Hey! Following this post I'm wondering if addressable terminators behave differently in clustered setups?
I was able to get the addressable terminators working with the examples provided in that post, but when I tried it on a clustered setup I wasn't able to get it to work.
Any ideas if they should work in a clustered setup? I double and triple checked and everything should match my non clustered setup where I was able to get it to work.
Thanks!
Hi @montwepa, they should work the same in clustered and non-clustered. If you want to share what specifically you're seeing, we might be able to help. Are the terminators getting created? Are they getting created with the right instanceIds? What are the specific errors that you are seeing?
Paul
Hi @plorenz thanks for the reply!
As far as I can see there's no error. I can see the terminators in ZAC etc.
If I try to go to client3.ziti.net (running simple python hello world) I get:
But pressing contiue to site just gives: "Hmmm… can't reach this page"
When I go to the same page on my non clustered setup, I get the same warning but I can reach and access said page.
Here are the configs. First my non cluster setup:
addressable-service
{
"name": "addressable-service",
"roleAttributes": [],
"configs": [
"5K9V1Hzht8JD3KAdIUgiV5",
"sAMUV9wbbb4xnlMM6Tmxh"
],
"encryptionRequired": true,
"terminatorStrategy": "smartrouting",
"tags": {}
}
addressable-service.host.v1
{
"_links": {
"self": {
"href": "./configs/sAMUV9wbbb4xnlMM6Tmxh"
}
},
"createdAt": "2026-03-19T09:57:45.608Z",
"id": "sAMUV9wbbb4xnlMM6Tmxh",
"tags": {},
"updatedAt": "2026-03-19T10:24:20.919Z",
"configType": {
"_links": {
"self": {
"href": "./config-types/NH5p4FpGR"
}
},
"entity": "config-types",
"id": "NH5p4FpGR",
"name": "host.v1"
},
"configTypeId": "NH5p4FpGR",
"data": {
"protocol": "tcp",
"address": "127.0.0.1",
"forwardPort": true,
"allowedPortRanges": [
{
"low": 1,
"high": 65535
}
],
"httpChecks": [],
"listenOptions": {
"bindUsingEdgeIdentity": false,
"identity": "$tunneler_id.name"
},
"portChecks": []
},
"name": "addressable-service.host.v1"
}
addressable-service.intercept.v1
{
"_links": {
"self": {
"href": "./configs/5K9V1Hzht8JD3KAdIUgiV5"
}
},
"createdAt": "2026-03-19T09:53:07.455Z",
"id": "5K9V1Hzht8JD3KAdIUgiV5",
"tags": {},
"updatedAt": "2026-03-19T10:13:42.118Z",
"configType": {
"_links": {
"self": {
"href": "./config-types/g7cIWbcGg"
}
},
"entity": "config-types",
"id": "g7cIWbcGg",
"name": "intercept.v1"
},
"configTypeId": "g7cIWbcGg",
"data": {
"portRanges": [
{
"low": 1,
"high": 65535
}
],
"addresses": [
"*.ziti.net"
],
"dialOptions": {
"identity": "$dst_hostname"
},
"protocols": [
"tcp",
"udp"
]
},
"name": "addressable-service.intercept.v1"
}
addressable-service.bind
{
"_links": {
"identities": {
"href": "./service-policies/2USUUaosyh4m2pqN1Zv13N/identities"
},
"posture-checks": {
"href": "./service-policies/2USUUaosyh4m2pqN1Zv13N/posture-checks"
},
"self": {
"href": "./service-policies/2USUUaosyh4m2pqN1Zv13N"
},
"services": {
"href": "./service-policies/2USUUaosyh4m2pqN1Zv13N/services"
}
},
"createdAt": "2026-03-19T10:00:44.273Z",
"id": "2USUUaosyh4m2pqN1Zv13N",
"tags": {},
"updatedAt": "2026-03-19T10:00:44.273Z",
"identityRoles": [
"#WINNET"
],
"identityRolesDisplay": [
{
"name": "#WINNET",
"role": "#WINNET"
}
],
"name": "addressable-service.bind",
"postureCheckRoles": null,
"postureCheckRolesDisplay": [],
"semantic": "AnyOf",
"serviceRoles": [
"@6YMzwOypXsLSrvclkfw39O"
],
