Wazuh getting logs through IPsec
Greatings.
I'm deploying Wazuh on my lab environment trying to see if it matches my needs as I want to build a small SOC. As I have been playing with it, one question arose: I can monitor whatever is on the same network of my Wazuh, and different subnets or VLANs as long as my firewall allows traffic , but what about endpoints on remote locations?
Reading some old posts, I've seen that VPN or tunnelization is a possibility given that I would only monitor devices that are not BYOD or those which connects through a VPN to internal resources.
My question is now what follows:
Looking at the clearly 5 yo kid drawing, the logs would be tunnelized through an IPsec connection between both firewalls. If I show the network or the sole IP of the Wazuh server to the tunnel, the agents deployed in each endpoint may have configured the private IP of the Wazuh server or any configuration should be done?
2nd scenario: say I cant make a s2s IPsec tunnel for whatever reason and the client don't want to use VPN against me since they already have their own but still want to feed logs to my wazuh. Is possible to make something like CheckMK and install a "satellite" Wazuh which collects logs from the endpoints and then feeds them through VPN against my FW? Would I lose information if this method is used?
Thanks beforehand!