topic Re: Stealthwatch Flow Collectors (Cisco Secure Network Analytics) in Security Analytics

Stealthwatch Flow Collectors (Cisco Secure Network Analytics)

latenaite2011 — Wed, 11 Aug 2021 01:14:07 GMT

Hey Everyone,

Wanted to check if the Stealthwatch Flow Collectors can be configured in failover/high availability mode? I know the Stealthwatch Management Console supports failover but not sure the Stealthwatch Flow Collectors. Looking for best practice. I couldn't find any document on this but it could be that best practice is to install a Stealthwatch Flow Collector at one location and the second Flow Collector as a different location for redundancy but they aren't exactly redundancy but there is another box to receive flow traffic should one location not be available.

thanks!

Re: Stealthwatch Flow Collectors (Cisco Secure Network Analytics)

Marvin Rhoads — Sun, 15 Aug 2021 05:05:57 GMT

A second flow collector that's receiving the same flows exported to it and then integrated with the SMC will just make more work for the flow deduplication.

Personally I think SNA is complicated enough without adding extra complexity of very limited potential value. Better to focus your time on optimizing the core features.

Re: Stealthwatch Flow Collectors (Cisco Secure Network Analytics)

hanjabbo — Sun, 15 Aug 2021 06:39:19 GMT

Stealthwatch is not an inline solution, failover is not mandatory. However to achieve redundancy will require adding a follow collector and licenses in addition to sending the same telemetry twice to two flow collector. The system will then be in Active/Active model with double licensing. Recommended to go with cold failover if it is required.