topic Re: Minemeld High Availability in General Topics

Minemeld High Availability

rchilukuri — Mon, 06 Feb 2017 21:53:26 GMT

MineMeld needs to be deployed in a high availability model, so if one goes down firewall will not start blocking allowed traffic from the rule base. What is the recommendation here?

Re: Minemeld High Availability

lmori — Mon, 06 Feb 2017 22:42:05 GMT

Current suggestion for HA is having 2 MM instances running behind a load balancer. Config sync should be still done manually.

Luigi

Re: Minemeld High Availability

lukjdye — Tue, 07 Feb 2017 22:27:25 GMT

If we don't want to put ti behind a LB, what about having two MM instances, and having PAN pulling both feeds seperatly then incorporating both fo the feeds into the rule base? Do you see any issues with that?

Re: Minemeld High Availability

lmori — Wed, 08 Feb 2017 21:21:06 GMT

Hi @lukjdye,

Great Idea ! I haven't tested this yet, but I think it should work.

Luigi

Re: Minemeld High Availability

irt-unimi — Tue, 14 Feb 2017 16:17:22 GMT

Using two MM instances and two EDLs for the same IP lists adds overhead to the firewall and could hit the EDL IP number limit for your hardware.

If an EDL source URL is unreachable, PAN OS just keeps using the old EDL values, so I would not be overly concerned if you can endure it 24-48 hours.

I would rather like to be warned when MM goes down, so I suggest configuring something like Nagios to ping and check https.

And I would like to be notified if a Miner fails updating a list N times: right now it seems the alert is only shown in the web UI.

Re: Minemeld High Availability

lmori — Wed, 15 Feb 2017 10:29:57 GMT

Good point @irt-unimi. The double EDL solution would be viable only for small EDLs, like O365.

Re: Minemeld High Availability

mmathis — Mon, 23 Apr 2018 21:27:03 GMT

Is this still the reccomendation?

Re: Minemeld High Availability

lmori — Fri, 04 May 2018 08:25:21 GMT

Yes, but we are planning for something more advanced for the next major.

Re: Minemeld High Availability

mmathis — Fri, 04 May 2018 14:25:40 GMT

Thanks! any rough ETA on the next major release?

Re: Minemeld High Availability

nogueirad — Fri, 19 Oct 2018 00:18:56 GMT

Just chekcing in to see if you had a target date for this.

Thanks!

Re: Minemeld High Availability

Piyarat — Thu, 18 Jul 2019 09:18:19 GMT

Hi All,

I have 2 minemeld install on redhat 7.6 and I need to auto sync data between 2 server. I try to setting schedule for backup data via rsync to backup path /opt/minemeld/local/ with user permission but It's not work. I think user doesn't have write permission for minemeld/local/ directory. What is the permission using for backup data via rsync.

Best Regards.

Re: Minemeld High Availability

ScottWare — Tue, 13 Aug 2019 14:48:08 GMT

I'm curious to see about this feature as well. Any new updates to report on?

Thank you!

Re: Minemeld High Availability

akapucu — Mon, 24 Feb 2020 17:41:57 GMT

Re: Minemeld High Availability

g_sanchez — Wed, 19 Aug 2020 01:22:17 GMT

hi @lmori is there any update about this feature?

Re: Minemeld High Availability

John.Petrucci — Fri, 02 Oct 2020 15:47:38 GMT

It's difficult to justify deploying this product in production without support for high availability. Is this someone's side project, or a bonafide Palo Alto product?