Can someone help me understand how protocols, permissions, and communication are configured for universal forwarders?

[dwin02]

1. Protocols, I am assuming that everything is running on TCP, but perhaps UDP is required as well
2. Permission, there is no mention on permission set for the Splunk Universal forwarder. This should be run on an account other than admin. We need to get very specific here.
3. Network communication instantiation. Is communication with the universal forwarder bi-lateral or uni-lateral pushing information out? This will be important for the firewall rules to be setup properly.

[Jeremiah]

Let's cover both network related questions together:

Splunk forwarders send data to Splunk servers via TCP. All communication from the forwarders are initiated from the forwarders. If you are using the deployment server to manage your config, your Splunk forwarder will initiate a TCP connection on port 8089 to the deployment server to update its configuration. To forward log data, your Splunk forwarder initiates a connection to your indexer(s) on port 9997. You can remap these ports if necessary.

https://answers.splunk.com/answers/63646/what-port-does-the-forwarder-need-opened-to-the-indexers.ht...

By permission, do you mean the user that the Splunk forwarder runs as? This will depend on if you are running your forwarders on unix or windows. Generally speaking, you can run as any user as long as that user has read/write access to the Splunk installation directory and has read access to the files you would like to index.

This document goes into detail about Windows permissions to run Splunk (including your forwarders): http://docs.splunk.com/Documentation/Splunk/6.3.2/Installation/ChoosetheuserSplunkshouldrunas

There is a similar document for Unix systems.
http://docs.splunk.com/Documentation/Splunk/6.3.2/Installation/RunSplunkasadifferentornon-rootuser