Splunk Enterprise

Securing Splunk servers with SSL (CA-Signed)

spl_unker
Explorer

Hi  All

Im stuck with couple of questions  while i working on securing communication between Splunk nodes.

I have 4 forwarders sending data to 3 indexers which is in cluster . I have a 1 deployment server to manage  forwarders . and have 1 cluster master:

Question 1 (securing forwarder->indexers): From the Splunk documentation we need to have certificates for both forwarders and indexers. But don't understand why it is required on forwarders as well? Having certificates only in indexers does the job right? . Is it because of Splunk configuration or code demands to have it in forwarders as well?

Question 2 (Cluster Master->indexers) : Since we have already in production , is there any impact or precautions that needs to be taken while making communication secured  between CM and indexers. please share any link to document or list high level steps  on the configuration . 

 

Thanks in Advance

Labels (1)
Tags (1)
0 Karma