Best practice for separating ZAC and management API while keeping edge clients online

Ziti Administration Console
1

Hi all, quick question about Ziti architecture :waving_hand:

I'm trying to move ZAC and the management API to internal-only access (private network / via Ziti), but keep edge clients and routers working normally.

Is it supported to:

  • keep client/edge API public

  • but move management + ZAC internal only?

Also, which endpoints MUST stay public so existing clients don’t disconnect?

Thanks!

2

Hi @larry1788, welcome to the community and to OpenZiti!

The only apis that MUST remain public are edge-oidc and edge-client.

There are many discourse posts and a fair number of videos on YouTube that discuss this if you're interested but that's the short of it - JUST those two.