Deploying a standby Module Server

TanOS supports configuration and data sync from a primary Module Server appliance to a standby Module Server appliance. Data is copied to the standby appliance on demand or according to a schedule that you specify.

To protect data consistency, the scheduled TMS sync job disables (shuts down) the Module Server and all solution modules for the duration of the TMS sync job. Be sure to determine a TMS sync schedule that does not disrupt solution module processes. You might have to adjust scheduled activities for the solution modules accordingly.

About the standby Module Server

The Module Server service on the standby appliance is not enabled. In the event the primary Module Server appliance is taken out of service:

  1. Enable the Module Server service on the standby appliance.
  2. Reconfigure the Tanium Server(s) connection to the remote Module Server so that it uses the IP address and hostname for the newly active Module Server.

Requirements and limitations

A redundant cluster deployment has the following requirements:

  • Each Module Server must be installed on the same appliance model (size).
  • Each Module Server must run the same software version, including build number (for example, each must have build number 7.3.314.3424).
  • The two Module Servers must be able to connect to each other via a reliable Ethernet connection. The connection requires a minimum throughput of 1 Gbps and a maximum round-trip latency of 30 ms.

Before you begin

  • Configure basic network, host, and user settings on both appliances. See Completing the initial setup (hardware appliances).
    • For best results, allocate a network interface on each Module Server appliance for the redundant cluster sync communication.
    • The interfaces used for the redundant cluster sync communication should not be configured with a default gateway and do not need a default gateway.
    • Specify the IP addresses of the redundant cluster interfaces when you configure the IPsec tunnel.
    • Specify the IP addresses of the Tanium traffic interfaces when you configure the Module Server IP addresses.
  • Make sure your network security administrator has configured security rules to allow communication on the TCP ports that the Tanium core platform components use. In addition to the ports used by individual Module Servers, a Module Server in a cluster sends and receives sync traffic over an IPsec connection. The network security rules must allow ESP (50/ip) and IKE (500/udp, 4500/udp).

Set up the IPsec tunnel

IPsec is used to ensure end-to-end security between the two appliances.

  1. Start two SSH terminal sessions so you can copy and paste between them:
    • First Module Server
    • Second Module Server
  2. Log into each of the Module Server appliances as a user with the tanadmin role and go to the IPsec menu:
    1. From the tanadmin menu, enter A to go to the Appliance Configuration menu. ClosedView screen
    2. Enter 2 to go to the Networking Configuration menu. ClosedView screen
    3. Enter 2 to go to the IPSEC menu. ClosedView screen
  3. On the second appliance, copy the IPsec host key to the clipboard:
    1. From the IPSEC menu (A-2-2), enter 1 to display the local IPsec host key. ClosedView screen
    2. Copy the key to the clipboard.
  4. On the first appliance, from the IPSEC menu, enter 3 and follow the prompts to configure the IPsec tunnel on the first appliance. When prompted, paste the IPsec host key for the second appliance. ClosedView screen
  5. On the first appliance, copy the IPsec host key to the clipboard:
    1. From the IPSEC menu, enter 1 to display the local IPsec host key.
    2. Copy the key to the clipboard.
  6. Go to the second appliance and complete the IPsec configuration:
    1. From the IPSEC menu, enter 3 and follow the prompts to configure the IPsec tunnel on the second appliance. When prompted, paste the IPsec host key for the first appliance.
    2. Enter 6 to test the connection from the second appliance. ClosedView screen
  7. Go back to the first appliance and enter 6 to test the connection.

Configure Sync

  1. Install the primary Module Server and complete the steps to set up the remote Module Server configuration on both the Tanium Server and Module Server as described in Installing an individual Tanium Module Server.
  2. Install the standby Module Server but do not complete the steps to set up the remote Module Server configuration. You complete those steps only when making the standby Module Server active.
  3. Log into the standby Module Server appliance as a user with the tanadmin role and complete the following steps:
    1. Enter 2 to go to the Tanium Operations menu.
    2. Enter D to go to the Module Server Sync menu. ClosedView screen
    3. Enter 3 and follow the prompts to enable sync on the standby Module Server. ClosedView screen
  4. Log into the primary Module Server appliance as a user with the tanadmin role and complete the following steps:
    1. Enter 2 to go to the Tanium Operations menu.
    2. Enter D to go to the Module Server Sync menu.
    3. Enter 3 and follow the prompts to enable sync on the primary Module Server. ClosedView screen

Perform a manual sync

  1. Log into the primary Module Server appliance as a user with the tanadmin role.
  2. From the tanadmin menu, enter 2 to go to the Tanium Operations menu.
  3. Enter D to go to the Module Server Sync menu.
  4. Enter 4 to initiate sync. The sync job details are logged to the screen. ClosedView screen

Schedule sync jobs

  1. Log into the primary Module Server appliance as a user with the tanadmin role.
  2. From the tanadmin menu, enter 2 to go to the Tanium Operations menu.
  3. Enter D to go to the Module Server Sync menu.
  4. Enter 5 to display the Schedule TMS Sync menu. ClosedView screen

    The top of the menu displays active and pending settings. The changes you make are pending until you use menu 7 to make them active.

  5. Use the menu to configure the schedule:
    1. Enter 1 or 2 to toggle the enabled/disabled status for the schedule.
    2. Enter 3 or 4 to set the schedule by days of the month or days in a week.
      • A comma (,) indicates separate days. For example, 1,15.
      • A hyphen (-) indicates contiguous days. For example, mon-fri.
      • Specify days of the week with three-letter abbreviations: sun, mon, tue, wed, thu, fri, sat.
    3. Enter 6 to set the time of day.
    4. Enter 7 to make your changes active.

Display detailed status for Module Server sync

The top of the Module Server Sync menu shows configuration status and the last return code for the sync job. You can use menu 1 to display detailed status.

  1. Log into the Module Server appliance as a user with the tanadmin role.
  2. From the tanadmin menu, enter 2 to go to the Tanium Operations menu.
  3. Enter D to go to the Module Server Sync menu.
  4. Enter 1 to view the status. ClosedView screen

Add the Module server to the Appliance Array

If you set up a Tanium cluster with an Appliance Array, add the standby Module Server to the array.