I am seeing a firewall block by the Windows Firewall for traffic returning to my forwarders from the deployment server. The rule they are hitting on is : "FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V4_SILENT_DROP". My forwarders are randomly having this issue across the environment, and there seems to be neither rhyme nor reason to which ones have the error. The 8089 traffic outbound from the universal forwarder gets to the deployer okay, but the TCP Dynamic return traffic is getting blocked because the return port does not match up to that of the outbound traffic.
splunkd.log shows lots of this error:
DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
Does anyone have a similar issue? Any ideas on where to look next?
↧