This is more of a question, actually. When talking to customers about installing Zabbix, a frequent question that arises is whether traffic can go one way out of their data center to a Zabbix server (in the cloud, for instance) or if two-way communication is required? Everything I've looked at seems to indicate that even with active checks, the agent needs to get a list of checks from the server, thus necessitating two-way communication. Is there any documentation that clarifies this and/or addresses the question of network security? I know about encryption, but many customers do not want ANY incoming traffic. So if incoming traffic is indeed required, having a clearer idea of how that works would be great...

Thanks!