Auto-Registration Action + Active Proxy in DMZ Problem

[Luis Filipe]

Hi erveryone.

Im having a issue with Zabbix Proxy + DMZ + Auto-Registration Action combo.

I created the following infraestructure:

Zabbix Proxy - 192.168.50.10 in DMZ (firewall permissions was adjusted to communicate with server)

Zabbix Server - 192.168.2.20 in VLAN/Internal (firewall permissions was adjusted to communicate with proxy)

Zabbix Agent Active connected with Proxy.

Monitoring works fine, but specifically the auto-registration action does not.

I try connect a new machine (with no host registered) and Agent logs just show:

no active checks on server [mypublicdns]: host [myhostname] not found

Im figured could be a problem with configurations then i did a test:

Put Zabbix Server and Zabbix Proxy in the same VLAN/INTERNAL and....works fine.




I catched and autoregistration loop in Zabbix Server logs getting the gateway (literally 192.168.2.1) and trying autoregister, maybe thats the problem?

Already checked all info between Zabbix Agent Conf, metadata, server addresses, everything...nothing wrong here (confirmed when i manully register the host in Zabbix Frontend - Zabbix can monitor without problems)

Does anyone have any ideas what it could be?




Some additional information:

• Zabbix Proxy logs:

received configuration data from server - normal

unknows request received from "192.168.50.1" [active check heatbeat]

• Zabbix Server

sending configuration data to proxy "proxy" at "192.168.50.10"... - normal

process_autoregistration_contents(): "_gateway" is not a valid hostname

• Zabbix Active Agent

no active checks on server [mypublicdns]: host [myhostname] not found

• Auto Registration Rule

Condition:

host metadata contains: myinformation

Zabbix Proxy equals: MyZabbixProxy

Operations:

Add Host

Add to Host Groups: MyGroup

Link to template: MyTemplate

[Markku]

Based on your outputs ("192.168.50.1", "_gateway") and your statement that inside the firewall it works, your firewall is doing some kind of network address translations.

Markku

[Luis Filipe]

Based on your outputs ("192.168.50.1", "_gateway") and your statement that inside the firewall it works, your firewall is doing some kind of network address translations.

Markku

It makes sense. I went to check the firewall but NAT is disabled.

[Markku]

no active checks on server [mypublicdns]: host [myhostname] not found

Btw that is expected in the agent log for the first connection, the autoregistration is happening only after that. If you still experience the problems, show us the current logs again.

Markku

[Luis Filipe]

Btw that is expected in the agent log for the first connection, the autoregistration is happening only after that. If you still experience the problems, show us the current logs again.

Markku

I got packets with tcpdump and wireshak from Zabbix-Proxy to Zabbix-Server

Data [truncated]: {"request":"proxy data","host":"zbxproxy","session":"5d706c6f3c5a1a8 c7d822077d3201e3a","auto registration":[{"clock":1669751167,"host":"METAORA1000","ip":"192.168.50.1","dns":"_gateway","port":"10051","host_metadata":"midasnotebooks "," tls_accepted":1}],"version":"6.0.5","clock":1669751167,"ns":7436 735 81}

I already got this error in zabbix server logs:

106257:20221129:200514.592 process_autoregistration_contents(): "_gateway" is not a valid hostname


I found an issue almost similar: https://support.zabbix.com/browse/ZBX-17869 but was fixed in version 4.4.8..i'm using 6.0.5.