Security

How to configure forwarding with SSL using load balancing?

fairje
Communicator

So I have a group of servers that I am load balancing across and I am trying to figure out how to set the "sslCommonNameToCheck" variable when handling multiple servers. This does not look like it allows a comma separated list.

I want it to look something like this:

[tcpout]
defaultGroup = myIndexers

[tcpout:myIndexers]
maxQueueSize = 128MB
useACK = true
autoLB = true
server = splunk-idx01.myorg.com:9998, splunk-idx02.myorg.com:9998
sslCertPath = $SPLUNK_HOME/etc/auth/myOrg/splunk-forwarder.pem
sslPassword = <REDACTED>
sslRootCAPath = $SPLUNK_HOME/etc/auth/myOrg/cacert.crt
sslVerifyServerCert = true
sslCommonNameToCheck = splunk-idx01.myorg.com, splunk-idx02.myorg.com

But like I said, I do not believe this takes a comma separated value.

I tried something I found in the "bonus/deleted" slides from the 2015 .conf presentation by Defense Point Security on SSL Best Practices:
http://conf.splunk.com/session/2015/conf2015_DWaddle_DefensePointSecurity_deploying_SplunkSSLBestPra...

in which they do the same as above except break out each server with stanzas as follows:

[splunk-idx01.myorg.com]
sslVerifyServerCert = true
sslCommonNameToCheck = splunk-idx01.myorg.com
[splunk-idx02.myorg.com]
sslVerifyServerCert = true
sslCommonNameToCheck = splunk-idx02.myorg.com

I tried this, and it doesn't work as that is not the right syntax on stanzas. Anyone setup SSL with Load Balancing?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Did you read up on the docs here?
It appears you are missing *tcpout-server:// * in your individual server stanzas.

0 Karma

fairje
Communicator

Had read all through it, and I think it was throwing me off since I was afraid that the "tcpout-server://" setting would maybe somehow keep it from load balancing correctly. by instead duplicating all the data equally to the servers. I will give this a go and see if that works.

I am just not sure the best way to validate that it is load balancing and not sending the data out to all of my indexers at the same time (e.g. instead of it logging something once, I would guess to find my data copied 4 times over on my 4 indexers.)

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...