Correlating OpenZiti Access with Load Balancer/WAF Logs

Support General Questions
1

I have an application architecture consisting of:

OpenZiti router → load balancer/WAF → web application

The load balancer, WAF, and application typically record the Ziti router’s IP address rather than the identity or original endpoint associated with the OpenZiti session.

Is there a recommended way to correlate an OpenZiti connection with the corresponding request observed by the load balancer, WAF, or application?

For example, is there a connection or session identifier that can be:

  • obtained from OpenZiti router or controller logs;
  • propagated to the upstream HTTP request, such as through a trusted header; or
  • correlated using timestamps, source ports, terminator information, or other connection metadata?

The goal is to allow security monitoring systems to determine which OpenZiti identity initiated a request that was subsequently logged by the WAF or application.

2

If you're using the ER/T for hosting, the terminator_local_addr and terminator_remote_addr fields in the circuit events will be populated.

The local address is the ip/port combination on the ER/T. The remote address will be the IP/port of the load balancer.

  {
    "namespace": "circuit",
    "event_type": "created",
    "timestamp": "2025-01-17T14:09:13.603009739-05:00",
    "circuit_id": "rqrucElFe",
    "service_id": "3pjMOKY2icS8fkQ1lfHmrP",
    "terminator_id": "7JgrjMgEAis7V5q1wjvoB4",
    "path": {
      "nodes": ["5g2QrZxFcw"],
      "ingress_id": "8dN7",
      "egress_id": "ZnXG",
      "initiator_local_addr":   "...",
      "initiator_remote_addr":  "...",
      "terminator_local_addr":  "10.0.1.7:41232",
      "terminator_remote_addr": "10.0.2.20:443"
    },
    "tags": { "clientId": "haxn9lB0uc", "hostId": "IahyE.5Scw", "serviceId": "..." }
  }

Let me know if that's helpful,
Paul

3

Thanks, this is a great start!

Given the fields available in a circuit event, how can the event be mapped back to the requester’s identity?

4

The clientId field in tags should be the identityId. As long as you're coming in on an edge enabled path (Edge SDK or edge router/tunneler), that should be populated corrected. It's not called identityid because there's also hostId which is also an identity id, just the hosting identity.

Hope that's clear :slight_smile:

5

I see that now!

Regarding hostId, is that effectively the identity of the ER/T acting as the circuit terminator?

6

Yes, it's either the ER/T identity or if an SDK is hosting, it's the SDK identity.

7

I now understand. Thanks!