I'm interested in McAfee ESM system and have a few questions regarding its high availability deployment. However, I can't get enough information from McAfee people in my country. Hope people here can help.
1. How many IP address required for data source NIC when receivers-HA? Just a single shared IP address for primary/secondary? Or 3 IP addresses required, 2 for each and 1 more for VIP?
2. What are HA deployment options available for ELM? Can we associate a single data source to more than one ELM? If it can't be done, what's an option to let logging continue? or we just solely rely on caching feature of receivers and wait for new ELM?
3. For ESM, what are HA options available? If we can put more than 2 ESM into single system, how to sync all configuration between those?
4. Are there any point between components communication where load balacing device recommended?
Thank you very much for your helps.