# Is the Edge Router Identity mandatory?

**URL:** <https://openziti.discourse.group/t/is-the-edge-router-identity-mandatory/4055>\
**Category:** General Questions\
**Created:** [March 4, 2025, 8:10pm UTC](https://openziti.discourse.group/t/is-the-edge-router-identity-mandatory/4055 "2025-03-04T20:10:35Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![brandi](https://avatars.discourse-cdn.com/v4/letter/b/45deac/32.png) [@brandi](https://openziti.discourse.group/u/brandi)\
**Post date:** [March 4, 2025, 8:10pm UTC](https://openziti.discourse.group/t/is-the-edge-router-identity-mandatory/4055/1 "2025-03-04T20:10:35Z")

</div>

Hi,

I'm enrolling a new edge router on my Ziti network :

```auto
[ziggy@8d4d956193f2 ~]$ ziti edge list edge-routers
╭────────────┬──────────────────────┬────────┬───────────────┬──────┬────────────╮
│ ID │ NAME │ ONLINE │ ALLOW TRANSIT │ COST │ ATTRIBUTES │
├────────────┼──────────────────────┼────────┼───────────────┼──────┼────────────┤
│ iDjQK5tHCS │ openziti_edge_router │ true │ true │ 0 │ │
╰────────────┴──────────────────────┴────────┴───────────────┴──────┴────────────╯

```

But for some reason I can't find the identity for the enrolled router:

```auto
[ziggy@8d4d956193f2 ~]$ ziti edge list identities
╭───────────┬───────────────┬─────────┬────────────┬─────────────╮
│ ID │ NAME │ TYPE │ ATTRIBUTES │ AUTH-POLICY │
├───────────┼───────────────┼─────────┼────────────┼─────────────┤
│ qzOGOnrNU │ Default Admin │ Default │ │ Default │
╰───────────┴───────────────┴─────────┴────────────┴─────────────╯

```

I'm using terraform to deploy the controller/edge router on a docker server using [this doc](https://openziti.io/docs/guides/deployments/docker/router).

Is the edge router identity mandatory ?

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [March 4, 2025, 8:14pm UTC](https://openziti.discourse.group/t/is-the-edge-router-identity-mandatory/4055/2 "2025-03-04T20:14:02Z")

</div>

Define "mandatory"? 🙂 If you want the router to act as a tunneler, and you enable tunneler mode on the router, then yes the identity will be created. If the router is not acting as a tunneler and is not with tunneler mode enabled, then no it's not mandatory.

It'll also be of type "Router" when you have one:

```auto
ziti edge list identities 'name contains "router"'
╭────────────┬──────────────────────────────┬────────┬────────────────────────────────┬─────────────╮
│ ID │ NAME │ TYPE │ ATTRIBUTES │ AUTH-POLICY │
├────────────┼──────────────────────────────┼────────┼────────────────────────────────┼─────────────┤
│ eM0NBWcsdI │ ip-172-31-47-200-edge-router │ Router │ acme.challenge.service.dialers │ Default │
╰────────────┴──────────────────────────────┴────────┴────────────────────────────────┴─────────────╯
results: 1-1 of 1

```

---

<div class="post-metadata">

**Author:** ![brandi](https://avatars.discourse-cdn.com/v4/letter/b/45deac/32.png) [@brandi](https://openziti.discourse.group/u/brandi)\
**Post date:** [March 4, 2025, 8:19pm UTC](https://openziti.discourse.group/t/is-the-edge-router-identity-mandatory/4055/3 "2025-03-04T20:19:10Z")

</div>

So If I want my edge router to intercept traffic, I need to enable tunneler mode, right ?

I believe the tunneler mode is set on my router, and It still doesn't create the identity for me :

````auto
v: 3

identity:
  cert: "router.cert"
  server_cert: "/ziti-router/router.server.chain.cert"
  key: "/ziti-router/router.key"
  ca: "/ziti-router/router.cas"
  #alt_server_certs:
  # - server_cert: ""
  # server_key: ""

ha:
  enabled: false

ctrl:
  endpoint: tls:vps-202d9b35.vps.ovh.net:1280

link:
  dialers:
    - binding: transport
  listeners:
    - binding: transport
      bind: tls:0.0.0.0:1281
      advertise: tls:vps-202d9b35.vps.ovh.net:1281
      options:
        outQueueSize: 4

listeners:
# bindings of edge and tunnel requires an "edge" section below
  - binding: edge
    address: tls:0.0.0.0:1281
    options:
      advertise: vps-202d9b35.vps.ovh.net:1281
      connectTimeoutMs: 5000
      getSessionTimeout: 60
  - binding: tunnel
    options:
      mode: host #tproxy|host

edge:
  csr:
    country: US
    province: NC
    locality: Charlotte
    organization: NetFoundry
    organizationalUnit: Ziti
    sans:
      dns:
        - localhost
        - vps-202d9b35.vps.ovh.net
        - 8d4d956193f2
      ip:
        - "127.0.0.1"
        - "::1"

#transport:
# ws:
# writeTimeout: 10
# readTimeout: 5
# idleTimeout: 120
# pongTimeout: 60
# pingInterval: 54
# handshakeTimeout: 10
# readBufferSize: 4096
# writeBufferSize: 4096
# enableCompression: true

forwarder:
  latencyProbeInterval: 0
  xgressDialQueueLength: 1000
  xgressDialWorkerCount: 128
  linkDialQueueLength: 1000
  linkDialWorkerCount: 32```
````

