# ZAC ports confusion

**URL:** <https://openziti.discourse.group/t/zac-ports-confusion/3960>\
**Category:** Ziti Administration Console\
**Created:** [February 13, 2025, 8:05pm UTC](https://openziti.discourse.group/t/zac-ports-confusion/3960 "2025-02-13T20:05:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![SpicyTann](https://avatars.discourse-cdn.com/v4/letter/s/3d9bf3/32.png) [@SpicyTann](https://openziti.discourse.group/u/SpicyTann)\
**Post date:** [February 13, 2025, 8:05pm UTC](https://openziti.discourse.group/t/zac-ports-confusion/3960/1 "2025-02-13T20:05:48Z")

</div>

Hello !

I'm very new to OpenZiti, I did the Host OpenZiti Anywhere installation and everything worked, except the port of ZAC.

There is a point that mentions that ZAC will be accessible with the port 8443 :  
`8443/tcp`: Ziti Admin Console (ZAC) [optional]

But mine is only accessible this way --\> [www.my.exemple.com:8441/zac/](http://www.my.exemple.com:8441/zac/)

Is there a reason why ZAC has the same port as the edge controller providing client sessions ?  
Or is it a confusion of mine ? The port 8443 doesn't seem to be use in my case, is it normal ?

Also is there a environment variable for the port that is missing in the documentation of Host Anywhere ?

Thanks in advance !

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [February 13, 2025, 8:11pm UTC](https://openziti.discourse.group/t/zac-ports-confusion/3960/2 "2025-02-13T20:11:11Z")

</div>

Hi @SpicyTann, welcome to the community and to OpenZiti!

> [@SpicyTann](#):
>
> Is there a reason why ZAC has the same port as the edge controller providing client sessions ?

Yes. Recently, the ZAC was converted from explicitly a node-based app to a SPA. This allowed us to support hosting the ZAC on the same port as the management API. If you update the controller's config file and provide the `binding: zac` stanzas, your controller will provide the ZAC.

> [@SpicyTann](#):
>
> The port 8443 doesn't seem to be use in my case, is it normal ?

That's just a doc artifact/issue. It needs a bit of changes. You can use the port you used for the controller's api.

> [@SpicyTann](#):
>
> Also is there a environment variable for the port that is missing in the documentation of Host Anywhere ?

From the current "host it anywhere" quickstart. That is documented just before "Run `expressInstall`":

```auto
export ZITI_CTRL_EDGE_ADVERTISED_PORT=8441

```

If you use that port, your ZAC will be at `https://${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS}:${ZITI_CTRL_EDGE_ADVERTISED_PORT}/zac`

Hope that helps

---

<div class="post-metadata">

**Author:** ![SpicyTann](https://avatars.discourse-cdn.com/v4/letter/s/3d9bf3/32.png) [@SpicyTann](https://openziti.discourse.group/u/SpicyTann)\
**Post date:** [February 13, 2025, 8:15pm UTC](https://openziti.discourse.group/t/zac-ports-confusion/3960/3 "2025-02-13T20:15:30Z")

</div>

Thank you very much for the information!

I was also wondering doesn't it cause some security problems as if someone type the `https://${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS}:${ZITI_CTRL_EDGE_ADVERTISED_PORT}` without the /zac/ the api page comes up ?

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [February 13, 2025, 8:18pm UTC](https://openziti.discourse.group/t/zac-ports-confusion/3960/4 "2025-02-13T20:18:15Z")

</div>

It's no security issue, no. There are two main APIs the controller supports. One is the "client" API and it provides an unauthenticated endpoint that provides "versions" (like you saw).

There is also the 'management' API which is what modifies the controller and always requires authentication. You can optionally decide to host the zac and management API on different ports if you wish, or as one recent discourse post shows, you can use OpenZiti to control access to the zac and the management API for a strong security posture

Have a look at [Making ZAC and management API accessible only through service](https://openziti.discourse.group/t/making-zac-and-management-api-accessible-only-through-service/3944) when you're ready to try that 🙂

---

<div class="post-metadata">

**Author:** ![SpicyTann](https://avatars.discourse-cdn.com/v4/letter/s/3d9bf3/32.png) [@SpicyTann](https://openziti.discourse.group/u/SpicyTann)\
**Post date:** [February 13, 2025, 8:23pm UTC](https://openziti.discourse.group/t/zac-ports-confusion/3960/5 "2025-02-13T20:23:15Z")

</div>

That is very interesting I'll take a look a it, thank you very much for the fast support !