topic SSL between forwarders and indexers in Getting Data In

SSL between forwarders and indexers

jatin_patel — Thu, 24 Jan 2019 16:31:41 GMT

Is it possible to have index cluster tier which can support both non-ssl and ssl forwarders without running multiple instances?

Re: SSL between forwarders and indexers

jkuepker_splunk — Thu, 24 Jan 2019 19:54:12 GMT

Yes, but they cannot be on the same port. You will need to have one [splunktcp-ssl:] stanza and [splunktcp:] stanza in your inputs.conf.

Re: SSL between forwarders and indexers

ddrillic — Thu, 24 Jan 2019 20:02:25 GMT

Sure, you can do that by setting on each forwarder outputs.conf as you choose to with or without ssl. If your outputs.conf is deployed via the apps then you can deploy to each set of forwarders the desired ssl or not configurations.

Re: SSL between forwarders and indexers

jatin_patel — Thu, 24 Jan 2019 20:12:54 GMT

Thanks so much for two answers!!

so,
I need inputs.conf with two ports one for one port for non-ssl(default 9997) and another for SSL?
Then just use SSL configs in outputs.conf for each forwarders where we need SSL?

is there some splunk docs out there which I can take a look?

Re: SSL between forwarders and indexers

skalliger — Tue, 29 Jan 2019 10:32:07 GMT

Just look at the inputs.conf specifictaions. It's all described there.

Skalli

Re: SSL between forwarders and indexers

burwell — Tue, 29 Jan 2019 19:55:27 GMT

Building on above answers. Here are examples at least for Splunk 6.6

inputs.conf on the indexer

# non ssl
[splunktcp://<non_ssl_port>]

# ssl
[splunktcp-ssl:<ssl_port>]
[SSL]
requireClientCert = true
sslCommonNameToCheck = mycommonName
serverCert = /path/to/ssl/servercert.pem

outputs.conf on a forwarder using SSL

[tcpout]
defaultGroup             = splunkindexer-ssl

[tcpout:splunkindexer-ssl]
autoLBFrequency = 30
compressed  = false
server  = server1:<ssl_port>,server2:<ssl_port>,server3:<ssl_port>
clientCert  = /path_to_cert/servercert.pem
sslPassword  = password
sslRootCAPath  = /path_to_ca_cert/ca.cert.pem
sslCommonNameToCheck = mycommonName
sslVersions = tls1.2

Re: SSL between forwarders and indexers

jatin_patel — Tue, 29 Jan 2019 20:02:54 GMT

Thanks everyone!!