FortiSIEM Architecture (Hardware Solution)

[ecalderon]

Hello, 

There's no information available on the docs page about FortiSIEM Hardware. How does licensing work if I want to add devices to the base license? How can I work with an architecture more reliable usign HA or a Supervisor and Workers like it works in the software solution? 

[FSM_FTNT · Accepted solution]

Hi Evelyn,

You can find information regarding the HW here https://docs.fortinet.com/fortisiem/hardware

You can add devices to the  license similar to the VM version, but you must have the HW base license in place to begin with.

From an architecture perspective, consider the HW appliances as a larger Super node with attached storage. The storage is not NFS, but a local disk and as such the HW appliances do not support Worker nodes.

If you require scale out capabilities, you need to use the VM appliances with NFS server and this can utilise the hypervisor to provide a HA design.

Thanks

Dan

[ecalderon]

Thank you Dan! 

Just to confirm. The only way to get a HA design is using the hypervisor capabilities? Does this mean Hardware Appliances do not support High Availability nor Scale out capabilities in any way? 

Best Regards

[FSM_FTNT]

You can add Collectors to take some of the load from the FSM HW appliances and is a method of scaling the system.

However, you cannot add more HW appliances (super + worker(s)) like you can with the Virtual Appliances and therefore restricted to the performance of the selected HW Appliance.

Currently there is no built in HA with the HW appliances such as deploying 2 x FSM 2000F to form a cluster. The HW does have RAID and dual power supplies.

If HA design is a must, then you need to utilise the underlying hypervisor.