Multi-Site HA Deployment Implementation in FortiSIEM 7.3.0

[gauravpawar]

How can I achieve Multi-Site (Primary and Secondary)  HA Deployment with following 

3 Supervisors without DB

3 DB servers

3 Keepers

2 workers

with version 7.3.0 

[aebadi]

Hello, Please look to our guide that goes over these setups: 
https://docs.fortinet.com/document/fortisiem/7.3.0/high-availability-and-disaster-recovery-procedure...

[gauravpawar]

Does KVM installation support this ?  

[FSM_FTNT · Accepted solution]

You can use the KVM hypervisor.

For the HA deployment, I would suggest that you start with the following. As you only have two workers and 3 super nodes, it is unlikely from a performance perspective you will need separate CMDB/DB nodes

3 Supervisors with DB

3 Keepers

2 workers

with version 7.3.0

[gauravpawar]

@FSM_FTNT  thanks for the guidance, really appreciated   

[gauravpawar]

@FSM_FTNT I have one more question: Does the setup you suggested function as an automated HA? According to the documentation, "automated HA is supported for hardware appliances, ESX-based VMs, and AWS public cloud." Or will it follow the Leader/Follower Supervisor configuration, as seen in version 7.2.4? Additionally, if the Leader Supervisor goes down, do we need to manually run the script on the Follower node? Also, do we need to add a virtual IP in the DB cluster configuration for this?

[FSM_FTNT]

you can think of it as two tiers:

1) FortiSIEM Super & CMDB
2) FortiSIEM ClickHouse.

Each tier provides its own resilient/HA capabilities.

At tier 1, the Supervisor level, you need 3 Super nodes, and you need to run version 7.3.0 or later for automated failover. Prior versions required a manual step to promote a Super node to a leader.

At tier 2, the ClickHouse level, you have the 2 replicas (if you lose one, data should be in the other, which also increases query performance) and the 3 keepers. The 3 keepers are important for failover as you need 3 for the quorum negotiation. If you lose one of the 3 keepers and one of the worker replicas, failover will be automatic.