SSL connection between Indexer and Forwarder- validation

garima_chauhan — Mon, 28 Sep 2020 15:20:05 GMT

Hi,

I am not able to configure the ssl connections between the forwarder and indexer. The splunkd logs on both the indexer and forwarder are not the same as cited in the documentation.

Here is what I get on Indexer in splunkd.log:

Date Time +1100 INFO TcpInputConfig - IPv4 port 9997 is reserved for splunk 2 splunk

Date Time +1100 INFO TcpInputConfig - IPv4 port 9997 is not compressed

Date Time +1100 INFO TcpInputConfig - IPv4 port 9997 is reserved for splunk 2 splunk (SSL)

Date Time +1100 INFO TcpInputConfig - IPv4 port 9997 is compressed

Date Time +1100 INFO TcpInputProc - Registering metrics callback for: tcpin_connections

After this, I do not get any other message as mentioned in the documentation.

On Forwarder, I get the following in splunkd.log:

Date Time +1100 INFO TcpOutputProc - found Whitelist forwardedindex.0.whitelist , RE : forwardedindex.0.whitelist

Date Time +1100 INFO TcpOutputProc - found Blacklist forwardedindex.1.blacklist , RE : forwardedindex.1.blacklist

Date Time +1100 INFO TcpOutputProc - found Whitelist forwardedindex.2.whitelist , RE : forwardedindex.2.whitelist

Date Time +1100 INFO TcpOutputProc - tcpout group splunkssl using Auto load balanced forwarding

Date Time +1100 INFO TcpOutputProc - Group splunkssl initialized with maxQueueSize=512000 in bytes.

Date Time +1100 WARN TcpOutputProc - Connected to idx=:9997. Not using ACK.

Date Time +1100 INFO TcpOutputProc - Connection to :9997 closed. Connection closed

For enabling SSL connection between a forwarder and an indexer, I performed the following configurations:

On Indexer(Windows)
I added the following stanzas in $SPLUNK_HOME\etc\system\local\inputs.conf

[splunktcp-ssl:9997]
compressed = true

[SSL]
rootCA = $SPLUNK_HOME\etc\auth\cacert.pem
serverCert = $SPLUNK_HOME\etc\auth\server.pem
password = password

On Forwarder(Windows)
I added the following stanzas in $SPLUNK_HOME\etc\system\local\outputs.conf

[tcpout]
defaultGroup = splunkssl

[tcpout:splunkssl]
compressed = true
server = :9997
sslCertPath = $SPLUNK_HOME\etc\auth\server.pem
sslPassword = password
sslRootCAPath = $SPLUNK_HOME\etc\auth\cacert.pem
sslVerifyServerCert = false

I checked if there were 2 inputs.conf stanzas using port 9997. There were no 2 stanzas using port 9997 but I still changed the port to 9996 for ssl connection.

Despite changing the port, I don't get the output in splunkd.log as mentioned in the splunk documentation.

However, when I checked the metrics.log file on Indexer, I get "ssl=true". Does this mean that ssl is enabled, even though the splunkd logs are not as desired?

Please help.

Re: SSL connection between Indexer and Forwarder- validation

msarro — Thu, 21 Nov 2013 08:05:03 GMT

In the splunkd.log on the forwarder, are you seeing messages similar to "TcpOutput: Connected to 1.2.3.4." (Where 1.2.3.4 is the IP address of your indexer)?

Re: SSL connection between Indexer and Forwarder- validation

garima_chauhan — Thu, 21 Nov 2013 09:15:07 GMT

Yes it does give

TcpOutputProc: Connected to idx IP:9996

Re: SSL connection between Indexer and Forwarder- validation

uchaitanya — Sat, 17 May 2014 19:20:48 GMT

I am having similar problem as above. Can anyone please post the solution for this problem?
Thanks in advance

Re: SSL connection between Indexer and Forwarder- validation

MuS — Sun, 18 May 2014 08:42:17 GMT

Hi garima_chauhan,

run this command from the cmd prompt

 %SPLUNK_HOME%/bin/splunk cmd openssl s_client -connect myIDX:9997

this will open a SSL connection to the idx and verify the SSL connection.

find some background information about SSL tests and config changes here

hope this helps ...

cheers, MuS

topic Re: SSL connection between Indexer and Forwarder- validation in Getting Data In

SSL connection between Indexer and Forwarder- validation

Re: SSL connection between Indexer and Forwarder- validation

Re: SSL connection between Indexer and Forwarder- validation

Re: SSL connection between Indexer and Forwarder- validation

Re: SSL connection between Indexer and Forwarder- validation