Splunk License Master and Heavy Forwarder communicate

[AlesFrohlich]

Hello,

does anyone know if there is any communication between License Master and Heavy Forwarder initiated by the License Master. I know that Heavy Forwarder initiate some communication with License Master to download license information. I also found that indexers are reporting every minute an amount if indexed data to License Master. However I have not found any official Splunk explanation what communications exist and how the components exactly talk together.

There is a simple reason for this question ... our firewall guys are complaining to open tcp/8089 initiated from License Master to Heavy Forwarders.

Thanks to anyone for an answer.

Best Regards,
Ales

[AlesFrohlich]

Thank you for your replies. The server is only license master. So the one way communications should be enough.

Thanks a lot from help.

Regards,
Ales

[somesoni2]

AFAIK, The slaves report their license usage to License Master and there is no communication happens from LM to L slaves.

[dsctm3]

Not sure on the license front, but TCP/8089 is used for more than Licensing.

This includes deployment client, distributed management console etc. If you have more than just licensing on the host serving that function, you have clear justification to request that port being opened as splunk uses TCP/8089 for all of those features.