Does Universal Forwarded supports Server Name Indication (SNI)?

tihomirstoyanov — Tue, 14 Jan 2020 13:43:19 GMT

Hi there folks,

I would like to ask if Universal Forwarder can support Server Name Indication (SNI)? That is extension of TLS protocol which can be used by nginx to deploy SNI-based-routing from UF`s to multiple hosts.

INFO:
- We have many clients with on-premise machines/laptops with Universal Forwarders sending traffic to our AWS Splunk Instances (Indexers). Our AWS Instances doesnt have public IPv4 addresses and we would like to deploy single point of contact (nginx) with public IPv4 address for all TCP UFs traffic which then differentiate by destination.

UF -> nginx with public IPv4 (SNI based-routing) -> AWS Target Indexer

Pre-requisites:
We need UF with enabled SSL - this is completed.
We need UF with enabled SNI (Its needed to differentiate destination hosts)

e.g. UF`s will send traffic to:
client1.mydomain.com
client2.mydomain.com

Nginx will then route the traffic to destination.

Have someone tried similar approach before? Also if you could give other suggestion for our solution will be much appreciated!

Thank you.

Kind Regards,
Tihomir Stoyanov

Re: Does Universal Forwarded supports Server Name Indication (SNI)?

tihomirvstoyano — Thu, 13 Feb 2020 12:45:42 GMT

Hello,

Got an update from our seniors --> Universal Forwarder doesn`t support SNI at the moment.

Thanks,
Tihomir Stoyanov

topic Does Universal Forwarded supports Server Name Indication (SNI)? in Getting Data In

Does Universal Forwarded supports Server Name Indication (SNI)?

Re: Does Universal Forwarded supports Server Name Indication (SNI)?