Stealthwatch Flow Collectors (Cisco Secure Network Analytics)

[latenaite2011]

Hey Everyone,

Wanted to check if the Stealthwatch Flow Collectors can be configured in failover/high availability mode? I know the Stealthwatch Management Console supports failover but not sure the Stealthwatch Flow Collectors.  Looking for best practice.  I couldn't find any document on this but it could be that best practice is to install a Stealthwatch Flow Collector at one location and the second Flow Collector as a different location for redundancy but they aren't exactly redundancy but there is another box to receive flow traffic should one location not be available.

thanks!

[Marvin Rhoads]

A second flow collector that's receiving the same flows exported to it and then integrated with the SMC will just make more work for the flow deduplication.

Personally I think SNA is complicated enough without adding extra complexity of very limited potential value. Better to focus your time on optimizing the core features.

[hanjabbo]

Stealthwatch is not an inline solution, failover is not mandatory. However to achieve redundancy will require adding a follow collector and licenses in addition to sending the same telemetry twice to two flow collector. The system will then be in Active/Active model with double licensing. Recommended to go with cold failover if it is required.