We have a website that processes credit card data and uses a load balancer for our two web servers. The SSL connection terminates on the webservers and not the load balancer. Is the load balancer in scope for PCI?
First, IANAQSA (I am not a QSA), but I do deal with PCI a lot.
Using the open scoping toolkit as guidance, the Load Balancer would not be a category 1 system. That is because it does not directly store, process, or transmit unencrypted cardholder information. Given that it opening network connections to the web server (which is a category 1 system), then it would likely be a category 2 system. A category 2 system is still in scope for PCI as it can affect the security of the cardholder data environment (CDE).
I would suggest following the scoping toolkit yourself or engaging a QSA for more information.