Proxy behind firewall

[wjterveld]

Is it possible to have a proxy behind a firewall that only allows out going communication?
So we can install a proxy inside that collects al info and sends this to the zabbix server (outside). I have installed this but Zabbix keeps telling me that the agent is unreachable for 5 minutes..

[Hamardaban]

The interaction of system components (server/proxy/agent) occurs over the TCP Protocol, which cannot work only in one direction - reverse traffic is required. But usually firewalls are able to maintain a session. Therefore, you should talk about which side starts the connection (who connects to whom). Your case is called "active proxy" and is described here: https://www.zabbix.com/documentation...toring/proxies

[wjterveld]

Oke so if we need a environment where zabbix proxy makes an connection to the zabbix-server the proxy needs to be set to "Active Proxy"?
this is the case for this customer but we still get "Zabbix agent on XXXXXXX is unreachable for 5 minutes"

[Hamardaban]

Yes. "Select the proxy mode. Active - the proxy will connect to the Zabbix server and request configuration data"

[wjterveld]

oke in our case we did this but still Zabbix server reports the agent as "unreachable" ??
from the proxy I can namp to our zabbix server on 10050 and 10051.. so there should not be a problem there...

[Hamardaban]

What type of agents do you use?

Availability of the host is displayed. Four icons each represent a supported interface (Zabbix agent, SNMP, IPMI, JMX).
The current status of the interface is displayed by the respective colour:
Green - available
Red - not available (upon mouseover, details of why the interface cannot be reached are displayed)
Gray - unknown or not configured
Note that active Zabbix agent items do not affect host availability.

In the settings of network nodes it is specified that they work through a proxy?

[wjterveld]

In the proxy config I have setup the Server= option to point to out zabbix servers.
And in the agent (other server) I have setup the ServerActive= and Server= to the IP of the zabbixproxy server

In Zabbix the proxy says last seen 7h ago and the none of the agents report back the state zbx snmp jmxi or pmi (I beleive it should be zbx)

[wjterveld]

extra info:
When I chekc the proxy log I see this error:
cannot obtain configuration data from server at "xxx.xxx.xxx.xxx": empty string received
cannot send proxy data to server at "xxx.xxx.xxx.xxx": connection is not allowed

nmap xxx.xxx.xxx.xxx -p10050 tells me the port is open
nmap xxx.xxx.xxx.xxx -p10051 tells me the port is open

[Hamardaban]

Check this out

Host configuration

You can specify that an individual host should be monitored by a proxy in the host configuration form, using the Monitored by proxy field.

[wjterveld]

yes this option is set to the proxy in question..

[Hamardaban]

Pls show me how the parameter "ProxyMode" is configured in Proxy.conf

and picture like this:

• Go to: Administration → Proxies

Do you use some kind of encryption between components?

[wjterveld]

ProxyMode was left to default value.. #ProxyMode=0

[wjterveld]

I think I see the problem.. Apparently the external IP adress can change from xxx.xxx.xxx.123 to xxx.xxx.xxx.124 and back!!! Is there a way Zabbix can deal with this?
I have added the second IP address in the proxy config also..
The proxy is now responding oke.. But the agents still do not report in as the should... Still the repsond as "unreachable"

[wjterveld]

adding both IP addresses to the config made the proxy work. But the agents are still not reporting..

[Hamardaban]

See the agent and proxy logs for errors
And as I wrote earlier-agents only with active data elements do not display their state