All Apps and Add-ons

How to encrypt data stream between ProxySG and Indexer?

edekker
Explorer

Is it possible to encrypt the data stream between the ProxySG and the Indexer?

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Maybe.

A quick googling shows that Blue Coat can send its syslog via tcp over an SSL link. Splunk can listen for a TCP input with SSL encryption. This "should work". See https://kb.bluecoat.com/index?page=content&id=KB4294 for the Blue Coat side of this. In Splunk, this is an inputs.conf stanza of type tcp-ssl.

Lukas Camenzind has blogged about this setup, including some of the SSL certificate issues he discovered, at http://www.looke.ch/wp/integrating-bluecoat-proxy-sg-access-logs-into-splunk

Another option (if the Blue Coat supports it) is IPSec. You could configure host-to-host IPSec and have all traffic between the two devices encrypted by the IP stack. However, I can find no evidence that Blue Coat can support this.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...