# Error in ziti-edge-tunnel

**URL:** <https://openziti.discourse.group/t/error-in-ziti-edge-tunnel/724>\
**Category:** Ziti Edge Tunnel\
**Created:** [August 31, 2022, 11:41pm UTC](https://openziti.discourse.group/t/error-in-ziti-edge-tunnel/724 "2022-08-31T23:41:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![av-dev](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@av-dev](https://openziti.discourse.group/u/av-dev)\
**Post date:** [August 31, 2022, 11:41pm UTC](https://openziti.discourse.group/t/error-in-ziti-edge-tunnel/724/1 "2022-08-31T23:41:28Z")

</div>

I am trying to get an endpoint enrolled on my ziti network. Here are the steps taken -

1.Installed ziti-edge-tunnel from OpenZiti’s RPM repo  
2. Confirmed that systemd-resolved is working  
3. Enrolled the endpoint ( got success )  
4. Started ziti-edge-tunnel service

```auto
Aug 31 23:24:53 ip-10-10-10-10.us-west-2.compute.internal ziti-edge-tunnel[3447]: [627.424] ERROR ziti-sdk:channel.c:875 on_channel_connect_internal() ch[0] failed to connect [-3008/unknown node or service]

```

Also see following error -

```auto
Aug 31 23:34:53 ip-10-10-10-10.us-west-2.compute.internal ziti-edge-tunnel[3447]: [732.424] WARN ziti-sdk:connect.c:344 connect_timeout() conn[0.0/Connecting] connect timeout: no suitable edge router

```

Identities

```auto
~ > ziti edge list identities                                                                                                                                          
╭───────────┬──────────────────────────────────┬────────┬────────────╮
│ ID │ NAME │ TYPE │ ATTRIBUTES │
├───────────┼──────────────────────────────────┼────────┼────────────┤
│ AAAAAAAA │ er1 │ Router │ all-routers│
│ BBBBBBBB │ ep1 │ Device │ all-eps │
│ CCCCCCCC │ ep2 │ Device │ all-eps │
╰───────────┴──────────────────────────────────┴────────┴────────────╯

```

Routers

```auto
~ > ziti edge list edge-routers                                                                                                                                        
╭───────────┬──────┬────────┬───────────────┬──────┬────────────╮
│ ID │ NAME │ ONLINE │ ALLOW TRANSIT │ COST │ ATTRIBUTES │
├───────────┼──────┼────────┼───────────────┼──────┼────────────┤
│ AAAAAAAA │ er1 │ true │ true │ 0 │ all-routers│
╰───────────┴──────┴────────┴───────────────┴──────┴────────────╯

```

edge-router-policies

```auto
~ > ziti edge list edge-router-policies                                                                                                                                
╭────────────────────────┬──────────────────────────────┬───────────────────┬────────────────╮
│ ID │ NAME │ EDGE ROUTER ROLES │ IDENTITY ROLES │
├────────────────────────┼──────────────────────────────┼───────────────────┼────────────────┤
│ xxxxxxxxxxxxxxxxxxxxxx │ erp-default-allow │ #all-routers │ #all-eps │
│ AAAAAAAAA │ edge-router-AAAAAAAA-system │ @er1 │ @er1 │
╰────────────────────────┴──────────────────────────────┴───────────────────┴────────────────╯

```

Went through troubleshooting steps and made sure there is no PKI setup issue. ( er.cert is the edge-router identity cert and identity.ca obtained from tunneler host enrollment )

```auto
 > verifyCertAgainstPool ./er.cert ./identity.ca                                                                                                
    Verifying that this certificate:
        - ./er.cert
    is valid for this ca pool:
        - ./identity.ca

./er.cert: OK

============ SUCCESS! ============

```

What am I missing? 🙂

TIA.

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [September 1, 2022, 10:23am UTC](https://openziti.discourse.group/t/error-in-ziti-edge-tunnel/724/3 "2022-09-01T10:23:40Z")

</div>

This seems to me that the endpoint is allowed to connect to an edge router (via policies, the endpoint is allowed to connect to a given router) but the edge router has an advertised address configured that isn’t resolvable/addressable by the endpoint.

I am pretty sure that’s the issue. So verify the address advertised in listeners.options for the edge router

```auto
listeners:
# bindings of edge and tunnel requires an "edge" section below
  - binding: edge
    address: tls:0.0.0.0:8442
    options:
      advertise: ext_router_fqdn:8442 <-- is this address reachable by the endpoint?

```

---

<div class="post-metadata">

**Author:** ![av-dev](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@av-dev](https://openziti.discourse.group/u/av-dev)\
**Post date:** [September 1, 2022, 1:54pm UTC](https://openziti.discourse.group/t/error-in-ziti-edge-tunnel/724/4 "2022-09-01T13:54:36Z")

</div>

Take a bow @TheLumberjack 🙂

Everything else checked out NACL, SG, R53 record except there was a typo in the advertised url ( . instead of - )  
I see both endpoints are online now.

Thank you! 🙂

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [September 1, 2022, 1:56pm UTC](https://openziti.discourse.group/t/error-in-ziti-edge-tunnel/724/5 "2022-09-01T13:56:20Z")

</div>

![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/1X/e5e06294713a92c7a2d37e991a789daa042cb5e0.png)

Nice!

---

<div class="post-metadata">

**Author:** ![av-dev](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@av-dev](https://openziti.discourse.group/u/av-dev)\
**Post date:** [September 1, 2022, 1:59pm UTC](https://openziti.discourse.group/t/error-in-ziti-edge-tunnel/724/6 "2022-09-01T13:59:24Z")

</div>

Now on to the final frontier of service policies! 🙂