Security

How to configure forwarding with SSL using load balancing?

fairje
Communicator

So I have a group of servers that I am load balancing across and I am trying to figure out how to set the "sslCommonNameToCheck" variable when handling multiple servers. This does not look like it allows a comma separated list.

I want it to look something like this:

[tcpout]
defaultGroup = myIndexers

[tcpout:myIndexers]
maxQueueSize = 128MB
useACK = true
autoLB = true
server = splunk-idx01.myorg.com:9998, splunk-idx02.myorg.com:9998
sslCertPath = $SPLUNK_HOME/etc/auth/myOrg/splunk-forwarder.pem
sslPassword = <REDACTED>
sslRootCAPath = $SPLUNK_HOME/etc/auth/myOrg/cacert.crt
sslVerifyServerCert = true
sslCommonNameToCheck = splunk-idx01.myorg.com, splunk-idx02.myorg.com

But like I said, I do not believe this takes a comma separated value.

I tried something I found in the "bonus/deleted" slides from the 2015 .conf presentation by Defense Point Security on SSL Best Practices:
http://conf.splunk.com/session/2015/conf2015_DWaddle_DefensePointSecurity_deploying_SplunkSSLBestPra...

in which they do the same as above except break out each server with stanzas as follows:

[splunk-idx01.myorg.com]
sslVerifyServerCert = true
sslCommonNameToCheck = splunk-idx01.myorg.com
[splunk-idx02.myorg.com]
sslVerifyServerCert = true
sslCommonNameToCheck = splunk-idx02.myorg.com

I tried this, and it doesn't work as that is not the right syntax on stanzas. Anyone setup SSL with Load Balancing?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Did you read up on the docs here?
It appears you are missing *tcpout-server:// * in your individual server stanzas.

0 Karma

fairje
Communicator

Had read all through it, and I think it was throwing me off since I was afraid that the "tcpout-server://" setting would maybe somehow keep it from load balancing correctly. by instead duplicating all the data equally to the servers. I will give this a go and see if that works.

I am just not sure the best way to validate that it is load balancing and not sending the data out to all of my indexers at the same time (e.g. instead of it logging something once, I would guess to find my data copied 4 times over on my 4 indexers.)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...