Where to place Load Balancer for Redundant Heavy Forwarder ans Syslog Collector

[ojay]

Hi all,

I'm planning an architecture with a redundant Heavy Forwarder and double Syslog collector Servers.

Where do i place a Load Balancer? and how do these Components communicate in terms of Ports and Firewalls? What do i need to plan? 

I cant find the right places to read about this in the documentation.

Thank you for your help in advance.

Oj.

[gcusello]

Hi @ojay,

you have to put the Load balancer in front of the two (or more) Heavy Forwarders.

In other words, you configure on the LB a virtual IP to use as front end to receive syslogs from your appliances.

Then the LB sends these logs to the HFs on the ports you opened.

About ports, you could use the same ports on LB and HFs (e.g. 514).

About firewalls rules, if they are on the same network there isn't any problem, if they are in diferent networks, you have to open the relative routes between LB and HFs.

Remember to configure an heart beat on the HFs so the LB can know if the HFs are alive: e.g. you could create an alert that pings the LB every minute.

Ciao.

Giuseppe