QRadar Network Insights appliance stacking
You can stack QRadar Network Insights appliances to scale performance by load balancing the network packet data across multiple appliances. By distributing the data processing and analysis, stacked appliances can help you handle higher data volumes and improve flow throughput performance at the highest inspection levels.
Only the QRadar Network Insights 1920 (appliance type 6200) and QRadar Network Insights 1940 (appliance type 6600 and 6610) appliances can be stacked. All appliances in the stack must be the same appliance type. For example, you cannot put QRadar Network Insights 1920 and 1940 appliances in the same stack, and you cannot create a stack that has a combination of 6200, 6600, or 6610 appliances.
You can have more than one stack in a deployment, and each stack can have a maximum of four appliances. If any of the appliances in the stack experience a failure and becomes unavailable, the entire stack is impacted. For example, if the first appliance in a stack has a hardware failure, the data is not received by the rest of the stacked appliances.
You cannot stack the QRadar Network Insights 1901 appliance, and you cannot stack appliances in a software installation.
When you stack appliances, you must also change the network cable configuration. Placement and orientation of network cards differs depending on which appliance that you are installing. To view the cabling diagrams for your appliance, see QRadar Network Insights appliances.
Stacking 1920 appliances
You can stack the QRadar Network Insights appliances (type 6200). Each QRadar Network Insights 1920 appliance is configured with 2 Napatech cards. The port configuration on the first Napatech card changes, depending on whether the appliance is part of a standalone configuration or a stacked configuration.
- Standalone configuration
- In a standalone configuration, the four ports on the first Napatech card are configured to
accept inbound traffic from the network tap.
The second Napatech card is a load balancer that is configured internally. Do not use the ports on this card; if you use them, you do not get any data.
- Stacked configuration
- In a stacked configuration, the four ports on the first Napatech card are reconfigured, two ports for inbound traffic and two ports for outbound traffic. The ports are configured as linked pairs, so the data that comes in on port 0 goes out on port 2, and the data that comes in on port 1 goes out on port 3.
Stacking 1940 appliances
You can stack the QRadar Network Insights 1940 (type 6600 and 6610) appliances to distribute network packets across multiple Napatech cards. Stacking the appliances can help you handle higher data volumes and inspect more traffic. Each QRadar Network Insights 1940 appliance is configured with two Napatech cards. The port configuration on the first Napatech card changes, depending on whether the appliance is part of a stand-alone configuration or a stacked configuration.
- Stand-alone configuration
- In a stand-alone configuration, the two ports on the first Napatech card are configured to
accept inbound traffic from the network tap.
The second Napatech card is a load balancer that is configured internally. Do not use the ports on this card; if you use them, you do not get any data.
- Stacked configuration
- In a stacked configuration, the two ports on the first Napatech card are reconfigured so that
one port is for inbound traffic and one port is for outbound traffic.
The ports are configured so that the data comes in on port 0, and goes out on port 1. On the first appliance, port 0 is used for the network tap or span port. The traffic is then mirrored to Port 1 on the same card, which sends data to port 0 of the next appliance in the stack.
Similar to a stand-alone configuration, the second Napatech card cannot be used in a stacked configuration.