Zabbix proxy: Issues sending SNMP data from network devices to Server

[86Zabbix]

Hello,

We have a remote site with network devices being monitored through a SNMP template. We recently added a Zabbix proxy configured in Passive Mode at the remote site. On the web console of the main server we see the Proxy is connected based on the Last Seen (age) data which is typically 5 seconds or less.

When we adjust the settings on the Hosts to redirect them to use the Proxy, the SNMP information is no longer received by the main server. Under the Configuration for the hosts the SNMP box changes from green to blank and we lose the data feeds for these devices sent to our dashboards. Does anyone know which resources would be helpful in troubleshooting this issue? For the zabbix_proxy.conf file, we have not touched any of the Proxy Specific parameters or Advanced parameters as we are unsure which items require to be added or uncommented.

I took note of items mentioned in the thread below.

https://www.zabbix.com/forum/zabbix-troubleshooting-and-problems/418529-how-to-monitor-an-snmp-device-behind-active-proxy

The proxy did not have snmpd installed and I followed the directions listed here but the SNMP issue continues.

https://kifarunix.com/quick-way-to-install-and-configure-snmp-on-ubuntu-20-04

[cyber]

Maybe proxy is not allowed to poll (ACL on devices side)?
You do not need snmpd to poll devices.. you may need snmptrapd if you want to receive traps/informs on that proxy...

[86Zabbix]

I spent some time today looking at the traffic flow for any potential ACLs or other rules blocking traffic. It looks like our environment is configured for agentless snmp polling. That explains why the Zabbix Server can see the data because it's making the request for the data. When setting the option on the host to use a Proxy, I'm assuming that only works if there's a Zabbix agent installed and it's pushing data out to the main server or proxy server. Now I need to hunt through the documentation to see if a Proxy can perform SNMP polling and how to configure that.

[Hamardaban]

Proxy can do SNMP pooling

https://www.zabbix.com/documentation/6.4/en/manual/config/items/itemtypes/snmp

[86Zabbix]

Thank you for the link. I see that it mentions how Proxies can perform SNMP polling, but the absence of any explicit steps to perform on the Proxy makes me wonder if this is supposed to occur automatically or if additional configuration on the Proxy needs to be performed. I've double checked firewall rules to ensure traffic flowing and everything is showing allowed. I have also tried selecting Active mode on the Server for the Proxy and modifying the .conf file on the Proxy to use Active mode along with other required Active mode settings. These adjustments have not worked to get the Server to display a green SNMP box under Configuration->Hosts. When I toggle the "Monitored by proxy" option back to no proxy, the SNMP box returns to green.

[solution]

Now that you have a proxy on the network.
in the SNMP Interface, use the Device's Internal IP, example: 192.168.0.55 and the SNMP port (Default is 161).
Do not use external IP (default when monitoring remote devices without VPN).

And always do a test to see if the proxy server can communicate and receive data from the device via SNMP

https://www.zabbix.com/documentation/6.4/en/manual/config/items/itemtypes/snmp#step-1

Wellington

[86Zabbix]

The devices/hosts are sending data to the main server without any issues. The SNMP interface doesn't need to be changed if we're pointing the devices/hosts to the Proxy instead of the main Server, does it?
I've run "snmpwalk -v 2c -c public <host IP> ." on the Proxy and it is able to retrieve the OIDs from each host we want to be moved under the Proxy for monitoring.

[solution]

depends on the topology.
If Monitoring remote SNMP devices without proxy or VPN:




When monitoring SNMP devices using a proxy or VPN:

When using a proxy, the proxy communicates and collects data, which is why the internal IP can be used.


Wellington

[86Zabbix]

Thank you for the explanation here. I had to go back to the drawing board and myself a "what-if" question to find the answer. "What if the Proxy is the source of the connections, not the Hosts?" On the firewall at the remote site I was missing an allow rule between the subnet the Proxy is on and the other subnet the Hosts are on.

[86Zabbix]

The fix for my problem was a better understanding of what the Proxy is doing and realizing I was missing a firewall rule at the remote site. It doesn't matter if the Proxy is in Active mode or Passive mode. The Proxy will be reaching out to the assigned hosts. You need to ensure you have appropriate rules on the firewall to ensure the Proxy (being the source) can successfully reach the Hosts.

[solution]

For those who have traffic rules in their Firewalls, the directions are as follows:

Zabbix Agent/Proxy Active:
Source: Zabbix Agent/Proxy
Destination: Zabbix Server

Zabbix Agent (Passive Mode), IPMI, SNMP, HTTP
With Proxy:
Source: Zabbix Proxy
Destination: Host/Device/URL

No Proxy
Source: Zabbix Server
Destination: Host/Device/URL


Wellington