Our use case is to have our Splunk indexer(s) running in one DC and our production hardware in another, in the public cloud at Rackspace, or in the public cloud at Amazon.
So restricting port 9997 to only a whitelist of IPs seems impractical. we can open the port to the internet at large, and SSL encrypt traffic (I think), but how to we authenticate that forwarders as legitimate senders?
If this is documented someplace I have been too dense to find, please let me know.
... View more