What should I enable in the firewall to allow communication collector-SplunkServer

Path Finder

Hi team!

What ports do I need to open and in what direction, I do not know if I leave any.

Is there any communications table?

Thank you a lot.

Tags (1)
0 Karma

Ultra Champion

Splunk does not dictate which ports event forwarding uses, however there is a 'convention'.
Splunk management port defaults to 8089, but this also is configurable.

As a basic start (and using defaults) the following should allow your Universal Forwarders to communicate with a deployment server and forward events to indexers/intermediate tiers.

UF -> Splunk TCP:9997 (unencrypted event forwarding)
UF -> Splunk TCP:9998 (TLS encrypted event forwarding)
UF -> Deployment Server TCP:8089 (TLS)

There is a great post with diagrams here which does an awesome job of illustrating all the communications ports

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...