Rico,
If you're not considering clustering, which you probably still should, you can set up Event Collector stacking (white paper on ISS site). It all comes down to your requirements for DR. If a main site is totally destroyed/unavailable, the secondary site needs to be able to perform command and control, as well as monitoring. You also get into key management/TCO issues maintaining two geographically separate sites.
I have not seen an 'official' ISS DR plan. I've been researching this for some time (too much info.,/too time consuming to put in an email. Call me offline if you'd like to discuss.
Bob
Robert J. Craig, CISM, CISSP, SSCP
Senior Security Engineer
NETSEC
13525 Dulles Technology Drive
Herndon, VA 20171
(703) 561-0420
(703) 832-4505 fax
[EMAIL PROTECTED]
http://www.netsec.net
Your Network Security Solution.
=======================================
This electronic message contains information from NETSEC or its affiliates, which may be confidential, proprietary or otherwise protected from disclosure. The information is intended to be used solely by the recipient(s) named above for the purposes intended by the originator. If you are not an intended recipient, be aware that any review, disclosure, copying, distribution or use of this transmission or its contents is prohibited. If you have received this transmission in error, please notify us immediately by telephone at (703) 561-0420, or by electronic mail at [EMAIL PROTECTED]
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Rico Tsang
Sent: Thursday, September 25, 2003 9:45 PM
To: [EMAIL PROTECTED]
Subject: [ISSForum] Setup SiteProtector in DR
Hi,
How can I setup SiteProtector with Network Sensors in a HA or in
a DR environment if I didn't want to consider running Clustering? My objective requires two SiteProtector to be setup such that
they are located in two different locations, managing a number of network sensors. In case the primary SiteProtector is down, the secondary SiteProtector can provide service immediately and ideally, the lost of security events should be minimized.
As far as I know, each Network Sensor can only point to one SiteProtector, right? If the primary SiteProtector is down, how can I make those Network Sensor to fall back to the secondary SiteProtector? Manually reconfigure those Network Sensors?
What's the official way to make two SiteProtectors synchonize their configuration and data?
Regards,
Rico.
_______________________________________________
ISSForum mailing list
[EMAIL PROTECTED]
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo
