How to monitor devices behind a firewall without the agent?
I'm currently evaluating Zabbix as a monitoring software, my knowledge is purely theoretical and thus quite limited. I have a question that I couldn't find a clear answer for searching on the web, hopefully someone here can clarify.
If I understand it correctly, Zabbix is set up the following way: There is a Zabbix server that can be either on-premise or not. In order to monitor other devices, the server will either query open interfaces on these devices (using network protocols with open ports), or an agent program can be installed on the monitored device in which case the agent will communicate with the server.
Assuming that the Zabbix server is in one location, reachable over a public IP, and the monitored devices are in a private network at another location, the Zabbix server would not be able to get much information from these devices unless we let those requests through the firewall. Which is a security issue, of course. However, if the agent is used and there are no blocking outbound firewall rules, then the agent can safely communicate with the Zabbix server.
So what is the right approach then to monitor devices within this local subnet that don't support Zabbix agent? For example, devices that support SNMP only? Is it possible to use another Zabbix agent within the subnet to include these devices in its monitoring? Alternatively, can the server be instructed to open a VPN channel, on demand, to the private network in order to safely query those devices directly?
I hope the question makes sense like this. Thanks for indulging me.
Vic
If I understand it correctly, Zabbix is set up the following way: There is a Zabbix server that can be either on-premise or not. In order to monitor other devices, the server will either query open interfaces on these devices (using network protocols with open ports), or an agent program can be installed on the monitored device in which case the agent will communicate with the server.
Assuming that the Zabbix server is in one location, reachable over a public IP, and the monitored devices are in a private network at another location, the Zabbix server would not be able to get much information from these devices unless we let those requests through the firewall. Which is a security issue, of course. However, if the agent is used and there are no blocking outbound firewall rules, then the agent can safely communicate with the Zabbix server.
So what is the right approach then to monitor devices within this local subnet that don't support Zabbix agent? For example, devices that support SNMP only? Is it possible to use another Zabbix agent within the subnet to include these devices in its monitoring? Alternatively, can the server be instructed to open a VPN channel, on demand, to the private network in order to safely query those devices directly?
I hope the question makes sense like this. Thanks for indulging me.
Vic
Comment