How do I trace if a server in a network path behind a firewall?
The data is presented in the table below.
For example: IP 192.168.1.7 of server-A is connected to "LoadBalancer-to-Server" network, LoadBalancer-A is connected to "LoadBalancer-to-Server" network and "Firewall-to-Loadbalancer" network.
So, server-A is behind a firewall.
Please suggest. Thanks
ip | name | network | behindfirewall |
192.168.1.1 | LoadBalancer-A | Loadbalancer-to-Server | yes |
172.168.1.1 | LoadBalancer-A | Firewall-to-Loadbalancer | yes |
192.168.1.7 | server-A | Loadbalancer-to-Server | yes |
192.168.1.8 | server-B | Loadbalancer-to-Server | yes |
192.168.1.9 | server-C | network-1 | no |
192.168.1.9 | server-D | network-2 | no |
This requires some discovery work from your organisation or network engineer, Splunk can't magically work out a network's connections unless you have data that states so.
An option might be to ingest the data from these components and ensure the source_ip and destination_ip data is ingested and that may help you see the traffic flow and you can use a Splunk app with the discovery work. like https://splunkbase.splunk.com/app/6876
Or you might want to look at, other third-party tools for that and perhaps then create a look up file that contains this information, so its then presented to Splunk and to help you with your use case.