Hello gents, Good day. I've been working on this, and I made this changes to my lab: - Disabled Firewall - Changed the topology to make the collector and Splunk server in two different subnets. (I'm not sure that this is major or not, but saw couple of discussions saying that Collector will not send the packets unless it rewritten first) However, it might work even if they were in the same subnet. The root cause of the issue was the Firewall on Collector Server, basically it was Centos 7. For reference, Firewall was allowing traffic on port 2055 - In direction by default, but it was very restrictive in out direction. I hope you find my answer helpful. ... View more

any update ? ... View more

Hello team,. I've the following topology: PC with Cisco Anyconnect configured with NVM ------ Collector ------ Splunk Enterprise with NVM addon Now, everything is working fine from Wiresahrk perspective, I'm receiving flows on collector, and collector send it to Splunk enterprise. Issue is, that on splunk, I can't see anything on dashboards, why? One more thing: the captured data on Splunk server appears with SRC IP of the VPN client, and DST IP is the collector..why? And, why i can't capture traffic destined to 20519 and 20520 on Splunk server? I capture only the traffic as mentioned above destined to port 2055 ... View more

Hello team,. I've the following topology: PC with Cisco Anyconnect configured with NVM ------ Collector ------ Splunk Enterprise with NVM addon Now, everything is working fine from Wiresahrk perspective, I'm receiving flows on collector, and collector send it to Splunk enterprise. Issue is, that on splunk, I can't see anything on dashboards, why? One more thing: the captured data on Splunk server appears with SRC IP of the VPN client, and DST IP is the collector..why? And, why i can't capture traffic destined to 20519 and 20520 on Splunk server? I capture only the traffic as mentioned above destined to port 2055 ... View more

Hello rich.., Thank you for quick reply. First of all, attached my topology, http://imgur.com/a/oUWun As you see, Collector IP is 192.168.222 and Splunk instance is 192.168.8.105. Now, I started wireshark session on Splunk hosting server, here a sample of the capture, http://imgur.com/a/OYuy3 SRC : is the laptop after connected through VPN. (192.168.8.55) As you see, it's wrong, because traffic should be destined to 192.168.8.105 (Splunk Server) As per acnvm.conf script on Collector server, here is the configuration http://imgur.com/a/ZRlRe And, I've configured Cisco Anyconnect NVM profile on Cisco ASA firewall to push the ip of the collector: 192.168.8.222 on port 2055 Now, why I can't see a traffic captured on Splunk server saying: src ip: 192.168.8.55 (vpn client) dst ip: 192.168.8.105 (splunk server) ## this traffic should be redirected from the collector and sent to splunk instance. ... View more