How to monitor an SNMP device behind active proxy

[davidkillingsworth]

I have a central Zabbix server.
I have active proxys setup at several of our clients sites.

I can also install the Zabbix agent for Windows or Linux and set them to their local proxy at their site and then add the host on the Zabbix server (ensuring to set monitored by proxy) and use their local proxy in the host configuration on the central Zabbix server.

This is all working.

What I can't figure out how to do is monitor any SNMP devices at each customer site.

Since the Zabbix proxys are active, they report to the central Zabbix server. The central Zabbix server is publicly Internet accessible, but the proxy's are behind client firewalls and we don't want to open any firewall rules at client sites. So the proxys are active proxys instead of passive.

I've looked through documentation, but I can't figure out how to do this. What do I have to configure on the Zabbix proxy for this to work?

I feel like I'm missing a key factor, but I haven't found any clear how to or tutorial on how to set this up.


Thanks in advance.

[NilsA]

Your Zabbix proxy needs snmpd (and optionally snmptrapd) to monitor devices over SNMP. So check if that's installed first.
Then you need to figure out the devices you want to monitor and which SNMP versions they use and then configure the devices accordingly before adding them to your UI and setting them to be monitored by your proxy.
SNMPv2c or SNMP1 are easiest to configure and are often times already working on SNMP devices like printers. If there's a policy forbidding that, you'll need to configure SNMPv3 accesses for your proxy.
You can check if SNMP itself works with the configured accessing methods over the commandline (use snmpwalk / snmpget commands).

Then you need to figure out what to monitor and just add the templates or just create a single item for testing. And don't forget to add the SNMP interface to your host with all the login information / community.

[ratalene]

Hello, I was able to configure the zabbix proxy at my client, and snmpwalk properly queries my servers at this client.
However I try to declare it on my Zabbix server located in my company network.
And here I have a problem, should I declare the public IP of my client and then query the zabbix proxy? On this subject when adding a host via the zabbix proxy, do I have to rely on the zabbix agent? Indeed, I want to redirect flows using the Zabbix agent port, but I do not want to rely on SNMP to report information from my client's servers.
I would like to point out that there is no permanent VPN between my company's network and that of my client.
How to synchronize without using a permanent VPN?
The documentation is not very exhaustive on this subject.

[jnsvano]

And here I have a problem, should I declare the public IP of my client and then query the zabbix proxy? On this subject when adding a host via the zabbix proxy, do I have to rely on the zabbix agent? Indeed, I want to redirect flows using the Zabbix agent port, but I do not want to rely on SNMP to report information from my client's servers.
I would like to point out that there is no permanent VPN between my company's network and that of my client.
How to synchronize without using a permanent VPN?

If I understand correctly your problem, you have no permanent connection between zabbix proxy and zabbix server ? You can maybe set very long time (one hour, for example) to poll proxy, or vice versa (depending does proxy passive/active).

[ratalene]

hello, I have no problem resuming the proxy sync, however when I declare a host with the public IP (and the firewall rules + address translation), I have a zabbix agent in orange with the message following :
"Get value from agent failed: cannot connect to [Public IP ADDRESS]:10050]: [111] Connection refused"

I have the impression that on the zabbix proxy side I have a missing setting to authorize my zabbix console (located in another local network) to retrieve information related to the zabbix agent

Thank you for your reply

[cyber]

There is no difference is it an agent or snmp queries. You define that host same way, just with snmp interface (and credentials). Set it to be monitored by proxy. If you use only snmp queries, you do not need snmptrapd etc. If you want to use also traps, make sure you have snmptrapd installed on proxy and devices send their traps to proxy. That local proxy will do all the querying and will forward all the data to your server, pretty much same as it would do with passive agent.

[jnsvano]

hello, I have no problem resuming the proxy sync, however when I declare a host with the public IP (and the firewall rules + address translation), I have a zabbix agent in orange with the message following :
"Get value from agent failed: cannot connect to [Public IP ADDRESS]:10050]: [111] Connection refused"

I have the impression that on the zabbix proxy side I have a missing setting to authorize my zabbix console (located in another local network) to retrieve information related to the zabbix agent

In case of proxy, you must set ip address of agent/snmp device/whatever as related to proxy, so if you have snmp device with address 192.168.0.1 and proxy sees it, then set it as is.

[ratalene]

jnsvano Thank you very much, it's ok for me. So if we have severals clients with the same IP Lan address, it's ok because the proxy zabbix is defined with public IP.