Configuration Item | Setting | | ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | service\_discovery!enabled | Set to "Yes" | | service\_discovery!plugin | Select "builtin-PCS\_PPS" | | service\_discovery!plugin\_args |
For the HTTPS pool, use the following argument:
--nodes="192.0.2.0:443 192.0.2.1:443" --info
For the ESP pool, use the following argument:
--nodes="192.0.2.0:4500 192.0.2.1:4500" --info
For the --nodes argument, substitute in a space or comma separated list of your ICS node IP addresses, as also specified during the “Load-balance Ivanti Connect Secure” wizard .
The --info argument places INFO messages in the Virtual Traffic Manager Event Log whenever a change is detected in the relative node weights (used by the load-balancing algorithm). If such log message are not required, you can safely omit this argument.
For the ESP pool, make sure the port number you use matches that specified during the “Load-balance Ivanti Connect Secure” wizard . | To save your changes, click **Update**. Note that in the pool edit page, the node list is no longer configurable. Next, select a "Weighted" load-balancing algorithm (click **Services > Pools > Edit > Load Balancing**). You must complete this process for both ICS pools in your Virtual Traffic Manager configuration. To learn more about Service Discovery, see [Service Discovery](docId:6BObYkz8G0H5KhKW7bmlx).