"serviceRolesDisplay": [
{
"name": "@addressable-service",
"role": "@6YMzwOypXsLSrvclkfw39O"
}
],
"type": "Bind"
}
addressable-service.dial
{
"_links": {
"identities": {
"href": "./service-policies/5kEkQUt3AI9EI2vMFZ0ju2/identities"
},
"posture-checks": {
"href": "./service-policies/5kEkQUt3AI9EI2vMFZ0ju2/posture-checks"
},
"self": {
"href": "./service-policies/5kEkQUt3AI9EI2vMFZ0ju2"
},
"services": {
"href": "./service-policies/5kEkQUt3AI9EI2vMFZ0ju2/services"
}
},
"createdAt": "2026-03-19T10:00:00.930Z",
"id": "5kEkQUt3AI9EI2vMFZ0ju2",
"tags": {},
"updatedAt": "2026-03-19T10:00:00.930Z",
"identityRoles": [
"#WINNET"
],
"identityRolesDisplay": [
{
"name": "#WINNET",
"role": "#WINNET"
}
],
"name": "addressable-service.dial",
"postureCheckRoles": null,
"postureCheckRolesDisplay": [],
"semantic": "AnyOf",
"serviceRoles": [
"@6YMzwOypXsLSrvclkfw39O"
],
"serviceRolesDisplay": [
{
"name": "@addressable-service",
"role": "@6YMzwOypXsLSrvclkfw39O"
}
],
"type": "Dial"
}
From the clustered setup:
{
"name": "addressable-service",
"roleAttributes": [],
"configs": [
"2tSo8zGq6FSO5lO8rwuP23",
"3mvEFZVh27hu3flykbM3tw"
],
"encryptionRequired": true,
"terminatorStrategy": "smartrouting",
"tags": {}
}
{
"name": "addressable-service.host.v1",
"configTypeId": "NH5p4FpGR",
"data": {
"protocol": "tcp",
"address": "127.0.0.1",
"forwardPort": true,
"allowedPortRanges": [
{
"low": 1,
"high": 65535
}
],
"httpChecks": [],
"listenOptions": {
"bindUsingEdgeIdentity": false,
"identity": "$tunneler_id.name"
},
"portChecks": []
},
"tags": {}
}
{
"name": "addressable-service.intercept.v1",
"configTypeId": "g7cIWbcGg",
"data": {
"portRanges": [
{
"low": 1,
"high": 65535
}
],
"addresses": [
"*.ziti.net"
],
"dialOptions": {
"identity": "$dst_hostname"
},
"protocols": [
"tcp",
"udp"
]
},
"tags": {}
}
{
"name": "addressable-service.bind",
"appData": "",
"serviceRoles": [
"@6I3P8JXnvnEBnvK695Rifh"
],
"identityRoles": [
"#WINNET"
],
"postureCheckRoles": [],
"semantic": "AnyOf",
"type": "Bind",
"tags": {}
}
{
"name": "addressable-service.dial",
"appData": "",
"serviceRoles": [
"@6I3P8JXnvnEBnvK695Rifh"
],
"identityRoles": [
"#WINNET"
],
"postureCheckRoles": [],
"semantic": "AnyOf",
"type": "Dial",
"tags": {}
}
and a terminator from the clustered setup:
{
"_links": {
"self": {
"href": "./terminators/2A1NuEZuP0WOBIKdF8xeB6"
}
},
"createdAt": "2026-04-09T18:38:09.263Z",
"id": "2A1NuEZuP0WOBIKdF8xeB6",
"tags": {},
"updatedAt": "2026-04-09T18:38:09.263Z",
"address": "2A1NuEZuP0WOBIKdF8xeB6",
"binding": "edge",
"cost": 0,
"dynamicCost": 0,
"identity": "client1.ziti.net",
"precedence": "default",
"router": {
"_links": {
"self": {
"href": "./transit-routers/ASVlrXJ0x6"
}
},
"entity": "transit-routers",
"id": "ASVlrXJ0x6",
"name": "router.xxxxx"
},
"routerId": "ASVlrXJ0x6",
"service": {
"_links": {
"configs": {
"href": "./services/6I3P8JXnvnEBnvK695Rifh/configs"
},
"self": {
"href": "./services/6I3P8JXnvnEBnvK695Rifh"
},
"service-edge-router-policies": {
"href": "./services/6I3P8JXnvnEBnvK695Rifh/service-edge-router-policies"
},
"service-policies": {
"href": "./services/6I3P8JXnvnEBnvK695Rifh/service-policies"
},
"terminators": {
"href": "./services/6I3P8JXnvnEBnvK695Rifh/terminators"
}
},
"entity": "services",
"id": "6I3P8JXnvnEBnvK695Rifh",
"name": "addressable-service"
},
"serviceId": "6I3P8JXnvnEBnvK695Rifh"
}
Thanks in advance 
HI @montwepa , that's hepful. We can see that the terminator is being created and the 'identity' field is set.
