Deployment of the Central Node and Sensor components in the form of a cluster includes the following steps:
The first step is to deploy the storage server. After the storage server is deployed, you can add additional storage and processing servers to the cluster.
A cluster must include at least 4 servers: 2 storage servers and 2 processing servers. You can use the Sizing Guide to determine the right number of servers for your organization.
You can deploy the servers in any order.
At the final stage of cluster deployment, you need to configure the scaling settings of the program: specify the planned volume of SPAN traffic, email traffic, the number of hosts with Kaspersky Endpoint Agent, as well as the size of the Storage and event database.
The Central Node component is always installed together with the Sensor component. If you need to use the Central Node component separately, when deploying the processing server, turn off receipt of mirrored traffic from SPAN ports in step 10.