Getting Data In

Can I enable SSL for a universal forwarder (public IP), but not for a local universal forwarder (private IP)?

arbabnazar
New Member

Hi,

Can I enable the SSL for the universal forwarder that will access it through the public ip, but not the forwarder that accesses Splunk from its private ip? Is it possible?

Thanks,

0 Karma

lguinn2
Legend

Yes - but you need to think about the indexers as well. On the indexer, you can have a receiving port that uses SSL. You can also have a receiving port that does not - but you can't have a single port that does both. So set up 2 ports: let's say 9995 for SSL and 9996 for non-SSL. Of course, you have to do the SSL setup for port 9995.

Then on the forwarder, you can have more than one stanza in outputs.conf - when you are sending to port 9995, you have to specify the SSL options. When you forward to port 9996, you don't need those options.

There is more information here:
Configure Splunkforwarding to use signed certificates
Splunk wiki article on using default certs

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...