Linux servers: After upgrading from 6.2.0 to 7.2.0, will the 6.2.0 universal forwarders be able to communicate with the new 7.0.2 enterprise components?

[rlaan]

We are considering upgrading from 6.2.0 to version 7.0.2 All the *nix servers will be upgraded but during the upgrade process, will the 6.2.0 universal forwarders be able to communicate with the new 7.0.2 enterprise components?

Our windows servers won't be updated as we are thinking of removing the clients. Will the 6.2.0 windows universal forwarders still function with 7.0.2?

My understanding is that and enterprise components 7.0.2 should be ok to receive data from any 6.x or higher forwarder

[rlaan]

so to get the 6.2.0 windows forwarders that are marked for decommission working with the new 7.0.2 enterprise components my understanding is to add the following to the server.conf.

[sslConfig] 
sslVersions = *,-ssl2 
sslVersionsForClient = *,-ssl2 
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH

I also like the idea of doing the UFW 7 installation prior to the enterprise component so less server.conf configurations will be requried to connect.
So end state will be:
windows servers UFW 6.2.0
*nix servers 7.0.2
enterprise components 7.0.2

My understanding is to
1. apply the conf changes to windows,
2. install 7.0.2 UFW on nix
3. Upgrade enterprise components on *nix 7.0.2

Any other gotcha's you can think of?

[Elsurion]

For the Windows part, i'd take in account how long they will be around. When only a few months then this can be your path, when longer then i'd upgrade the windows ufw as well, to have a clean environment.

[Elsurion]

One thing ist the part with the SSL:
An indexer that is version 6.6 or later, including 7.0, can receive data from a forwarder that is version 4.3 or later, including 7.0, after you change the SSL/TLS version and cipher suite on the indexer.
https://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Compatibilitybetweenforwardersandindex...

You have to change the SSLv3 Support to nil in Forwarders older then 6.4.0, after the POODLE Problem.

Since you have to change your setting, why not first upgrade your forwarders? I have UFW 7 which connects to a 6.6 Indexer.

[horsefez]

Hi rlaan,

take a look at the docs here:
https://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Compatibilitybetweenforwardersandindex...

I think the following quote is important:
A forwarder that is version 6.0 to 6.5 can send data to an indexer that is version 5.0 or later, but less than 7.0.