Management HA & Reporting

[biskit]

Hi everyone.  I'm looking for some advice and guidance please regarding Management HA and Event/Reporting.

My customer currently has 2 sites.  The FW cluster is split across these sites, one member in each, and there is full replication of all other server at both sites - mostly VMware.  My SMS is running on VMware at Site 1.  The idea has always been that if there's a problem at Site 1, they can just spin that server up over at Site 2 and carry on.  Last week they had a problem affecting the VMware platform itself, so they lost the SMS (for a while) and also couldn't spin it up elsewhere.  So now they want to explore their options.

Ordinarily I'd suggest Management HA, with the HA SMS running at Site 2.

The thing that I can't figure out is what happens with Event & Reporting  (Currently in use on SMS 1)?

Is it as easy as spinning up a HA SMS at site 2, ticking the Event & Reporting boxes and having the cluster log to both SMS's?

Or in the case of Management HA is there a better way of handling Event/Reporting?  Because ultimately the customer will expect Event/Reporting HA too.

Interested in your thoughts 😀

Thanks,

Matt

[mdjmcnally · Accepted solution]

SmartEvent is not supported to be run on a Management HA solution

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

As such you would need to deploy a seperate SmartEvent box dedicated to just being the SmartEvent.

That box would then need to connect to both SMS boxes so that can process logs.

Best you would be able to do is vmware migrate the machine across to site 2 as you do for the SMS now.

[biskit]

Good spot, thanks!