topic BrokerVM HA cluster in Cortex XDR Discussions

BrokerVM HA cluster

Sadig — Fri, 09 Feb 2024 20:24:57 GMT

Hi team,

I created cluster from scratch and added here 2 brokervm, then for new cluster I assigned dedicated IP address and FQDN, then in local DNS is created A record using ha cluster FQDN and dedicated IP address. Is ti true way? because I tried to install cortex xdr agent to endpoint using HA cluster IP as proxy list but no connection established from endpoint to to brokervm ha cluster. Where is my mistake?

Re: BrokerVM HA cluster

abdrahman — Mon, 12 Feb 2024 07:28:30 GMT

Dear @Sadig

Hope you are doing well, and thank you for reaching out to the Live Community. From the query abouve I see you are trying to create a Broker VM cluster and redirect the endpoint to the cluster. Please find the documentation I have linked below on how to properly set up or configure the HA cluster for Broker VMs. Thank you:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Add-Broker-VM-to-Cluster?tocId=cOnCzHrf8AtE6hOvhbewgQ

Once the cluster is formed properly, you should be able to direct the endpoint in the correct direction. Thank you.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Re: BrokerVM HA cluster

Rocky-25 — Mon, 12 Feb 2024 07:40:41 GMT

Hi Sadig

For "active/active" applets that require load balancing, you must install a Load Balancer in your network to distribute the incoming data between the nodes. See the reference here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Broker-VM-High-Availability-Cluster

The Load Balancer is not provided with the Broker HA Cluster functionality. This has to be done seperately.

Hope that helps. Best Regards

Re: BrokerVM HA cluster

Sadig — Mon, 12 Feb 2024 07:38:14 GMT

Hi Abdrahman,

Thank you for answering my question.

I already know and have done these parts. Unfortunately, no one can explain the technical details. A separate IP address has been assigned to the HA cluster - should it be registered with a different FQDN in the local DNS?