Side note: this field is being renamed to instanceId, as the term identity is already overused in ziti. If you use the fabric api, you'll instanceId. In the next rev of the API, it will be instanceId across the board.
So, the terminator looks correct, so it's not a hosting issue. If you're not seeing any indication of an error, then it's likely to be something in your python hello world. If a dial attempt is being made, you should at least see a circuit failure event from the controller (see: Events | NetFoundry Documentation).
If there's no evidence of the client dialing (nothing in the router logs, nothing in the controller log, no circuit event), then it's a sdk or client issue. If you find something in the router or controller, let me know and I'll try to help. If it's a python sdk issue, I can point one of the sdk guys at this post
Cheers,
Paul
Hi @plorenz,
I went and checked the tunneler logs and found the following:
ERROR ziti-sdk:connect.c:1052 connect_reply_cb() conn[5.43/IA-JFRiI/Connecting](addressable-service) failed to connect, reason=service 6YMzwOypXsLSrvclkfw39O has no terminators for instanceId client3.ziti.net
Any ideas why this would be?
Also I'm not using the python SDK, just connecting to the port where the hello world is running through OpenZiti.
Thanks!
Hi @montwepa , the dial shows it's trying to connect to service 6YMzwOypXsLSrvclkfw39O with instanceId client3.ziti.net. Can you check if you have a terminator with that instanceId/identity (field name varies, depending on if you're looking with ziti fabric list terminatorsorziti edge list terminators`?
Paul
Hi again @plorenz
Think that was a red herring. Seems that it was complaining that my non-clustered service didn't have a terminator for the clustered one which makes sense.
Clustered Terminator:
{
"_links": {
"self": {
"href": "./terminators/17gQNDOgTGeHGVM7gakQx1"
}
},
"createdAt": "2026-04-17T06:45:14.691Z",
"id": "17gQNDOgTGeHGVM7gakQx1",
"tags": {},
"updatedAt": "2026-04-17T06:45:14.691Z",
"address": "17gQNDOgTGeHGVM7gakQx1",
"binding": "edge",
"cost": 0,
"dynamicCost": 0,
"identity": "client3.ziti.net",
"precedence": "default",
"router": {
"_links": {
"self": {
"href": "./transit-routers/JLD5mo6BiY"
}
},
"entity": "transit-routers",
"id": "JLD5mo6BiY",
"name": "router...."
},
"routerId": "JLD5mo6BiY",
"service": {
"_links": {
"configs": {
"href": "./services/6I3P8JXnvnEBnvK695Rifh/configs"
},
"self": {
"href": "./services/6I3P8JXnvnEBnvK695Rifh"
},
"service-edge-router-policies": {
"href": "./services/6I3P8JXnvnEBnvK695Rifh/service-edge-router-policies"
},
"service-policies": {
"href": "./services/6I3P8JXnvnEBnvK695Rifh/service-policies"
},
"terminators": {
"href": "./services/6I3P8JXnvnEBnvK695Rifh/terminators"
}
},
"entity": "services",
"id": "6I3P8JXnvnEBnvK695Rifh",
"name": "addressable-service"
},
"serviceId": "6I3P8JXnvnEBnvK695Rifh"
}
From my non cluster setup.
