All Apps and Add-ons

How to encrypt data stream between ProxySG and Indexer?

edekker
Explorer

Is it possible to encrypt the data stream between the ProxySG and the Indexer?

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Maybe.

A quick googling shows that Blue Coat can send its syslog via tcp over an SSL link. Splunk can listen for a TCP input with SSL encryption. This "should work". See https://kb.bluecoat.com/index?page=content&id=KB4294 for the Blue Coat side of this. In Splunk, this is an inputs.conf stanza of type tcp-ssl.

Lukas Camenzind has blogged about this setup, including some of the SSL certificate issues he discovered, at http://www.looke.ch/wp/integrating-bluecoat-proxy-sg-access-logs-into-splunk

Another option (if the Blue Coat supports it) is IPSec. You could configure host-to-host IPSec and have all traffic between the two devices encrypted by the IP stack. However, I can find no evidence that Blue Coat can support this.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...