Getting Data In

Upgrade to 7.1.2 from 6.5.1 - Universal Forwarder Upgrade


Hello Team,

We are planning to upgrade Splunk Enterprise v6.5.1 to v7.1.2. I understand that we need to upgrade or make changes to SSL/TLS config as per
Current UF Version Deployed and connecting to Heavy Forwarders.
I am confused as in link it says to change the cipher suite on forwarder but when clicked on Known issue list it is not clear where to make the changes.

From Known issue:
SPL-141964 - For splunktcp-ssl - we are not using it
SPL-141961 - This seems to be applicable but it states "Upgrade your older instances to the latest maintenance releases or on your 6.6.x Splunk instances. Add the following stanza to server.conf:"
sslVersions = *,-ssl2
sslVersionsForClient = *,-ssl2
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH

Can you advise what changes need to be done? I believe it is SPL-141961 but where this change need to be done IDX/HF/UF?

0 Karma

Ultra Champion

Hi @hemendralodhi,

As you have mentioned that you are not using splunktcp-ssl on Heavy Forwarders for receiving data which means that you are not using SSL communication between UF and Heavy Forwarder. In that case I guess there will not be any problem because I have tested UF 7.0.4 with Indexer 6.5.0 and it is running fine without changing any Ciphers because in my lab I am not using SSL communication between UF and Indexer.

If you are using Deployment Server to distribute configuration to UF in this case, you need to degrade Ciphers in servers.conf sslConfig stanza because UF and Deployment Server talk with each other using SSL so there might be problem with 7.1.X Deployment server and less than 6.6 UF (as far as I am aware Ciphers changed in 6.6)

My recommendation is always upgrade test environment first, test everything and then upgrade production.

I hope this helps.


0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...