check systems after a firewall...

[Philippe]

Hello,

i work since a while with zabbix in a LAN environment, simple checks, snmp and servers with agents, graphs etc...
We are now doing a project and there will be 2 firewalls between our site and the other site (1 at our site and 1 at the other site) so it will be more difficult to monitor the remote systems.
I have no experience with it so i have some questions and hopefully someone can get me on track.

this is the situation:


ZABBIX SITE A => firewall => internet => firewall => SITE B SERVERS (agent, snmp)TO CHECK

1) is it possible to check servers and systems with an agent if there is a firewall between like in the previous example ?

2) does this has to be done with NAT & PAT on the firewalls ?

3) does SITE B needs a static ip address or is it possible with DNS ? (in case that point 2 is the way to monitor those servers and systems).

4) what exactly are active items ? i read about active items in the forum and people use them with firewalls ? is this the way to do it ? if so, how does it work ?

5) can i also do SNMP checks in this example ?
we monitor temperature via SNMP in our LAN with zabbix, is it also possible if there are 2 firewalls between ?

6) Does SITE A needs a static ip address ?



thnx a lot!
Phil.

[mbobkiewicz]

Well there could be several ways to do it, let me show you two:
1. VPN: Install a vpn client on the zabbix server make a connection to site b with it and you´re done. Building a vpn tunnel between site a and site b would also be an option but if you only want to monitor the hosts of site b with a zabbix server on site a for security reasons this should not be the way to go.
2. Port forwarding on the firewall of site b. Let´s say you want to monitor three hosts on site b with the ip adresses x.x.x.1, x.x.x.2 and x.x.x.3. The entries on firewall might look like this:
forward port 10050 -> x.x.x.1:10050
forward port 10051 -> x.x.x.2:10050
forward port 10052 -> x.x.x.3:10050
While I haven´t heard about any security risks with zabbix this sounds a bit like a bad idea to me.

Your server should have a fix ip anyway, because you have to specify one in your agent client file. With my first setup you get it with the vpn connection with the second you have to get one from your internet provider. Using something like dyndns might be a bit tricky while I don´t know much about the life time of a record. So if you get a new ip adress the monitored hosts may have cached the old ip adress and get down until they relookup the dyndns name.
To make one thing clear: I never had build up such an environment and maybe it´s all wrong but that´s the way I would try it.

Mike

[Philippe]

hello,
thanks for the reply, it's clear to me.

about the vpn client, this can work but if you have also other sites (site C, site D) that you want to monitor, then this works not anymore.

so, if working with different sites, the firewall configuration is the only solution.

what about the active checks ? how does that work ?
isn't it possible to let a client make access with the server ?
in that case, firewall configuration is easier for site B (only outgoing to fixed ip address of zabbix server).

thnx
Phil.

[mbobkiewicz]

Hm,
I think your vpn client should be able to make several vpn connections at the same time. Problem would be if two sites have the same network setup.
Active mode is also a solution but I never have tried that and I don´t know how that works with actions depending on timeouts.
Maybe another solution is new new feature of clustering zabbix servers. There are some posts aviable here in the forum declaring such a setup. But that would lead into more hardware and more setups to do and to maintain.

[Philippe]

is there a possibility that the agent pushes his info to the server without the server "asking" for information from the agent ?

[Alexei]

is there a possibility that the agent pushes his info to the server without the server "asking" for information from the agent ?

Sure! Use ZABBIX agent's active checks only.