Use Zabbix for off-site servers that cannot be connected to

[bartfriederichs]

I just started Zabbix in my search for a tool that needs to do the following.

I want to monitor servers that are located at a customer's location, where I have little to no control on the IT structure, as it is the customer's IT department. The best I can probably get them to do is open an outgoing route to a cloud server (where I would host Zabbix server). For some maybe even for certain times during the day. We can reach all customer's servers using (different) VPN. All of them are on-premise of the customer, some virtualized, none in the cloud. The usually do not have full internet access.

We have multiple customers that I all want to connect to a single Zabbix server. Like below, each color represents a different customer, with wildly different IT structures and policies.



I have installed Zabbix using the appliance and can successfully monitor a Windows machine on the local network. However, it looks like there is a connection going from the server to the agent (over TCP port 10050), which would not be possible in the setup I want to use it in.

Can Zabbix accommodate this for me, and if so, how?

[Markku]

https://majornetwork.net/2017/10/zabbix-components-and-ports/

https://www.zabbix.com/documentation/current/en/manual/distributed_monitoring/proxies

Markku

[cyber]

As Markku suggested, don't try to connect those hosts directly to your Server... Try to put a proxy on their premises and connect that one to your Server.

[bartfriederichs]

Thanks, I will look into this. One small followup question: our customers typically only have one server. Could I install both the agent and the proxy on the same machine?

[Markku]

Sure.

It's up to your operational processes though, as you don't really need a proxy at all in that case. One usual reason for installing a proxy in the customer network is that the clients (the monitored servers, or active agents) are not allowed to communicate with the external Zabbix server directly, thus the proxy is installed and allowed to communicate. But if the proxy host is the only monitored host anyway, the proxy is not bringing much benefit there, one more managed software component. Maybe you want to install proxy anyway to get identical setup with all customers, despite the additional administrative overhead.

Also note that major Zabbix updates (6.0.x -> 6.2.x, and so on) must be performed at the same maintenance for Zabbix server and all the proxies, while lower-version agents are generally compatible with higher-version server/proxies.

Markku