Communication error between old ver Splunk and Forwarder ver6.x about ssl.

[yutaka1005]

Splunk ver 6.2.0 has been introduced in my separate environment, and recently I installed forwarder ver 6.6.1 on a new server and seted up that it forward data to Splunk server using ssl.

However, a communication error like below occurred between the forwarder and splunk server.

◆ Splunk server
WARN HttpListener - Socket error from "forwarder ip" while idling: error: 1408 A 0 C 1: SSL routines: SSL 3 _ GET _ CLIENT _ HELLO: no shared cipher

◆ Forwarder
SSLCommon - Received fatal SSL 3 alert. Ssl_state = 'SSLv 3 read server hello A', alert_description = 'handshake failure'.

When we looked at other similar questions, we saw the answer like below.
"When splunk server side is ver 6.6, and Forwarder side is old ver, it can happen and it is a known issues"

Is this also a known issues like this?

[skalliger · Accepted solution]

Usually this problem should be gone after upgrading the indexers and forwarders to 6.6.1.
Have you tried this?

Update the inputs.conf on your indexer(s) like this:

[SSL]
sslVersions = *,-ssl2
cipherSuite = ALL:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

Skalli

[yutaka1005]

Thank you Skalli.

When I investigated about the error, Only data transfer was succeed, but it seems that there was an error in the communication between deployment server (indexer) and forwarder with using the management port.

There was a workaround on a web page that you attached link.
The method is to add the following setting to "/opt/splunk/etc/system/local/server.conf" of the indexer side.

[sslConfig]
sslVersions = ,-ssl2
sslVersionsForClient = ,-ssl2
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH

So I tried it, and the error has gone!
Now I tentatively avoid this issue by this method, but soon I think I will also rise indexer to 6.6 ver.

Thanks a lot.

[skalliger]

Good to hear! 🙂 Glad to be of help.