Terminator:
{
"_links": {
"self": {
"href": "./terminators/4ixD8cOvJfZzrMVvfLJm1V"
}
},
"createdAt": "2026-04-17T06:44:48.343Z",
"id": "4ixD8cOvJfZzrMVvfLJm1V",
"tags": {},
"updatedAt": "2026-04-17T06:44:48.343Z",
"address": "4ixD8cOvJfZzrMVvfLJm1V",
"binding": "edge",
"cost": 0,
"dynamicCost": 0,
"identity": "story2.ziti.net",
"precedence": "default",
"router": {
"_links": {
"self": {
"href": "./transit-routers/t.255R.-H"
}
},
"entity": "transit-routers",
"id": "t.255R.-H",
"name": "router..."
},
"routerId": "t.255R.-H",
"service": {
"_links": {
"configs": {
"href": "./services/6YMzwOypXsLSrvclkfw39O/configs"
},
"self": {
"href": "./services/6YMzwOypXsLSrvclkfw39O"
},
"service-edge-router-policies": {
"href": "./services/6YMzwOypXsLSrvclkfw39O/service-edge-router-policies"
},
"service-policies": {
"href": "./services/6YMzwOypXsLSrvclkfw39O/service-policies"
},
"terminators": {
"href": "./services/6YMzwOypXsLSrvclkfw39O/terminators"
}
},
"entity": "services",
"id": "6YMzwOypXsLSrvclkfw39O",
"name": "addressable-service"
},
"serviceId": "6YMzwOypXsLSrvclkfw39O"
}
But I found these logs which are probably more important:
DEBUG ziti-sdk:connect.c:520 process_connect() conn[5.345/gW8Ig0d8/Connecting](addressable-service) requesting 'Dial' session for service[addressable-service]
[2026-04-17T00:15:23.101Z] DEBUG ziti-sdk:ziti_ctrl.c:504 ctrl_body_cb() ctrl[https://controller.cluster.xxxx.com:443/edge/client/v1] completed POST[/sessions] in 0.338 s
[2026-04-17T00:15:23.101Z] DEBUG ziti-sdk:connect.c:481 connect_get_net_session_cb() conn[4.48/I4lLhY8W/Connecting](cluster-X1) got session[6483a33e-a30c-40b5-abed-5937ec509c4b] for service[cluster-X1]
[2026-04-17T00:15:23.101Z] DEBUG ziti-sdk:posture.c:210 ziti_send_posture_data() ztx[4] posture checks must_send set to TRUE, new_session_id[FALSE], must_send_every_time[TRUE], new_controller_instance[FALSE]
[2026-04-17T00:15:23.101Z] DEBUG ziti-sdk:connect.c:543 process_connect() conn[4.48/I4lLhY8W/Connecting](cluster-X1) starting Dial connection for service[cluster-X1] with session[6483a33e-a30c-40b5-abed-5937ec509c4b]
[2026-04-17T00:15:23.101Z] DEBUG ziti-sdk:connect.c:403 ziti_connect() conn[4.48/I4lLhY8W/Connecting](cluster-X1) selected ch[router.cluster.xxxx.com@tls://router.cluster.xxxx.com:443] for best latency(179 ms)
[2026-04-17T00:15:23.101Z] DEBUG ziti-sdk:channel.c:238 ziti_channel_add_receiver() ch[3] added receiver[48]
[2026-04-17T00:15:23.221Z] DEBUG tunnel-sdk:ziti_tunnel.c:221 ziti_tunneler_dial_completed() ziti dial succeeded: client[tcp:100.64.0.1:64104] service[cluster-X1]
[2026-04-17T00:15:23.222Z] DEBUG tunnel-sdk:tunnel_tcp.c:66 on_accept() on_accept: 0
[2026-04-17T00:15:23.233Z] DEBUG ziti-sdk:ziti_ctrl.c:504 ctrl_body_cb() ctrl[https://controller.non-cluster.com:443] completed POST[/sessions] in 0.329 s
[2026-04-17T00:15:23.233Z] DEBUG ziti-sdk:connect.c:481 connect_get_net_session_cb() conn[5.344/fYj3RojK/Connecting](addressable-service) got session[1f87923c-11d7-4f75-89c1-92e8ba2c3382] for service[addressable-service]
