FortiSIEM High Availability

[doosa]

Hi @Community  

I was planning to deploy multisite HA for FortiSIEM deployment with the following current 7.3.5 architecture of 6 nodes.

1 super with DB

3 keepers

2 data/query, which double as event upload workers

I have reviewed #High Availability and Disaster Recovery - ClickHouse | FortiSIEM 7.0.0 | Fortinet Document Library

I already have 6 nodes on the second site ready to go.

kindly suggest the best architecture and load balancer if needed

@FSM_FTNT @Secusaurus,  I would really appreciate your input. 

[AEH · Accepted solution]

Dear @doosa ,

Please note that High Availability (HA) for the Supervisor node requires a license, whereas HA for Collector nodes does not.

(for the collector) The choice of architecture will depend on your existing infrastructure. If load balancers are already available, I recommend using them. If not, and deploying a load balancer is not feasible in terms of cost or time, you can use VRRP to manage failover.

Also , please note that a minimum of 3 sites is required for automated HA (ref : https://docs.fortinet.com/document/fortisiem/7.5.0/high-availability-and-disaster-recovery-procedure...). 2 sites are supported when talking about Manual HA.

for your scenario , please check the Fortinet resource : https://docs.fortinet.com/document/fortisiem/7.5.0/high-availability-and-disaster-recovery-procedure...

Best regards.

[doosa]

Hi @AEH 

The license we are using supports high availability for the supervisor.

The references you provided are based on version 7.5.0 — can these also be applied to version 7.3.5?

Additionally, we have only two sites available, and one of the sites will need to host two deployments.

[AEH]

Hello @doosa ,

You can find the reference for 7.3.5 here : https://docs.fortinet.com/document/fortisiem/7.3.5/high-availability-and-disaster-recovery-procedure...

Best regards.