Agent ping failed > connection not allowed by agent

[ithierack]

hello,

i have an strange problem with on host, where i can't get the agent.ping working.

In the logfile on the agent i get

 12305:20151110:085909.163 failed to accept an incoming connection: connection from "10.1.0.158" rejected, allowed hosts: "10.1.0.2"

10.1.0.158 is the IP from the zabbix-Server DNS zabbix.ghostdive.local
10.1.0.2 it's on ip from the zabbix-agent

config on the agent side

### Option: Server
#       List of comma delimited IP addresses (or hostnames) of Zabbix servers.
#       Incoming connections will be accepted only from the hosts listed here.
#       If IPv6 support is enabled then '127.0.0.1', '::127.0.0.1', '::ffff:127.0.0.1' are treated equally.
#
# Mandatory: no
# Default:
# Server=

Server=zabbix.ghostdive.local

### Option: ServerActive
#       List of comma delimited IP:port (or hostname:port) pairs of Zabbix servers for active checks.
#       If port is not specified, default port is used.
#       IPv6 addresses must be enclosed in square brackets if port for that host is specified.
#       If port is not specified, square brackets for IPv6 addresses are optional.
#       If this parameter is not specified, active checks are disabled.
#       Example: ServerActive=127.0.0.1:20051,zabbix.domain,[::1]:30051,::1,[12fc::1]
#
# Mandatory: no
# Default:
# ServerActive=

ServerActive=zabbix.ghostdive.local

Any hint, where i can set 10.1.0.158 to allowed?

zabbix-server and agents are Version 2.4.6 - Server and client on CentOS 7.1

[evertonco]

have you restarted zabbix agent after change zabbix_agentd.conf?

[ithierack]

Restarted multiple times, include reboot the maschin(VM).

Maybe on thing is, it's an KVM-virtual maschine. But there are two other without any problems. This on complains about the zabbix-server is not allowed to access the agent. And it's the agent who has the restriction no the operation system.

[ithierack]

Found the problem.

There was an additional agent-config under zabbix_agentd.d where the server-parameter was also set.

removed it now it's working.

[lobiDA]

Hi can you please elaborate on your solution to the problem?

[jribeiro84]

[resolved]

EXAMPLE
12305:20151110:085909.163 failed to accept an incoming connection: connection from "10.1.0.158" rejected, allowed hosts: "10.1.0.2"

edit config file:
vi zabbix_agentd.conf

Server=0.0.0.0,10.1.0.158

You are probably going through NAT

This causes Zabbix source error and when it arrives at the destination with another IP agent blocks.


I hope it helps!

[websalga]

Use of cisco vpn client to acess zabbix agent

Hy everybody.

I have a service to my clients to monitoring they servers.
Normaly the conection is made via VPNC or Cisco vpn.
IP Adress of my zabbix server is not the same at all time.
My zabbix clients do not aceept and reject my server at new connection and new IP gaved from dhcp server at my client datacenter.
How to habiliti the client to aceept any server if my server uses vpn cliente to conect to my clients and vpn cliente receives other IP adress all the time to new conect are made?

Can you help-me?

[GPegel]

Maybe you should create a reservation in your DHCP setup so that the Zabbix server always has the same IP. ;-)

[websalga]

Maybe you should create a reservation in your DHCP setup so that the Zabbix server always has the same IP. ;-)

I not abel to configure a network at my clients.
My IP is dyanmic and conect via vpn, my server dont show same ip to may agents at new conection via vpn.

[allexpetrov]

Hello websalga,

How do you imagine this should happen? If you have a dynamic IP address and you don't have dynamic DNS in that network that will point the DNS-name to your IP, then how you think this should work?

You can allow connecting from the whole subnet range, but it is kinda security breach.

Regards,
Alex!

[websalga]

I resolve problem of zabbix server behind vpn connection

Some friend here in this forum give-me a solution.
Create a DNS replication and adotepted NOIP2 service to atualize the IP of zabbix server at internal network. All my zabbix clients espect to receive conections from my DNS NOIP updated server adress.

Problem solved.

I will construct one shell script that any time connect via vpn my dns always knows my Zabbix server IP.

Each time that i open VPN connection and receive a new IP my Noip service actualizes the dns information and my clients are knowing what is the new IP.

But this solution is a "brasilian acochambration" because zabbix dont are maked to work with vpn connections.

[allexpetrov]

But this solution is a "brasilian acochambration" because zabbix dont are maked to work with vpn connections.

What do you mean by that? Maybe your VPN isn't configured properly? There are two types of VPN - User VPN or Site to Site VPN, and I see that you are utilizing the User VPN, because usually in normally designed site to site VPNs you have a static IP address and you are interconnecting different remote subnets.

Blame yourself for bad design, not the Zabbix for "not being designed for work with VPN". Dynamic IP(DHCP) isn't a part of VPN but an independent protocol in any network.

[websalga]

Zabbix can be more pratical for monitoring via vpn

Some client not have network persons and not give a Fixc IP.
I am servicer contract to monitoring and analise the network servers at mys clients but i dont privilges and not needs this. I needs so unique vpn connection and that my client install zabbix client agente on all machines that they have to monitoring. Nothing more, no especial permissions, no net estructure, no admin confereces oe reunion, no delay, no burried with nothing, the client pay for services that i makes simples, fast, via vpn my server stay in touch with all agents, simple, what is about complicated of this?

Dudes, make zabbix agents to work from a named server not Fix IP from vpn, simple this.

Thank's, i show the form to resolve this inssue from zabbix.