Do we have to enable/configure SSL on our 6.4.3 UFs before we upgrade to 7.1.2?

[Branden]

We are upgrading our Splunk Indexer from 6.4.3 to 7.1.2 (via 6.5). Our forwarders are running a mixture of 6.2.4 and 6.4.3 and are NOT using SSL.
Then I noticed this compatibility matrix for the UFs: http://docs.splunk.com/Documentation/Forwarder/7.1.2/Forwarder/Compatibilitybetweenforwardersandinde...

If I read this correctly, does this mean we must enable/configure SSL on our 6.4.3 UFs before we upgrade? Or will we still be able to send data to the 7.1.2 indexer without SSL from the older UFs?

Thanks!

[jtacy · Accepted solution]

Non-SSL forwarding is still supported but if you do decide to use SSL at some point, you'll have to work out the version/cipher compatibility between UF and Indexer. Your configuration should work just fine the way it is.

If your UFs are configured as deployment clients and you're updating your Deployment Server, consider that the SSL/TLS config for the management port in 6.6+ is affected by the version/cipher changes and you'll need to work out a solution for that. The Known Issues page at http://docs.splunk.com/Documentation/Splunk/7.1.2/ReleaseNotes/KnownIssues suggests some configurations you could use on the server side to support legacy clients.