Firewall Rules: How are connections made when using a Heavy Forwarder?

[darthsplunk]

Hi all,

I'd just like to double check my understanding in terms of connections made when using a heavy forwarder.

My understanding is that the universal forwarders make a connection to the heavy forwarder on 9997 and then the data is forwarded to the indexer over 9997. When a deployment server is in use, do the universal forwarders make a connection on port 8089 to the heavy forwarder and then this connection is forwarded on to the deployment server?

Thanks,
DS

[masonmorales · Accepted solution]

My understanding is that the universal forwarders make a connection to the heavy forwarder on 9997 and then the data is forwarded to the indexer over 9997.
You don't usually need to configure forwarders to send to other forwarders (although there are a couple corner cases). Normally either the universal forwarder will send data to the indexer on TCP/9997 or the heavy forwarder will send data to the indexer on TCP/9997. If you are using both types of forwarders, configure each one to send to the indexers, not to each other.
When a deployment server is in use, do the universal forwarders make a connection on port 8089 to the heavy forwarder and then this connection is forwarded on to the deployment server?
No. When a deployment server is in use, you point your universal (or heavy) forwarder to the deployment server and it will connect to the deployment server over TCP/8089. It will automatically phone-home to the DS every 5 minutes and check if its configurations are current. If they aren't, DS will tell it to update, and the forwarder will download the appropriate apps/TAs from the DS.

[alanden_splunk]

It is useful to forward from UF through HF when index-time parsing is required or when network security requires configuration to allow connections to indexers (firewall).

[kristian_kolb]

First of all, ports are configurable (by you). However the de-facto 'standard' is 9997 for logs from Forwarder to indexer, and 8089 for communication between Splunk instances (searches, deployment traffic).

Deployment traffic is normally not 'relayed' in the same way that log traffic is/can be. If you already know the ip-address of your DS, you should put that info in deploymentclient.conf on the UF (see the docs), and open the fw accordingly. Remember that it is the UF that makes the connection to the DS, not the other way around.

/k