3 nodes epo in a cluster

[User95478885]

Can I create a cluster with 2 EPO nodes in the Primary site and 1 EPO node in the DR site and share 1 SQL server? If I remember correctly that McAfee EPO set up can't do active/active if there are more than 3 nodes. So i only can set up as a Warm/cold/cold set up instead right? If yes, do you guys have a guide on how to set up 3 nodes in a cluster in warm/cold/cold setup?

[cdinet]

No, we don't support any active/active scenario and only support 2 node cluster.  In the event of total failure of the cluster (loss of both nodes), we recommend following the disaster recovery procedure for a cluster.  Just make sure you always have full backups of db and file system of epo server.

[User95478885]

Currently, my setup at my DC site has 2 nodes in a cluster. If I wish to add 1 more node at my DR site. Is it possible? So if DC site Cluster EPO is down then the EPO at DR site with 1 node also can do disaster recovery right?

[cdinet]

As I stated, we do not support more than 2 nodes in a cluster.  You can have 2 servers set up on the dr site without epo installed that are configured as a cluster so if the main site goes down, you can then restore epo to that new clustered environment pointing to a backup of the existing production database.  It should not be the same database the other servers were using unless they will never be able to access it again.

[User95478885]

We have a TIE/DXL/MAR server as well on the PDC site then in DR site, we also require to have one separate TIE/DXL/MAR server for the DR EPO  right?

[cdinet]

That might be a little more difficult since that would require setting it up once epo is restored.  If that server doesn't go down, then the restore should retain that server info, assuming no hostname changes, etc.  You might want to ask that in tie channel.  

https://community.mcafee.com/t5/Threat-Intelligence-Exchange-TIE/bd-p/threat-intelligence-exchange

[User95478885]

For the EPO portion, if I set up the cluster EPO at the DR site, will it be a warm or cold failover? 

[cdinet]

It would be cold.  There is no warm site capabilities with epo.  That is why you would not already have epo installed in the backup site, but just have the servers set up ready to install.  Then you would perform disaster recovery install.  Keep in mind, however, that name and IP changes can break communication, so there would need to be some redirection to the new cluster virtual name/ip.

[User95478885]

Do you have a guide on how to do the redirection to the new vip? 

[cdinet]

KB94721 is all we have and that is a question for DNS admins.  They would handle that.