[2026-04-17T00:15:23.233Z] DEBUG ziti-sdk:posture.c:210 ziti_send_posture_data() ztx[5] posture checks must_send set to TRUE, new_session_id[FALSE], must_send_every_time[TRUE], new_controller_instance[FALSE]
[2026-04-17T00:15:23.233Z] DEBUG ziti-sdk:connect.c:543 process_connect() conn[5.344/fYj3RojK/Connecting](addressable-service) starting Dial connection for service[addressable-service] with session[1f87923c-11d7-4f75-89c1-92e8ba2c3382]
[2026-04-17T00:15:23.233Z] DEBUG ziti-sdk:connect.c:414 ziti_connect() conn[5.344/fYj3RojK/Connecting](addressable-service) waiting for suitable channel
[2026-04-17T00:15:23.233Z] DEBUG ziti-sdk:connect.c:545 process_connect() conn[5.344/fYj3RojK/Connecting](addressable-service) no active edge routers, pending ER connection
[2026-04-17T00:15:23.293Z] DEBUG ziti-sdk:connect.c:1411 process_edge_message() conn[4.48/I4lLhY8W/Connected](cluster-X1) peer capability: stream[N] multipart[Y] trace[Y]
[2026-04-17T00:15:23.372Z] DEBUG ziti-sdk:ziti_ctrl.c:504 ctrl_body_cb() ctrl[https://controller.non-cluster.com:443] completed POST[/sessions] in 0.466 s
[2026-04-17T00:15:23.372Z] DEBUG ziti-sdk:connect.c:477 connect_get_net_session_cb() conn[5.345/gW8Ig0d8/Connecting](addressable-service) discarding existing session[1f87923c-11d7-4f75-89c1-92e8ba2c3382] for service[addressable-service]
[2026-04-17T00:15:23.372Z] DEBUG ziti-sdk:posture.c:210 ziti_send_posture_data() ztx[5] posture checks must_send set to TRUE, new_session_id[FALSE], must_send_every_time[TRUE], new_controller_instance[FALSE]
[2026-04-17T00:15:23.372Z] DEBUG ziti-sdk:connect.c:543 process_connect() conn[5.345/gW8Ig0d8/Connecting](addressable-service) starting Dial connection for service[addressable-service] with session[eec278f4-e862-42d2-8a48-4a688ffc5fed]
[2026-04-17T00:15:23.372Z] DEBUG ziti-sdk:connect.c:414 ziti_connect() conn[5.345/gW8Ig0d8/Connecting](addressable-service) waiting for suitable channel
[2026-04-17T00:15:23.372Z] DEBUG ziti-sdk:connect.c:545 process_connect() conn[5.345/gW8Ig0d8/Connecting](addressable-service) no active edge routers, pending ER connection
[2026-04-17T00:15:23.627Z] DEBUG ziti-sdk:bind.c:108 rebind_delay_cb() server[4.42](addressable-service) staring re-bind
[2026-04-17T00:15:23.886Z] DEBUG ziti-sdk:bind.c:108 rebind_delay_cb() server[4.45](addressable-service) staring re-bind
[2026-04-17T00:15:23.980Z] DEBUG ziti-sdk:ziti_ctrl.c:504 ctrl_body_cb() ctrl[https://controller.cluster.xxxx.com:443/edge/client/v1] completed GET[/services/6I3P8JXnvnEBnvK695Rifh/edge-routers] in 0.353 s
[2026-04-17T00:15:23.980Z] DEBUG ziti-sdk:bind.c:273 list_routers_cb() server[4.42](addressable-service) router.cluster.xxxx.com/tls://router.cluster.xxxx.com:443
[2026-04-17T00:15:23.980Z] DEBUG ziti-sdk:bind.c:273 list_routers_cb() server[4.42](addressable-service) router.cluster2.xxxx.com/tls://router.cluster2.xxxx.com:443
[2026-04-17T00:15:23.980Z] DEBUG ziti-sdk:bind.c:136 process_bindings() server[4.42](addressable-service) checking router[router.cluster.xxxx.com]
[2026-04-17T00:15:23.980Z] DEBUG ziti-sdk:bind.c:136 process_bindings() server[4.42](addressable-service) checking router[router.cluster2.xxxx.com]
