Clustering Multiple Core+CM (Windows Detection) Secondary Cores
The Clustered Core feature allows multiple Core detection engines to run in tandem to support larger networks. Juniper ATP Appliance supports additional secondary Core modules for the detonation of both Windows and Mac malware.
The installation procedures for clustering are the same installation procedures set for non-clustered devices.
The first install (perhaps an existing device currently deployed) will be automatically registered as the Primary whenever a second install takes place.
A second (or additional) Core+CM automatically joins the Core Cluster on completion of the CLI Setup Wizard. When the configuration wizard asks for the IP address of the CM, enter the IP address of the Core that was first installed.
Installing Clustered Cores
Install the Secondary Core(s) as described below, then configure the CM IP address to point to the existing Primary and set the device key for all Secondary Cores to match that of the Primary.
Do not change any configuration on the existing Primary device already in use. If all devices are new installations, any device can be the Primary device, and any of the additional devices can be the Secondary Cores. Juniper ATP Appliance supports up to 6 clustered Secondary per Primary installation.
If multiple cores are deployed, only a single license is required. That license only needs to be deployed on the primary core.
After the installation steps are performed (installation steps are shown below and configuration steps are provided in the section Configuring the Juniper ATP Appliance Core/CM System from the CLI), it will take approximately 10 minutes for the Central Manager services to detect the new Secondary Core(s) and initiate detection engine processes on the Secondary Core(s). The Central Manager Web UI will then display the new Secondary Core(s) in the Config->Secondary Cores table from which additional clustered Secondary Core management options can take place.
Allow a few minutes for the Juniper ATP Appliance Server to boot up and be ready to configure, then proceed to Configuring the Juniper ATP Appliance Core/CM System from the CLI to set the CM IP address to point to the existing Primary.
In clustered deployments, all systems must be either be in FIPS mode or not in FIPS mode. This is due to differences in how the device keys are calculated between modes. See FIPS Mode Overview for details.