Can i deploy 2 ESA as primary in same SA server?

[RajveerSingh]

Dears, 

I have a setup with 2 concentrator 2 decoder, 2 ESA, one VLC [HA on Esxi level] and one SA server.  I want my all logs to be present on both Stack at the same time  for that i have configured log forwarding on log decoder 2 and 1 simultaneously, now wanted to configure ESA 1 for Concentrator 1 and ESA 2 for Concentrator 2 but i can see ESA primary and ESA secondary service for installation on ESA hosts. 

Purpose is, if any server from stack 1 goes down i can enable stack 2 for the alert, report and investigation ( till then i will disable ESA rules so they cant push alert on respond server). 

I remember it was possible in version 10.6 to use 2 ESA as primary, is still SA [version 11.x] server support this type structure? 

or what issue i will face, if i select ESA primary on both ESA server? 

Need help if anyone has done this type setup or installation? Please suggest for alternative too. 

huan zhou‌ Huan Zhou‌ Zhou Huan‌ David Waugh‌

[Anonymous]

No, that's currently not supported. If you talk to your local RSA engineer, they can help advise you on the best route to take to make sure such a stack is configured in the best manner. If you're not sure who your engineer is, send me a message letting me know what company you're with and I can have your engineer reach out to you.

[RajveerSingh]

Hi Sean, 

Thank you so much for the response and help proposed for the resolution. I just wanted to know the current version capability in regards having 2 ESA primary at the same time. 

Thanks for the answer and clarifying my doubts. 

[RajveerSingh]

may i know how many days logs we can store on decoder and concentrator without having external storage?

as i can see on series 6 hardware we have only 2x2 TB and 2x 1 TB drive, but I can not see any directory in decoder or concentrator for metadb or packetdb.

[Anonymous]

Discrete 1U Decoders and Concentrators require external storage, either our Powervault appliances or SAN storage. You definitely should contact your RSA representatives if you're unsure what storage should be attached as that would have been discussed prior to shipping those appliances to you.

[RajveerSingh]

Dear Sean,

Thank you so much for the response, your help is much appricated. Will contact to RSA representatives as suggested.