topic Re: want to add third log collector in Panorama HA in Panorama Discussions

want to add third log collector in Panorama HA

Deepak25 — Wed, 25 Aug 2021 13:25:31 GMT

We have two panorama (M200) in HA with single collector group , local log collector of both panorama we have added in same collector group and enabled redundancy.

Due to low disk-space we want to add one more log collector. So there will be three log-collector in same LC group.

Can I add third LC ,( if Panorama in HA and already added LC's are part of same HA. This third panorama will be not part of HA.)?

How log will redistribute ?

Copy of log will store in all LC's or only in two LC's ? How redundancy will work ?

Please suggest suitable design.

Re: want to add third log collector in Panorama HA

S.Cantwell — Wed, 25 Aug 2021 14:47:30 GMT

Good Morning

Inside of your Collector Group, there is a check box for "Enable Log Redundancy across collectors", so the logs are seen across all LCs. This is what you will need to implement.

Thanks.

Re: want to add third log collector in Panorama HA

Deepak25 — Wed, 25 Aug 2021 15:00:56 GMT

Redundancy already enabled in current setup. Currently A location firewalls forwarding logs to primary panorama LC and B location firewalls to secondary panorama LC. Now in this setup if we add third LC, how redundancy will work and how we can make the changes in log forwarding preference.so both panorama storing copy in each other.

Let's say if from location A firewalls we have chooses to forward logs to new third LC from one firewall. how log copy will store in other LC..same copy will store in both LC ?

Re: want to add third log collector in Panorama HA

S.Cantwell — Wed, 25 Aug 2021 15:10:47 GMT

Ok, let me see if I can explain better, as I want to confirm and clarify.

Most customers will have 2 virtual log collectors for their HA Panorama. Lets call them LC1 and LC2.

If you have LC1 and LC2 configured, you probably (recommended) to add both LC1 and LC2 into a Collector Group, Let's call this CG1.

Next, you have your FWs forwarding (really, if configured correctly) to CG1 (and NOT LC1 and LC2)... this is benefit of a CG... Now you have log redundancy configured, so if LC1 fails, you will have LC2 to also have the logs.

So if you add in LC3 (new one), you will be adding into CG1. Do your devices care? NO.. because there configured to communicate to CG1. So CG1 will have LC1, LC2, and LC3, with log redundancy.

Does this help?

Re: want to add third log collector in Panorama HA

Deepak25 — Thu, 26 Aug 2021 04:16:36 GMT

Hi Steve,

Thank you for answer.

I understand , but as we have log forwarding preference..if LC1 receiving logs , duplicate copy will store in LC2 or in both (LC2 and LC3) ?

Re: want to add third log collector in Panorama HA

S.Cantwell — Thu, 26 Aug 2021 18:32:23 GMT

As I understand it... both.

Re: want to add third log collector in Panorama HA

JeffKim — Tue, 18 Jan 2022 17:27:51 GMT

Hi Steve,

How do we ponting to CG , not LC1 or LC2 ?

We are forwarding log to Panorama , Those are HA mode and LC1 is primary and LC2 is secondary Panorama and we have one CG.

Re: want to add third log collector in Panorama HA

JeffKim — Wed, 19 Jan 2022 03:44:42 GMT

Hi Deepak25,

Did you deploy 3rd LC in your environment?

Could you share your experience ? How could you deploy it and what's the benefit of 3rd LC ...