Deployment Architecture

Has anyone configured CM redundancy using load balancer ?

thehow
Loves-to-Learn

Current setup - Indexers --> F5 VIP --> CM 

CM is seeing the requests are coming F5 VIP rather than actual source ip of the indexers.

First indexer is connected successfully using the F5 VIP and the latter requests from indexers are dropped as CM is seeing the connections coming from same Indexer (same F5 VIP).

How did you configure the load balancer to see the actual source ip rather than the F5 VIP on the CM.

Note: CM and Indexers are sitting on same network.

I do not have much knowledge on the LB end.

Any assistance is much appreciated.

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...