cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

About SIEM combo box HA

Hi all,

I'm new here so please understand if my question is little bit maladroit.

We have both ESM and ERC with HA configuration and planning to move those server to ESX server as combo box.

So Is that possible to configure SIEM combo box on ESX with HA?

I tried to find it on install guide but couldn't find so If it is possible, please give me some tip or manual where to find.

Thanks a lot in advance.

3 Replies
McAfee Employee stefanvxr8
McAfee Employee
Report Inappropriate Content
Message 2 of 4

Re: About SIEM combo box HA

Unfortunately no. You cannot set up ESM redundancy between two combo boxes, same applies to the ERC component (HA in this case can only be achieved between two physical ERC's), and if you also have a combo running the ELM component, you cannot have ELM redundancy between to combo ELM's either.

Sorry! 🙂

Regards

Stefan

McAfee Employee Anchit
McAfee Employee
Report Inappropriate Content
Message 3 of 4

Re: About SIEM combo box HA

Hi Stefan,

I have 4 questions: 

1. Do we have any option to put ESM, ERC or ELM in Active-Active HA mode or all of them can be configured only in Active-Standby mode ?

2. Can virtual ESM or ELM be configured in HA ?

3. Can we achieve HA in ACE if configured both in same mode (Real-time/ Historical)

4. Can we achieve HA of two virtual ACE ?

Thanks !

Anchit Kharbanda 

McAfee Employee stefanvxr8
McAfee Employee
Report Inappropriate Content
Message 4 of 4

Re: About SIEM combo box HA

Anchit,

Huge apologies to the delay in replying, didn't get a notification for some reason and have been busy out on projects. Answers to your questions below!

1. Do we have any option to put ESM, ERC or ELM in Active-Active HA mode or all of them can be configured only in Active-Standby mode ? They are all Active-Standby, the ERC (Physical only and configured as a HA Pair) will failover as it's a true HA, the ESM and ELM require manual faliover

2. Can virtual ESM or ELM be configured in HA ? You can have a Primary/Redundant model for both on a VM platform, they don't need to be pyhsical appliances

3. Can we achieve HA in ACE if configured both in same mode (Real-time/ Historical) ACE doesn't really have any kind of HA capabililty (Physical or Virtual (in answer to your next question also)). You have a real time ACE and you can have a Historical ACE, now, that's not to say if the Real-time ACE failed you couldn't recover settings to the Historical and make that a Real-time, I've never had to do this, but a seperate Historical ACE is acceptable for use as a 'backup' ACE if needed.

4. Can we achieve HA of two virtual ACE ? See answer above

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator