topic Re: Does Splunk support two-way SSL between the Universal Forwarder TCP port and external application? in Getting Data In

Does Splunk support two-way SSL between the Universal Forwarder TCP port and external application?

ankithreddy777 — Wed, 19 Apr 2017 16:10:42 GMT

Does Splunk's Universal Forwarder supports SSL for TCP inputs (i.e It is receiving data from external application)? Does Splunk supports 2 way SSL between them?

Re: Does Splunk support two-way SSL between the Universal Forwarder TCP port and external application?

koshyk — Thu, 20 Apr 2017 08:02:26 GMT

We use TLS1.2 for Splunk UF to Indexers using certificates. So answer for 1st question is YES
I'm not sure what you mean as 2 way SSL between them? You mean from Deployment-server to UF? (Yes in that case). Indexers don't need to communicate back to UF, so it is one way traffic only.

Re: Does Splunk support two-way SSL between the Universal Forwarder TCP port and external application?

ankithreddy777 — Thu, 20 Apr 2017 13:24:50 GMT

Hi Koshyk,
I mean Does the traffic between external system (say Cloud foundry) to tcp port of Splunk UF has SSL b/w them?

Splunk UF TCP port xxx is receiving data from external source and forwarding it to Splunk Indexers.

Coming to splunk UF and indexers. In case when indexers send acknowledgement back to forwarders, is it not secured by SSL?

Thank you

Re: Does Splunk support two-way SSL between the Universal Forwarder TCP port and external application?

koshyk — Fri, 21 Apr 2017 08:47:07 GMT

if the connection is between Cloud-foundry and UF, you can enable SSL/TLS if you enable certificates accordingly.

if its between UF & Indexers/HF/UF => the network connection is opened by UF and is Secured. So the acknowledgement is using the same connection and hence is secured.

Re: Does Splunk support two-way SSL between the Universal Forwarder TCP port and external application?

ankithreddy777 — Fri, 21 Apr 2017 11:02:04 GMT

Hi Koshyk,
yes, the connection is between Cloud-foundry and UF, How to enable certificates for UF. Splunk docs gave information about how to configure inputs.conf for indexers and outputs.conf for UF for enabling SSL in case of connection between UF and Indexers. But how to configure splunk conf in my case?

thankyou

Re: Does Splunk support two-way SSL between the Universal Forwarder TCP port and external application?

koshyk — Fri, 21 Apr 2017 22:44:41 GMT

The documents provide step by step method. Please use Link : http://docs.splunk.com/Documentation/Splunk/6.5.3/Security/ConfigureSplunkforwardingtousesignedcertificates

(Please mark answer if you are satisfied. cheers)