- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to encrypt data stream between ProxySG and Indexer?
Is it possible to encrypt the data stream between the ProxySG and the Indexer?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Maybe.
A quick googling shows that Blue Coat can send its syslog via tcp over an SSL link. Splunk can listen for a TCP input with SSL encryption. This "should work". See https://kb.bluecoat.com/index?page=content&id=KB4294 for the Blue Coat side of this. In Splunk, this is an inputs.conf
stanza of type tcp-ssl
.
Lukas Camenzind has blogged about this setup, including some of the SSL certificate issues he discovered, at http://www.looke.ch/wp/integrating-bluecoat-proxy-sg-access-logs-into-splunk
Another option (if the Blue Coat supports it) is IPSec. You could configure host-to-host IPSec and have all traffic between the two devices encrypted by the IP stack. However, I can find no evidence that Blue Coat can support this.
