Configure multiple SpanVA instances for high availability (Active-Active)

Products

• CASB Securlet SAAS
• CASB Gateway
• CASB Gateway Advanced
• CASB Security Premium
• CASB Security Advanced
• CASB Security Standard

Issue/Introduction

Running one instance of SpanVA, makes it a Single Point of Failure. Having a valid and updated user accounts is very critical especially for the Gatelet users. 

There are a few options provided by most of the virtual infrastructure like taking snapshots of the VM, or Cloning it. Though they may need some level to manual intervention.

This article provides a suggestion on how to configure multiple live SpanVA instances to address the fault tolerance and high availability requirements in an Active-Active topology.

Environment

On-Prem SpanVA with Active Directory Sync configured.

Resolution

Two SpanVA instances with the exact mirrored configuration can run parallel to each other with a reasonable lag time (1 hour or so) so that each one of them will run each other Sync Cycle.

For example:

SpanVA instance 1: runs AD Sync at: 8 AM, 10 AM , 12 PM , 2PM ..etc

SpanVA instance 2: runs AD Sync at: 9 AM, 11 AM, 1 PM , 3 PM ..etc

 

if one of them fail, the Sync rate will be reduced by half (or Sync period will be doubled) but the service won't be lost.