We have two panorama (M200) in HA with single collector group , local log collector of both panorama we have added in same collector group and enabled redundancy.
Due to low disk-space we want to add one more log collector. So there will be three log-collector in same LC group.
Can I add third LC ,( if Panorama in HA and already added LC's are part of same HA. This third panorama will be not part of HA.)?
How log will redistribute ?
Copy of log will store in all LC's or only in two LC's ? How redundancy will work ?
Please suggest suitable design.
Redundancy already enabled in current setup. Currently A location firewalls forwarding logs to primary panorama LC and B location firewalls to secondary panorama LC. Now in this setup if we add third LC, how redundancy will work and how we can make the changes in log forwarding preference.so both panorama storing copy in each other.
Let's say if from location A firewalls we have chooses to forward logs to new third LC from one firewall. how log copy will store in other LC..same copy will store in both LC ?
Ok, let me see if I can explain better, as I want to confirm and clarify.
Most customers will have 2 virtual log collectors for their HA Panorama. Lets call them LC1 and LC2.
If you have LC1 and LC2 configured, you probably (recommended) to add both LC1 and LC2 into a Collector Group, Let's call this CG1.
Next, you have your FWs forwarding (really, if configured correctly) to CG1 (and NOT LC1 and LC2)... this is benefit of a CG... Now you have log redundancy configured, so if LC1 fails, you will have LC2 to also have the logs.
So if you add in LC3 (new one), you will be adding into CG1. Do your devices care? NO.. because there configured to communicate to CG1. So CG1 will have LC1, LC2, and LC3, with log redundancy.
Does this help?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!