Security

Why is Splunk consuming more than 40% of firewall traffic?

marcor70
New Member

Hello All,

I'm working in a huge installation and Splunk is consuming more than 40% of firewall traffic.
I don't have details of the Splunk Topology yet, but we have firewall between Splunk Servers and Forwarders.
What is the recommendation to minimize the firewall traffic?

I'll appreciate any suggestion.

Thanks in advance,
MarcoR

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If you are onboarding a lot of data from your forwarders then that data will, of course, have to pass through the firewalls.

You have some options:
1) Enable SSL on the connections between forwarders and indexers. This will compress the data on those connections.
2) Set compressed = true in your outputs.conf file. SSL compression is better.
3) Re-evaluate the data being onboarded and remove that which is not needed.
4) Use heavy forwarders to filter or edit events before they are sent to the indexers.
5) Remove the firewalls between forwarders and indexers.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If you are onboarding a lot of data from your forwarders then that data will, of course, have to pass through the firewalls.

You have some options:
1) Enable SSL on the connections between forwarders and indexers. This will compress the data on those connections.
2) Set compressed = true in your outputs.conf file. SSL compression is better.
3) Re-evaluate the data being onboarded and remove that which is not needed.
4) Use heavy forwarders to filter or edit events before they are sent to the indexers.
5) Remove the firewalls between forwarders and indexers.

---
If this reply helps you, an upvote would be appreciated.

marcor70
New Member

Thanks @richgalloway

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...