FortiSIEM High Availability

Question

Hi @Community

I was planning to deploy multisite HA for FortiSIEM deployment with the following current 7.3.5 architecture of 6 nodes.

1 super with DB

3 keepers

2 data/query, which double as event upload workers

I have reviewed #High Availability and Disaster Recovery - ClickHouse | FortiSIEM 7.0.0 | Fortinet Document Library

I already have 6 nodes on the second site ready to go.

kindly suggest the best architecture and load balancer if needed

@FSM_FTNT @Secusaurus, I would really appreciate your input.

AEH · Accepted Answer

Dear @doosa ,Please note that High Availability (HA) for the Supervisor node requires a license, whereas HA for Collector nodes does not.(for the collector) The choice of architecture will depend on your existing infrastructure. If load balancers are already available, I recommend using them. If not, and deploying a load balancer is not feasible in terms of cost or time, you can use VRRP to manage failover.Also , please note that a minimum of 3 sites is required for automated HA (ref : https://docs.fortinet.com/document/fortisiem/7.5.0/high-availability-and-disaster-recovery-procedures-clickhouse/552595/requirements-for-successful-ha-implementation). 2 sites are supported when talking about Manual HA.for your scenario , please check the Fortinet resource : https://docs.fortinet.com/document/fortisiem/7.5.0/high-availability-and-disaster-recovery-procedures-clickhouse/650162/configuring-supervisor-worker-cluster-for-ha-db-insideBest regards.

doosa · Answer

Hi @AEH

The license we are using supports high availability for the supervisor.

The references you provided are based on version 7.5.0 — can these also be applied to version 7.3.5?

Additionally, we have only two sites available, and one of the sites will need to host two deployments.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded