My knowledge of MARS is very limited. I am considering buying two Cisco Security MARS 25 (CS-MARS-25-K9) units.
This is to allow each system to be installed in different data centers, same geographical location.
This will be in an active/standby configuration.
Is it correct that the license is cheaper for this type of setup ? Can anyone confirm this ?
CS-MARS does not have a concept of active/standby (high availability) operation - there is no data synchornization between the two units. You can have two active CS-MARS with all reporting devices reporting to both. However, when either/both of the two systems is unreachable it will not receive any events during that time and in turn not generate any incidents. The 'standby' unit is used to restore archived data for 'offline' analysis.
Each CS-MARS will require its own license key.
You can reference the 'standby' operational process here: