Using Zabbix across multiple sites behind firewall/NAT

[Zenith]

Hi everyone,

I'm new to using Zabbix (just about to start). I work for an IT company who provide support to schools in our local area. We have about 100 or so schools, each of which has 2-3 ESXi servers which run a number of windows guest servers. They also have printers/firewall/switches internally on their network that I believe I can monitor with SNMP.

We are are looking to monitor these devices from a single location. From some reading around the approach we are thinking of taking is to configure a public facing server which hosts zabbix, the database and web front end. Then zabbix proxy in each location running on the existing ESXi hardware and then most likely the windows zabbix agent on the servers. My understanding is that we then add a the proxy to the main zabbix install so it's aware of it and then when we add a host we tell it which proxy it is monitored via. So, hopefully one proxy in each location will monitor whatever devices/services we need in that school.

Before we make a start does this sound like the correct way to go? Has anyone got a similar setup themselves, obviously we are aware we need to open the ports on the firewall's to allow communication between the main server and the zabbix proxies, how would people suggest we organise the devices within zabbix itself, ideally we need some way to view/monitor all devices at a particular site separate to others (or at least be able to filter to them).

Any suggestions or tips are greatly appreciated.

Thanks,

Zenith

[Hamardaban]

in short: the direction of thoughts is correct; the ports of interaction of the server, proxy and agents are configured in the appropriate configs; it is possible to use encryption when exchanging data;

Read the documentation! https://www.zabbix.com/documentation...ction/overview

[LenR]

I think you can setup a host group for each site, then nested groups under that site for servers, switches, printers etc. Zabbix can discover network devices and auto register servers that have the agent properly configured. You could have a discovery and/or auto registration rule for each proxy that would then add that site's devices to the proper group and connect the proper templates.

Alternatively, if you have a central device inventory, you could use the api to create Zabbix hosts, assign groups and templates.

We are a mix of these; our network devices had an inventory system pre Zabbix, so they script the definition of those devices. Our server build automation installs and configures the Zabbix agent so it knows to connect to it's proxy which drives auto registration for servers.

[Zenith]

Hi both,

This is all great into thanks, will definitely have to do some testing. For the time being I don't if we have to manually add the hosts for each site as we really don't have that many to manage in the grand scheme of things. But I like the idea of automatically registering agents to the correct group and assign the correct template, should we go as far as pushing this monitoring out to clients too that sounds like just the solution we would need.

Thanks again, hoping to have a play over the summer holidays.

Cheers

[Hamardaban]

I recommend that you read the manual. As you work, you will stop having questions and in order not to be a blind kitten, learn to get answers yourself.
In particular, here it is described how you can automate the addition of devices : https://www.zabbix.com/documentation...nual/discovery

[Zenith]

Hi Hamardaban,

Thanks, I've been reading the manual and watching some of the introduction videos that explain the features and proxy configuration etc, I just wanted to double check I'm going to be heading in the right direction before I take the first step.

Cheers