[2026-04-17T00:15:23.980Z] DEBUG ziti-sdk:bind.c:139 process_bindings() server[4.42](addressable-service) router[router.cluster2.xxxx.com] is not connected
[2026-04-17T00:15:24.049Z] DEBUG ziti-sdk:ziti_ctrl.c:504 ctrl_body_cb() ctrl[https://controller.cluster.xxxx.com:443/edge/client/v1] completed GET[/services/6I3P8JXnvnEBnvK695Rifh/edge-routers] in 0.162 s
[2026-04-17T00:15:24.049Z] DEBUG ziti-sdk:bind.c:273 list_routers_cb() server[4.45](addressable-service) router.cluster.xxxx.com/tls://router.cluster.xxxx.com:443
[2026-04-17T00:15:24.049Z] DEBUG ziti-sdk:bind.c:273 list_routers_cb() server[4.45](addressable-service) router.cluster2.xxxx.com/tls://router.cluster2.xxxx.com:443
[2026-04-17T00:15:24.049Z] DEBUG ziti-sdk:bind.c:136 process_bindings() server[4.45](addressable-service) checking router[router.cluster.xxxx.com]
[2026-04-17T00:15:24.049Z] DEBUG ziti-sdk:bind.c:136 process_bindings() server[4.45](addressable-service) checking router[router.cluster2.xxxx.com]
[2026-04-17T00:15:24.049Z] DEBUG ziti-sdk:bind.c:139 process_bindings() server[4.45](addressable-service) router[router.cluster2.xxxx.com] is not connected
[2026-04-17T00:15:24.391Z] DEBUG ziti-sdk:channel.c:905 channel_alloc_cb() ch[3] message pool is empty. stop reading until available
[2026-04-17T00:15:24.456Z] DEBUG ziti-sdk:channel.c:905 channel_alloc_cb() ch[3] message pool is empty. stop reading until available
[2026-04-17T00:15:24.532Z] DEBUG ziti-sdk:channel.c:905 channel_alloc_cb() ch[3] message pool is empty. stop reading until available
[2026-04-17T00:15:24.593Z] DEBUG ziti-sdk:channel.c:905 channel_alloc_cb() ch[3] message pool is empty. stop reading until available
[2026-04-17T00:15:24.686Z] DEBUG ziti-sdk:channel.c:905 channel_alloc_cb() ch[3] message pool is empty. stop reading until available
[2026-04-17T00:15:24.778Z] DEBUG ziti-sdk:channel.c:905 channel_alloc_cb() ch[3] message pool is empty. stop reading until available
[2026-04-17T00:15:24.855Z] DEBUG ziti-sdk:channel.c:905 channel_alloc_cb() ch[3] message pool is empty. stop reading until available
Out of those these seem the most important:
[2026-04-17T00:15:26.756Z] DEBUG ziti-sdk:bind.c:273 list_routers_cb() server[10.14](addressable-service) router.cluster.com/tls://router.cluster.com:443
[2026-04-17T00:15:26.756Z] DEBUG ziti-sdk:bind.c:273 list_routers_cb() server[10.14](addressable-service) router2.cluster.com/tls://router2.cluster.com:443
[2026-04-17T00:15:26.756Z] DEBUG ziti-sdk:bind.c:136 process_bindings() server[10.14](addressable-service) checking router[router.cluster.com]
[2026-04-17T00:15:26.758Z] DEBUG ziti-sdk:bind.c:136 process_bindings() server[10.14](addressable-service) checking router[router2.cluster.com]
[2026-04-17T00:15:26.758Z] DEBUG ziti-sdk:bind.c:139 process_bindings() server[10.14](addressable-service) router[router2.cluster.com] is not connected
If I'm reading these correct it seems that the clustered service dials successfully, but the addressable service remains stuck in “waiting for suitable channel / no active edge routers” despite terminators being present in ZAC?
