want to add third log collector in Panorama HA

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

want to add third log collector in Panorama HA

L3 Networker

We have two panorama (M200) in HA with single collector group , local log collector of both panorama we have added in same collector group and enabled redundancy.

Due to low disk-space we want to add one more log collector. So there will be three log-collector in same LC group.

 

Can I add third LC ,( if Panorama in HA and already added LC's are part of same HA. This third panorama will be not part of HA.)?

How log will redistribute ?

Copy of log will store in all LC's or only in two LC's ? How redundancy will work ?

 

Please suggest suitable design.

 

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Good Morning

 

Inside of your Collector Group, there is a check box for "Enable Log Redundancy across collectors", so the logs are seen across all LCs. This is what you will need to implement.

 

Thanks.

Help the community: Like helpful comments and mark solutions

View solution in original post

7 REPLIES 7

Cyber Elite
Cyber Elite

Good Morning

 

Inside of your Collector Group, there is a check box for "Enable Log Redundancy across collectors", so the logs are seen across all LCs. This is what you will need to implement.

 

Thanks.

Help the community: Like helpful comments and mark solutions

Redundancy already enabled in current setup. Currently A location firewalls forwarding logs to primary panorama LC and B location firewalls to secondary panorama LC. Now in this setup if we add third LC, how redundancy will work and how we can make the changes in log forwarding preference.so both panorama storing copy in each other.

 

Let's say if from location A firewalls we have chooses to forward logs to new third LC from one firewall. how log copy will store in other LC..same copy will store in both LC ?

Ok, let me see if I can explain better, as I want to confirm and clarify.

 

Most customers will have 2 virtual log collectors for their HA Panorama.  Lets call them LC1 and LC2.

If you have LC1 and LC2 configured, you probably (recommended) to add both LC1 and LC2 into a Collector Group, Let's call this CG1.

 

Next, you have your FWs forwarding (really, if configured correctly) to CG1 (and NOT LC1 and LC2)... this is benefit of a CG...  Now you have log redundancy configured, so if LC1 fails, you will have LC2 to also have the logs. 

 

So if you add in LC3 (new one), you will be adding into CG1.  Do your devices care?  NO.. because there configured to communicate to CG1.   So CG1 will have LC1, LC2, and LC3, with log redundancy.

 

Does this help?

 

Help the community: Like helpful comments and mark solutions

Hi Steve, 

Thank you for answer.

I understand , but as we have log forwarding preference..if LC1 receiving logs , duplicate copy will store in LC2 or in both (LC2 and LC3) ?

As I understand it... both.

Help the community: Like helpful comments and mark solutions

Hi Steve,

 

How do we ponting to CG , not LC1 or LC2 ?

 

We are forwarding log to Panorama , Those are HA mode and LC1 is primary and LC2 is secondary Panorama and we have one CG.

Hi Deepak25,

 

Did you deploy 3rd LC in your environment?

 

Could you share your experience ? How could you deploy it and what's the benefit of 3rd LC ... 

 

  • 1 accepted solution
  • 3483 Views
  • 7 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!