Cisco Proximity connection to Splunk Cloud

[Ismail Aydemir]

Hi,

We currently have Cisco Proximity Software (versions 2.0.5.0 and 3.0.1) on our Windows 10 SOE fleet, endpoints are randomly attempting to establish external connections through proximity.exe to 34.230.180.181:8089;

Port 8089 is TCP for Splunk Daemon Management.
Name: ec2-34-230-180-181.compute-1.amazonaws.com
Address: 34.230.180.181

Navigating to ec2-34-230-180-181.compute-1.amazonaws.com displays Splunk > Cloud

My understanding is that this is expected and Cisco does indeed collect logs via Splunk Cloud;

https://www.cisco.com/c/en/us/about/legal/privacy-full/proximity-supplement.html

I would like to know if there will be any impact to the Proximity software if we disable/block outbound connections from proximity.exe going through to: ec2-34-230-180-181.compute-1.amazonaws.com Address: 34.230.180.181<http://34.230.180.181> ?

Regards,

Izzy

[mneergaa]

Apologies for the belated reply. There have been some updates to how well we handle Splunk not being reachable, so if you want to do this I strongly suggest you not run an older version of Cisco Proximity. Otherwise, no, the software works fine without its metrics server.