Hi,
Can I enable the SSL for the universal forwarder that will access it through the public ip, but not the forwarder that accesses Splunk from its private ip? Is it possible?
Thanks,
Yes - but you need to think about the indexers as well. On the indexer, you can have a receiving port that uses SSL. You can also have a receiving port that does not - but you can't have a single port that does both. So set up 2 ports: let's say 9995 for SSL and 9996 for non-SSL. Of course, you have to do the SSL setup for port 9995.
Then on the forwarder, you can have more than one stanza in outputs.conf - when you are sending to port 9995, you have to specify the SSL options. When you forward to port 9996, you don't need those options.
There is more information here:
Configure Splunkforwarding to use signed certificates
Splunk wiki article on using default certs