Fortinet black logo

SD-WAN Architecture for Enterprise

FortiAnalyzer HA recommendation

7.0.0
Copy Link
Copy Doc ID 7030e0d2-4287-11ec-bdf2-fa163e15d75b:691874
Download PDF

FortiAnalyzer HA recommendation

When deploying FortiAnalyzer in a multitenant environment, high availability (HA) should be considered. This HA consists of a minimum of two FortiAnalyzer units to a maximum of four FortiAnalyzer units. These FortiAnalyzer units are configured in VRRP HA. The FortiGate(s) send the logs to the VIP or FQDN set on the FortiAnalyzer VRRP HA deployment.

A FortiAnalyzer HA cluster provides the following features:

  • Provides real-time redundancy in case a FortiAnalyzer primary unit fails. If the primary unit fails, another unit in the cluster is selected as the primary unit.
  • Synchronizes logs and data securely among multiple FortiAnalyzer units. Some system and configuration settings are also synchronized.
  • Alleviates the load on the primary unit by using secondary (backup) units for processes, such as running reports and FortiView dashboards.

A FortiAnalyzer HA cluster can have a maximum of four units, one primary unit with up to three secondary units. All units in the cluster must be the same FortiAnalyzer model. They need to be in the same network and running in the same operation mode: Analyzer or Collector.

For more details on the Analyzer or Collector mode, see the FortiAnalyzer Admin Guide.

Even though it is an active/passive HA setup, the secondary FortiAnalyzer(s) still participates in a round-robin load share for report creation and SQL query—used to populate the various FortiView dashboards. The main benefit of this mode is the overall performance improvement.

FortiAnalyzer HA recommendation

When deploying FortiAnalyzer in a multitenant environment, high availability (HA) should be considered. This HA consists of a minimum of two FortiAnalyzer units to a maximum of four FortiAnalyzer units. These FortiAnalyzer units are configured in VRRP HA. The FortiGate(s) send the logs to the VIP or FQDN set on the FortiAnalyzer VRRP HA deployment.

A FortiAnalyzer HA cluster provides the following features:

  • Provides real-time redundancy in case a FortiAnalyzer primary unit fails. If the primary unit fails, another unit in the cluster is selected as the primary unit.
  • Synchronizes logs and data securely among multiple FortiAnalyzer units. Some system and configuration settings are also synchronized.
  • Alleviates the load on the primary unit by using secondary (backup) units for processes, such as running reports and FortiView dashboards.

A FortiAnalyzer HA cluster can have a maximum of four units, one primary unit with up to three secondary units. All units in the cluster must be the same FortiAnalyzer model. They need to be in the same network and running in the same operation mode: Analyzer or Collector.

For more details on the Analyzer or Collector mode, see the FortiAnalyzer Admin Guide.

Even though it is an active/passive HA setup, the secondary FortiAnalyzer(s) still participates in a round-robin load share for report creation and SQL query—used to populate the various FortiView dashboards. The main benefit of this mode is the overall performance improvement.