Zabbix Proxy

Installing Zabbix Proxy on IXON Secure Edge Pro

This is a Docker app and can be deployed onto the SecureEdge Pro gateway. 

Prerequisites

• Hardware: IXON SecureEdge Pro.

• Architecture: Ensure your image is built for arm v8 (ARM64).

• Files: Your Zabbix TLS certificates (.pem) or PSK files.

Step 1: Prepare the Custom Dockerfile
To ensure your Zabbix Proxy can authenticate with your Zabbix Server, you must include your certificates and configuration files during the image build process.

Create a directory on your development machine, place your certificates inside a subfolder (e.g., /certs), and create a file named Dockerfile with the following content:

# Use official Zabbix Proxy image as the base (ensure it is ARM compatible)
FROM zabbix/zabbix-proxy-mysql:latest

# Copy your TLS certificates or PSK files into the container
# Assuming you have these files in a local directory called 'certs'
COPY ./certs/my_cert.pem /etc/zabbix/ssl/certs/my_cert.pem
COPY ./certs/my_key.pem /etc/zabbix/ssl/keys/my_key.pem
COPY ./certs/ca.pem /etc/zabbix/ssl/certs/ca.pem

# For PSK, if you're using PSK instead of certificates:
# COPY ./psk/psk.key /etc/zabbix/ssl/psk.key

# Ensure proper file permissions for the Zabbix user
RUN chmod 600 /etc/zabbix/ssl/certs/my_cert.pem /etc/zabbix/ssl/keys/my_key.pem
RUN chown zabbix:zabbix /etc/zabbix/ssl/certs/my_cert.pem /etc/zabbix/ssl/keys/my_key.pem

# Optional: Copy a customized zabbix_proxy.conf if specific settings are required
# COPY ./zabbix_proxy.conf /etc/zabbix/zabbix_proxy.conf

# Expose the default Zabbix Proxy port
EXPOSE 10051

Step 2: Build and Push the Image

Refer to the IXON Support Documentation for instructions on pushing your custom ARM64 image to the SecureEdge Pro. 

Step 3: Configure Firewall and Network

The Zabbix Proxy must communicate from the IXON WAN port, through the factory firewall, to your central server.

Direction: Outbound (Active Proxy)

This is the recommended setup for factory environments to avoid "Inbound" port forwarding rules.

• Source: IXON SecureEdge Pro (WAN IP)

• Destination: Your Zabbix Server Public IP

• Protocol/Port: TCP 10051

• Firewall Action: Ensure the factory IT department allows outbound traffic on port 10051 from the IXON's WAN interface

For more information, contact support@ixon.cloud