Has anyone successfully used a Heavy Forwarder to relay Universal Forwarder(s) connectivity to a Deployment Server?

[Log_wrangler]

Has anyone successfully used a Heavy Forwarder to relay Universal Forwarder(s) connectivity to a Deployment Server?

The scenario is that the UFs are going to send to the HF, and the DS is needed to configure the UFs.

The UFs can communicate with the HF and the HF can communicate to the DS, but the DS is behind a firewall, so it cannot communicate with the UFs. I know the HF has a FW allow, but I wanted to see if a relay would work.

Please advise.

Thanks

[gjanders · Accepted solution]

It sounds like your referring to somehow tunneling the connection through which doesn't sound like it will be possible.

However you can have tiered deployment servers, refer to Tiered Deployment Servers, is it possible? and the code example in github

This should help achieve your goal as the HF will become the deployment server of the UF's, it will also be the deployment client of the main deployment server

[Log_wrangler]

I will accept your answer as it is an option, however not what I was really looking for....

I was interested in the "tunnel" method via HF to DS.

But the HF would have to know how to handle the communication from the UFs so it could reach the DS.

Making the HF a DS as well, might be the only option here.

Thank you

[gjanders]

This is the only supported option I believe, you could change your heavy forwarder port from 8089 or have the clients phone home on a new port such as 8090 and attempt to use an OS level tunnel to get them to another host but that would not be a Splunk supported option.

Also note I've never tried an OS tunnel like that (I've used an SSH tunnel but that's about it).