The Manager Disaster Recovery (MDR) for Trellix IPS Manager provides the ability to inspect traffic through the concept of an active and standby Manager which avoids any downtime. MDR for Virtual Sensors uses the same concept as an MDR which manages the hardware appliances. The MDR pair includes a Primary Manager and a Secondary Manager. One Manager remains in Active state and the other in Standby state. When one of the Managers is not reachable, the other Manager becomes active which allows the Sensor to parse the traffic without any disruption.
The Managers communicate and share their health status through heartbeat. The heartbeat is sent at a pre-defined time interval.
The Virtual IPS Sensor sends alerts to both Managers. When the Secondary Manager becomes active, alerts generated when the Primary was active will be available in the Secondary Manager as well. Furthermore, policies, clusters, and protected groups configured in the Primary Manager are replicated in the Secondary Manager. Once the Primary Manager becomes active again, data from the Secondary Manager are updated in the Primary Manager.
For more information on MDR, see the section Manager Disaster Recovery (MDR) in the Trellix Intrusion Prevention System Product Guide.
