topic Re: How to pull data from DMZ Heavy Forwarder in Deployment Architecture

How to pull data from DMZ Heavy Forwarder?

randqm — Thu, 09 Feb 2023 16:10:48 GMT

I want to install HF or UF on our DMZ environment.

The Indexer is on the LAN.

I is not allow to communicate from the DMZ to the LAN .

I need that the logs from the DMZ will be pulled to the Indexer in the LAN (using HF or any other solution).

Please share your insight on how to setup this from your experience .

Thanks in advance.

Re: How to pull data from DMZ Heavy Forwarder

gcusello — Thu, 09 Feb 2023 14:33:50 GMT

Hi @randqm,

you have to put one (or better two) UFs or HFs to concentrate all the logs from DMZ or outside (e.g. Cloud Services).

So you have to open only the routes between these HFs or UFs and Indexers.

Ciao.

Giuseppe

Re: How to pull data from DMZ Heavy Forwarder

randqm — Thu, 09 Feb 2023 14:45:43 GMT

Thanks for your response.

Any tips on what configuration and port need to open between the UFs/HFs ?

Re: How to pull data from DMZ Heavy Forwarder

gcusello — Thu, 09 Feb 2023 14:49:54 GMT

Hi @randqm,

the usual ports you're using in your Splunk infrastructure:

usually 9997 is used to send data to indexers (monodirectional),
8089 (bidirectional) between UFs (or HFs) and Deployment Server for the configurations.

Ciao.

Giuseppe

Re: How to pull data from DMZ Heavy Forwarder

randqm — Thu, 09 Feb 2023 14:53:27 GMT

But my issue is that any communication from the DMZ to LAN is not allow. ☹️
In the opposite direction it is allowed.

Re: How to pull data from DMZ Heavy Forwarder

PickleRick — Thu, 09 Feb 2023 15:02:11 GMT

That's a typical problem because Splunk works mostly on "push" principle - forwarders get their data from various inputs but it's them who connect to the indexers (or intermediate forwarders), not the other way around. Splunk doesn't have a built-in "pull" mode.

So you can either set up a designated intermediate forwarder(s) which will be the only ones allowed to connect to LAN (but I understand that it can be not that easy with some strict traffic policies) or use some external solution to - for example - write events to a file on some host in DMZ. You'd then connect connect from your LAN to this host and read events from those files.

But I don't think there's a ready solution for this.

Re: How to pull data from DMZ Heavy Forwarder

gcusello — Thu, 09 Feb 2023 15:02:36 GMT

Hi @randqm,

if no commuminations are alloweb from DMZ to LAN, you haven't ways to send data!

You can secure the connections between machines using SSL and certificates, and define very hard rules for the firewalls, but if DMZ cannot send data to LAN, there isn't any solution!

Ciao.

Giuseppe