Secure forwarded data with certificates.

[allan_newton]

Dear Members,

We have a peculiar problem, there are 3 regions from which we collect data. Each region data should maintain its own integrity for various purposes.

The indexers, search heads and primary deployment server are in the 4th region. Now we use a secondary deployment server in each region which poll to primary DS, the secondary DSs also act as HF to forward data to the common indexers in the 4th region.

Now the requirement is to secure the forwarded data using different certificates for each location. Server certificate could be same but the client certificates should be unique for each region.

Thanks in advance.

[mattymo]

You can create an app for each region that contains the proper config to use for that outputs.conf

https://docs.splunk.com/Documentation/Splunk/latest/Security/Aboutsecuringdatafromforwarders

Duane Waddle and George Starcher's talk is a great primer for this topic to help supplement Splunk docs:

https://wiki.splunk.com/images/f/fb/SplunkTrustApril-SSLipperySlopeRevisited.pdf
https://splunk.webex.com/splunk/lsr.php?RCID=da90ccae281af46da9e4a3b46c076a0b

Just ensure each zone's HF has the cert they need from the CA that the IDX wants and you should be ok. The idx will simply check the cert the HF has, but the IDX's cert is the one that secure comms.