Deploying a standby Module Server

TanOS supports configuration and data sync from an active Tanium Module Server appliance to a standby Module Server appliance. Data, including the Module Server database, is copied to the standby appliance on demand or according to a schedule that you specify.

To protect data consistency, the scheduled TMS sync job stops each solution module service, performs the synchronization, and restarts the service before stopping the next solution module service. Be sure to determine a TMS sync schedule that does not disrupt solution module processes. You might have to adjust scheduled activities for the solution modules accordingly.

Requirements and limitations

A redundant cluster deployment has the following requirements:

  • Each Module Server must be installed on the same appliance model (size).
  • Each Module Server must run the same software version, including build number (for example, each must have build number 7.3.314.3424).
  • The two Module Servers must be able to connect to each other via a reliable Ethernet connection. The connection requires a minimum throughput of 1 Gbps and a maximum round-trip latency of 30 ms.

Before you begin

Set up the IPsec tunnel

IPsec is used to ensure end-to-end security between the two appliances.

  1. Start two SSH terminal sessions so you can copy and paste between them:
    • First Module Server
    • Second Module Server
  2. Sign in to each of the Module Server appliances as a user with the tanadmin role and go to the IPsec menu:
    1. Enter A to go to the Appliance Configuration menu. ClosedView screen
    2. Enter 2 to go to the Networking Configuration menu. ClosedView screen
    3. Enter 2 to go to the IPSEC menu. ClosedView screen
  3. On the second appliance, copy the IPsec host key to the clipboard:
    1. From the IPSEC menu (A-2-2), enter 1 to view the local IPsec host key. ClosedView screen
    2. Copy the key to the clipboard.
  4. On the first appliance, from the IPSEC menu, enter 3 and follow the prompts to configure the IPsec tunnel on the first appliance. When prompted, paste the IPsec host key for the second appliance. ClosedView screen
  5. On the first appliance, copy the IPsec host key to the clipboard:
    1. From the IPSEC menu, enter 1 to view the local IPsec host key.
    2. Copy the key to the clipboard.
  6. Go to the second appliance and complete the IPsec configuration:
    1. From the IPSEC menu, enter 3 and follow the prompts to configure the IPsec tunnel on the second appliance. When prompted, paste the IPsec host key for the first appliance.
    2. Enter 6 to test the connection from the second appliance. ClosedView screen
  7. Go back to the first appliance and enter 6 to test the connection.

Assign Tanium Module Server synchronization role

Indicate which Tanium Module Server in the deployment is the source for synchronization data and which is the target for synchronized data. Specify the active Tanium Module Server as the source, which sends data to the standby Tanium Module Server.

In the event of failover, you can promote the standby Tanium Module Server, which prevents it from receiving data. For more information, see Deploying a standby Module Server.

  1. Sign into the Tanium Server appliance as a user with the tanadmin role.
  2. Enter 2 to go to the Tanium Operations menu.
  3. Enter A to go to the Configure Module Server(s) menu. ClosedView screen
  4. Enter S to open the Assign TMS Role screen. ClosedView screen
  5. Enter the line number of the Tanium Module Server to use as the synchronization source. This is the active Module Server that sends data to the inactive target Module Server. ClosedView screen
  6. Enter S to enable the selected appliance as the synchronization source and press Enter.
    The TanOS console redirects to the Configure Module Server(s) menu.
  7. Enter S to open the Assign TMS Sync Role screen.
  8. Enter the number of the Tanium Module Server to use as the synchronization target. This is the standby Module Server that receives data from the source Module Server.
  9. Enter T and press Enter to enable the selected appliance as the synchronization target and enable synchronization between the source and target.

Perform a manual sync

  1. Sign in to the source Module Server appliance as a user with the tanadmin role.
  2. Enter 2 to go to the Tanium Operations menu.
  3. Enter D to go to the Module Server Sync menu.
  4. Enter 4 to initiate sync. The sync job details are logged to the screen. ClosedView screen