I'm not sure how that would be possible since everything else in the network is working fine.
Any thoughts and thanks again!
Hi @montwepa, is your client enrolled in both clustered and non-clustered networks at the same time? If so, do you have the same intercept defined for both networks? If you do, they're going to conflict and it will be non-deterministic which one will win. That seems like it might explain why you see calls you expect to go to one network going to the other one.
Paul
Hi @plorenz, I have identities enrolled in multiple networks. The interecept is the same since I followed the example from this post. But I experience the same behaviour even if I disable my other identities. Also the addressable terminators haven't worked for other people who aren't enrolled in our non-clustered network so I don't think that could cause it?
(By clients you mean identities in ZDEW? I'm not using the SDK or anything like that)
non-cluster intercept:
{
"_links": {
"self": {
"href": "./configs/5K9V1Hzht8JD3KAdIUgiV5"
}
},
"createdAt": "2026-03-19T09:53:07.455Z",
"id": "5K9V1Hzht8JD3KAdIUgiV5",
"tags": {},
"updatedAt": "2026-03-19T10:13:42.118Z",
"configType": {
"_links": {
"self": {
"href": "./config-types/g7cIWbcGg"
}
},
"entity": "config-types",
"id": "g7cIWbcGg",
"name": "intercept.v1"
},
"configTypeId": "g7cIWbcGg",
"data": {
"portRanges": [
{
"low": 1,
"high": 65535
}
],
"addresses": [
"*.ziti.net"
],
"dialOptions": {
"identity": "$dst_hostname"
},
"protocols": [
"tcp",
"udp"
]
},
"name": "addressable-service.intercept.v1"
}
Clustered intercept:
"name": "addressable-service.intercept.v1",
"configTypeId": "g7cIWbcGg",
"data": {
"portRanges": [
{
"low": 1,
"high": 65535
}
],
"addresses": [
"*.ziti.net"
],
"dialOptions": {
"identity": "$dst_hostname"
},
"protocols": [
"tcp",
"udp"
]
},
"tags": {}
}
Hi @plorenz, I changed the name on the addressable-service to addressable-service2 and also added "2" on all of the policies etc on my non-clustered setup and I was able to access the addressable service on my clustered setup. I can't access the non-clustered addressable-service2 anymore but seems that you were correct that they were conflicting 
would have never crossed my mind that could happen.
Also @plorenz, I’m trying to understand why this conflict seems to affect other users as well.
A colleague who is enrolled only in the clustered network experienced the same failure with addressable services, but it started working for them after I renamed the services on the non-clustered network.
Could identities, service names, or intercepts from another network (that only I’m enrolled in) influence addressable terminator resolution more globally?
In this case, they were trying to reach identities/terminators that had nothing to do with my laptop, which is why this behavior is confusing to me.
Hi @montwepa,
Sorry for the late response. The conflicts should be purely at the DNS/IP level. In other words, if you have two services with overlapping intercepts, whether they're from the same network, or two different networks, only one will work. A DNS entry or IP address can only direct to one place.
Why your colleague who was only enrolled in one network was affected by changes to the other network is very mysterious. If they really weren't in both then there's no mechanism for the one network to affect the other one.
If you're still seeing unexplained behavior, it might be helpful to post steps to recreate it, in terms of services and configs. That way we can see if there's a bug or if it's a matter of incorrect configuration.
Paul