How endpoint devices, XDR Broker VM and XSIAM Cloud communicate in case of HA configuration

[miyako]

Hi Team,

I'd like to know how endpoint devices, XDR Broker VM and XSIAM Cloud communicate in case of HA configuration.

I guess HA configuration may require a virtual IP address to receive logs from endpoint devices and to send the logs to XSIAM Cloud.

For example, there are 3 IP addresses. 

(1)Broker VM A : 10.0.0.5

(2)Broker VM B: 10.0.0.6

(3)Virtual IP address: : 10.0.0.7

To which IP address should endpoint devices send logs ? both (1) and (2)? or (3)?

From which IP address should  XDR Broker VM send logs to XSIAM Cloud? both (1) and (2)? or (3)?

[eluis]

Hi @miyako 

The BVM HA configuration requires FQDN set up which I assume you already did. 

So the FQDN should be the proxy to which your agents will communicate to. 

The former is valid for Cortex XDR and XSIAM 

Please check the doc:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/Broker-VM-High-Av...

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis