ATD/TIS Loadbalancing and High Availability with two hardware Appliances

[fw_mon]

if I've understood the manual correctly, for HA/LB not just two but at least three appliances (better 4+) are required (please correct me if I'm wrong):

• primary - holds the VIP, configuration, integrations and submissions run through this node
• backup - Receives and analyzes samples. If the primary node fails, the backup node assumes the primary node responsibilities and cluster IP address
• secondary (one or more) - Receives and analyzes samples

I consider it very ineffective.

With just two appliances are two variants possible, it doesn't make sense:

• primary + backup, that provides HA VIP but only one scanning node
• primary + secondary, that provides neigther HA nor LB

For those who have just two sandbox appliances, what is your setup? How you split the traffic, implement LB and HA?

BTW, the MWG MATD configuration accepts several ATD URLs, what if I configure both ATDs and implement some logic that only one appliance process the sample? How to consolidate allowlist, blocklist and reports?

I've considered putting two ATDs behind an external load balancer and apply API for allowlist, blocklist and reports, but then I found out that API can be used for checking only and only single hash value can be verified at a time.

[hsadi · Accepted solution]

Hi fw_mon

In a cluster environment the Primary also scans samples, so the logic is as follow

• primary + backup, that provides HA VIP and LB, both nodes scan samples, primary has a mechanism to distribute the load equally between itself and the Backup
• primary + secondary, it doesn't provide HA but LB will work, as explained above, so both nodes take samples as well.
• So, if you want to have HA and LB i would recommend having a Primary and a Backup
• If you just want LB only, then you could have the Primary and the Secondary, in this set up you don't need the VIP because there won't be HA, so you can use the Primary IP to achieve the LB.

For the half part of your question i would advise to submit the question to MWG support community.

Hope this helps.

[fw_mon]

thank you @hsadi for the explanation!

The description of the clustering in the product guide is very vague and need some rework.

[hsadi]

Hi fw_mon,

I will discuss this with engineering so they can enhance the quality of the product guide.

Best regards,