https://community.splunk.com/t5/Getting-Data-In/How-to-transfer-Cisco-ASA-logs-over-internet-to-Splunk-server/m-p/133353#M27405 <P>Thanks , I am also considering Knesis or VPC on AWS ? any idea if splunk can work with Knesis</P> Wed, 09 Jul 2014 12:03:28 GMT kiqbal 2014-07-09T12:03:28Z https://community.splunk.com/t5/Getting-Data-In/How-to-transfer-Cisco-ASA-logs-over-internet-to-Splunk-server/m-p/133349#M27401 <P>hi guys i would really appreciate if you can help me, </P> <P>I need to transfer my Cisco ASA logs over the Internet to Splunk server, anyone had an experience.</P> <P>How I make sure security and integrity of Syslogs. </P> Tue, 08 Jul 2014 11:04:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-transfer-Cisco-ASA-logs-over-internet-to-Splunk-server/m-p/133349#M27401 kiqbal 2014-07-08T11:04:30Z https://community.splunk.com/t5/Getting-Data-In/How-to-transfer-Cisco-ASA-logs-over-internet-to-Splunk-server/m-p/133350#M27402 <P>A Cisco ASA can transfer logs off of the system using either Syslog over UDP or Syslog over TCP. Neither of these is able to guarantee security or integrity. </P> <P>If you are sending these to Splunk over the Internet, I would suggest you create an IPSec VPN between the ASA and the Splunk box (or an IPSec gateway [like another ASA] near the Splunk box). This will give you the security and integrity you seek.</P> Tue, 08 Jul 2014 14:03:28 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-transfer-Cisco-ASA-logs-over-internet-to-Splunk-server/m-p/133350#M27402 dwaddle 2014-07-08T14:03:28Z https://community.splunk.com/t5/Getting-Data-In/How-to-transfer-Cisco-ASA-logs-over-internet-to-Splunk-server/m-p/133351#M27403 <P>Thanks dwaddle , what about if I have Universal forwarder in local LAN of Cisco ASA and collect the logs on Universal forwarder and then use universal forwarder to send the logs over internet, Is it safer way ?</P> Tue, 08 Jul 2014 14:26:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-transfer-Cisco-ASA-logs-over-internet-to-Splunk-server/m-p/133351#M27403 kiqbal 2014-07-08T14:26:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-transfer-Cisco-ASA-logs-over-internet-to-Splunk-server/m-p/133352#M27404 <P>Yes and no. If you can configure the UF to use SSL to send data to your indexer across the internet, then it will be very close to the same level of safety. Then, the best place to tamper with / sniff your log data would be the LAN behind the ASA, between it and the UF. This is usually an acceptable risk.</P> Wed, 09 Jul 2014 01:42:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-transfer-Cisco-ASA-logs-over-internet-to-Splunk-server/m-p/133352#M27404 dwaddle 2014-07-09T01:42:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-transfer-Cisco-ASA-logs-over-internet-to-Splunk-server/m-p/133353#M27405 <P>Thanks , I am also considering Knesis or VPC on AWS ? any idea if splunk can work with Knesis</P> Wed, 09 Jul 2014 12:03:28 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-transfer-Cisco-ASA-logs-over-internet-to-Splunk-server/m-p/133353#M27405 kiqbal 2014-07-09T12:03:28Z https://community.splunk.com/t5/Getting-Data-In/How-to-transfer-Cisco-ASA-logs-over-internet-to-Splunk-server/m-p/133354#M27406 <P>It's not a question for Splunk really - splunk would be blissfully unaware of any type of VPN because to Splunk it's all just sockets. The question is whether the ASA can interoperate with these VPN implementations. Like, for example, the ASA cannot interoperate with OpenVPN - completely different protocol.</P> Wed, 09 Jul 2014 16:28:26 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-transfer-Cisco-ASA-logs-over-internet-to-Splunk-server/m-p/133354#M27406 dwaddle 2014-07-09T16:28:26Z