Security

How do you make HAProxy load balance for Search Head Pooling?

rayutsw
Engager

I'd like to use HAProxy for Search Head Pooling with SSL.

1 Solution

rayutsw
Engager

This solution relies on HAProxy to terminate the SSL connection and the Search Heads to run in non-SSL Mode.

Download HAProxy from source (Currently only 1.5 supports SSL).

Build with SSL:

make TARGET=linux2628 USE_STATIC_PCRE=1 USE_OPENSSL=1

haproxy.cfg:

global
  maxconn     4096
  nbproc      1
  debug
  daemon
  log         127.0.0.1    local0
defaults
  mode        http
  option      httplog
  log         global
  timeout connect 5000ms
  timeout client 50000ms
  timeout server 50000ms

frontend splunk_secured
  mode http
  bind :443 ssl crt /etc/haproxy/splunk.pem # Includes Cert/Root/Intermediate/PrivateKey
  bind :80
  reqadd X-Forwarded-Proto:\ https
  redirect scheme https if !{ ssl_fc }
  default_backend splunk_search_heads


backend splunk_search_heads
        mode http
        balance roundrobin # Load Balancing algorithm
        cookie SRV insert indirect nocache # Allows sticky sessions
        ## Define your servers to balance
        server splnksh1 192.168.0.1:8000 cookie splnksh1 weight 1 maxconn 512 check port 8000
        server splnksh2 192.168.0.2:8000 cookie splnksh2 weight 1 maxconn 512 check port 8000
        server splnksh3 192.168.0.3:8000 cookie splnksh3 weight 1 maxconn 512 check port 8000

Restart HAProxy. Connect to HAProxy via https and verify everything works.

View solution in original post

rayutsw
Engager

This solution relies on HAProxy to terminate the SSL connection and the Search Heads to run in non-SSL Mode.

Download HAProxy from source (Currently only 1.5 supports SSL).

Build with SSL:

make TARGET=linux2628 USE_STATIC_PCRE=1 USE_OPENSSL=1

haproxy.cfg:

global
  maxconn     4096
  nbproc      1
  debug
  daemon
  log         127.0.0.1    local0
defaults
  mode        http
  option      httplog
  log         global
  timeout connect 5000ms
  timeout client 50000ms
  timeout server 50000ms

frontend splunk_secured
  mode http
  bind :443 ssl crt /etc/haproxy/splunk.pem # Includes Cert/Root/Intermediate/PrivateKey
  bind :80
  reqadd X-Forwarded-Proto:\ https
  redirect scheme https if !{ ssl_fc }
  default_backend splunk_search_heads


backend splunk_search_heads
        mode http
        balance roundrobin # Load Balancing algorithm
        cookie SRV insert indirect nocache # Allows sticky sessions
        ## Define your servers to balance
        server splnksh1 192.168.0.1:8000 cookie splnksh1 weight 1 maxconn 512 check port 8000
        server splnksh2 192.168.0.2:8000 cookie splnksh2 weight 1 maxconn 512 check port 8000
        server splnksh3 192.168.0.3:8000 cookie splnksh3 weight 1 maxconn 512 check port 8000

Restart HAProxy. Connect to HAProxy via https and verify everything works.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...