AnsweredAssumed Answered

Can i deploy 2 ESA as primary in same SA server?

Question asked by Rajbir Singh on Jul 29, 2019
Latest reply on Jul 31, 2019 by Rajbir Singh

Dears, 

 

I have a setup with 2 concentrator 2 decoder, 2 ESA, one VLC [HA on Esxi level] and one SA server.  I want my all logs to be present on both Stack at the same time  for that i have configured log forwarding on log decoder 2 and 1 simultaneously, now wanted to configure ESA 1 for Concentrator 1 and ESA 2 for Concentrator 2 but i can see ESA primary and ESA secondary service for installation on ESA hosts. 

 

Purpose is, if any server from stack 1 goes down i can enable stack 2 for the alert, report and investigation ( till then i will disable ESA rules so they cant push alert on respond server). 

 

I remember it was possible in version 10.6 to use 2 ESA as primary, is still SA [version 11.x] server support this type structure? 

or what issue i will face, if i select ESA primary on both ESA server? 

 

Need help if anyone has done this type setup or installation? Please suggest for alternative too. 

 

huan zhou Huan Zhou Huan Zhou David Waugh

Outcomes