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [March 4, 2025, 8:30pm UTC](https://openziti.discourse.group/t/is-the-edge-router-identity-mandatory/4055/4 "2025-03-04T20:30:04Z")

</div>

Yes. That requires the router to be created as as --tunneler-enabled and then the configuration will use `tproxy` not `host`.

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [March 4, 2025, 8:30pm UTC](https://openziti.discourse.group/t/is-the-edge-router-identity-mandatory/4055/5 "2025-03-04T20:30:59Z")

</div>

The identity is created when you make (or update) the router with --tunneler-enabled.

---

<div class="post-metadata">

**Author:** ![brandi](https://avatars.discourse-cdn.com/v4/letter/b/45deac/32.png) [@brandi](https://openziti.discourse.group/u/brandi)\
**Post date:** [March 4, 2025, 8:31pm UTC](https://openziti.discourse.group/t/is-the-edge-router-identity-mandatory/4055/6 "2025-03-04T20:31:43Z")

</div>

> [@brandi](#):
>
> ```auto
> options:
> mode: host #tproxy|host
> 
> ```

So If I don't use the runneler mode, I won't be able to terminate services on my edge router ?

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [March 4, 2025, 8:33pm UTC](https://openziti.discourse.group/t/is-the-edge-router-identity-mandatory/4055/7 "2025-03-04T20:33:19Z")

</div>

tproxy implies host. Meaning, if you use `tproxy`, you can both intercept traffic and offload traffic from the router. If you don't need to intercept traffic, the router only requires "host" mode.

---

<div class="post-metadata">

**Author:** ![brandi](https://avatars.discourse-cdn.com/v4/letter/b/45deac/32.png) [@brandi](https://openziti.discourse.group/u/brandi)\
**Post date:** [March 4, 2025, 8:39pm UTC](https://openziti.discourse.group/t/is-the-edge-router-identity-mandatory/4055/8 "2025-03-04T20:39:18Z")

</div>

Alright got it !

I'm leaving it `host` for now. I've made a dummy service to intercept `zac.ziti` on my windows machine where Ziti Edge Desktop is installed.

Configured the routers policies and so on, but since there's no Router identity, how should I create my Bind Service policy ? I mean my edge router is supposed to "host stuff", but I can't bind it to any service ?

```auto
[ziggy@8d4d956193f2 ~]$ ziti edge policy-advisor services --quiet "zac"
OKAY : brand (1) -> zac (1) Common Routers: (1/1) Dial: Y Bind: N

```

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [March 4, 2025, 8:41pm UTC](https://openziti.discourse.group/t/is-the-edge-router-identity-mandatory/4055/9 "2025-03-04T20:41:54Z")

</div>

> [@brandi](#):
>
> but since there's no Router identity

Would you please provide the output to:

```auto
ziti edge list edge-routers -j | jq -r '.data[] | [.name, .isTunnelerEnabled] | @csv'
"ip-172-31-47-200-edge-router",true

```

I expect you do not have tunneler mode enabled.

Or just run:

```auto
ziti edge update edge-router ip-172-31-47-200-edge-router --tunneler-enabled

```

(replace your router name)

---

<div class="post-metadata">

**Author:** ![brandi](https://avatars.discourse-cdn.com/v4/letter/b/45deac/32.png) [@brandi](https://openziti.discourse.group/u/brandi)\
**Post date:** [March 4, 2025, 8:42pm UTC](https://openziti.discourse.group/t/is-the-edge-router-identity-mandatory/4055/10 "2025-03-04T20:42:41Z")

</div>

```auto
[ziggy@8d4d956193f2 ~]$ ziti edge list edge-routers -j | jq -r '.data[] | [.name, .isTunnelerEnabled] | @csv'
"openziti_edge_router",false

```

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [March 4, 2025, 8:43pm UTC](https://openziti.discourse.group/t/is-the-edge-router-identity-mandatory/4055/11 "2025-03-04T20:43:22Z")

</div>

```auto
ziti edge update edge-router openziti_edge_router --tunneler-enabled

```

run that. you didn't enable tunneling