Getting Data In

Does Universal Forwarded supports Server Name Indication (SNI)?

tihomirstoyanov
New Member

Hi there folks,

I would like to ask if Universal Forwarder can support Server Name Indication (SNI)? That is extension of TLS protocol which can be used by nginx to deploy SNI-based-routing from UF`s to multiple hosts.

INFO:
- We have many clients with on-premise machines/laptops with Universal Forwarders sending traffic to our AWS Splunk Instances (Indexers). Our AWS Instances doesnt have public IPv4 addresses and we would like to deploy single point of contact (nginx) with public IPv4 address for all TCP UFs traffic which then differentiate by destination.

UF -> nginx with public IPv4 (SNI based-routing) -> AWS Target Indexer

Pre-requisites:
We need UF with enabled SSL - this is completed.
We need UF with enabled SNI (Its needed to differentiate destination hosts)

e.g. UF`s will send traffic to:
client1.mydomain.com
client2.mydomain.com

Nginx will then route the traffic to destination.

Have someone tried similar approach before? Also if you could give other suggestion for our solution will be much appreciated!

Thank you.

Kind Regards,
Tihomir Stoyanov

0 Karma

tihomirvstoyano
Engager

Hello,

Got an update from our seniors --> Universal Forwarder doesn`t support SNI at the moment.

Thanks,
Tihomir Stoyanov

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...