Getting Data In

Communication error between old ver Splunk and Forwarder ver6.x about ssl.

yutaka1005
Builder

Splunk ver 6.2.0 has been introduced in my separate environment, and recently I installed forwarder ver 6.6.1 on a new server and seted up that it forward data to Splunk server using ssl.

However, a communication error like below occurred between the forwarder and splunk server.

◆ Splunk server
WARN HttpListener - Socket error from "forwarder ip" while idling: error: 1408 A 0 C 1: SSL routines: SSL 3 _ GET _ CLIENT _ HELLO: no shared cipher

◆ Forwarder
SSLCommon - Received fatal SSL 3 alert. Ssl_state = 'SSLv 3 read server hello A', alert_description = 'handshake failure'.

When we looked at other similar questions, we saw the answer like below.
"When splunk server side is ver 6.6, and Forwarder side is old ver, it can happen and it is a known issues"

Is this also a known issues like this?

0 Karma
1 Solution

skalliger
SplunkTrust
SplunkTrust

Usually this problem should be gone after upgrading the indexers and forwarders to 6.6.1.
Have you tried this?

Update the inputs.conf on your indexer(s) like this:

[SSL]
sslVersions = *,-ssl2
cipherSuite = ALL:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

Skalli

View solution in original post

0 Karma

skalliger
SplunkTrust
SplunkTrust

Usually this problem should be gone after upgrading the indexers and forwarders to 6.6.1.
Have you tried this?

Update the inputs.conf on your indexer(s) like this:

[SSL]
sslVersions = *,-ssl2
cipherSuite = ALL:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

Skalli

0 Karma

yutaka1005
Builder

Thank you Skalli.

When I investigated about the error, Only data transfer was succeed, but it seems that there was an error in the communication between deployment server (indexer) and forwarder with using the management port.

There was a workaround on a web page that you attached link.
The method is to add the following setting to "/opt/splunk/etc/system/local/server.conf" of the indexer side.

[sslConfig]
sslVersions = ,-ssl2
sslVersionsForClient = ,-ssl2
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH

So I tried it, and the error has gone!
Now I tentatively avoid this issue by this method, but soon I think I will also rise indexer to 6.6 ver.

Thanks a lot.

0 Karma

skalliger
SplunkTrust
SplunkTrust

Good to hear! 🙂 Glad to be of help.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...