Getting Data In

How to transfer Cisco ASA logs over internet to Splunk server securely?

kiqbal
Explorer

hi guys i would really appreciate if you can help me,

I need to transfer my Cisco ASA logs over the Internet to Splunk server, anyone had an experience.

How I make sure security and integrity of Syslogs.

Tags (3)
0 Karma

dwaddle
SplunkTrust
SplunkTrust

A Cisco ASA can transfer logs off of the system using either Syslog over UDP or Syslog over TCP. Neither of these is able to guarantee security or integrity.

If you are sending these to Splunk over the Internet, I would suggest you create an IPSec VPN between the ASA and the Splunk box (or an IPSec gateway [like another ASA] near the Splunk box). This will give you the security and integrity you seek.

dwaddle
SplunkTrust
SplunkTrust

It's not a question for Splunk really - splunk would be blissfully unaware of any type of VPN because to Splunk it's all just sockets. The question is whether the ASA can interoperate with these VPN implementations. Like, for example, the ASA cannot interoperate with OpenVPN - completely different protocol.

0 Karma

kiqbal
Explorer

Thanks , I am also considering Knesis or VPC on AWS ? any idea if splunk can work with Knesis

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Yes and no. If you can configure the UF to use SSL to send data to your indexer across the internet, then it will be very close to the same level of safety. Then, the best place to tamper with / sniff your log data would be the LAN behind the ASA, between it and the UF. This is usually an acceptable risk.

kiqbal
Explorer

Thanks dwaddle , what about if I have Universal forwarder in local LAN of Cisco ASA and collect the logs on Universal forwarder and then use universal forwarder to send the logs over internet, Is it safer way ?

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...