topic Index cluster Migration to FIPS- Am I going to have any interoperability issues? in Splunk Enterprise

Index cluster Migration to FIPS- Am I going to have any interoperability issues?

bstimely — Wed, 26 Apr 2023 20:04:30 GMT

I have a large single site index cluster running 9.0.4 . Inter server communication is secured with third party certificates. The hosts are all older Linux boxes. I need to move to RHEL8 and turn on FIPS. Am I going to have any interoperability issues communication in the Cluster with some FIPS and some Non FIPS systems with certificates created without FIPS?

Re: Index cluster Migration to FIPS- Am I going to have any interoperability issues?

VatsalJagani — Thu, 27 Apr 2023 09:02:54 GMT

@bstimely - Ideal way to perform this migration is as follows:

For this, you need to have ReplicationFactor at least 2.
Create a totally new Indexer on FIPS.
- Do all the configuration of certificates and stuff.
Add the new indexer to the cluster.
- Make sure your new indexer is getting the new data. And also some data is being replicated from old Indexers to this new indexer.
Do the same for all the new Indexers you want to add.
Put the old indexers into manual detention. This stops them from accepting new data so all new data will be on the new indexers.
Stop one indexer using Splunk off-line enforce-counts. This will make sure the indexer's buckets are transferred to other (new) indexers.
- Wait for the indexer to shut down.
- Repeat steps 3-4 with each of the remaining old indexers one at a time.
Retire the old indexers.

I hope this helps!! Kindly upvote if you find it useful!!!

Re: Index cluster Migration to FIPS- Am I going to have any interoperability issues?

bstimely — Thu, 27 Apr 2023 13:21:52 GMT

Thanks, I know how to do the migration. I am asking if anyone has experienced any issues with some machines using FIPS compliant algorythms and certs and other indexers in the cluster not enforcing FIPS?