Skip to main content
Star us on GitHub Star

1.0 Configure the controller

1.1 Create a VM to be used as the Controller

  • It is easier to use resource group to organize and manage all your resources for this demo.
  • Create a resource group and change into that resource group.
  • Use + Create button to create a resource.
  • Azure will take you to the Marketplace screen. In the search bar, type in Ubuntu Server.
  • Choose "Ubuntu Server 22.04 LTS".


On the Create a virtual machine screen.

  • The Subscription and Resource group should already be filled.
  • In the Instance details section, enter the VM name.
  • Select the Region to host your VM.
  • Leave default Availability options and Security type(Standard).
  • Leave the selected image Ubuntu Server 22.04 LTS x64 Gen2.
  • For the Size, choose the appropriate size for your application. For this demo, Standard_B2s(2CPU,4 GB) size was used.


  • Next, choose Authentication type to login to the VM. (We highly discourage login to the VM using Password).

  • Enter an username (remember the username, you will need it to login to the VM), or leave the default user azureuser

  • Choose your ssh key

  • For inbound ports, select the ssh. You can add extra port based on your OpenZiti setup.

  • You can leave everything default. Press Review + create Diagram

  • After the Validation passed. Press Create to create VM. Diagram

  • Important: If you are creating the network controller, you need to associate an DNS name to the public IP of your VM.

  • You can do this from "Virtual machine" page. Diagram

1.2 Firewall

  • Azure's firewall is blocking all incoming access to the VM. You will need to open ports you specified for controller and ZAC (if you plan to use ZAC). Here is a example of the firewall ports if you used the default ports (TCP 8440-8443). Diagram

1.3 Login and Setup Controller

  • Once the VM is created, we can get the IP address (and the DNS name) of the VM from the Virtual machine screen.
  • Login to the VM by using defined user "username" (default username is azureuser) and the private sshkey:
ssh -i <private_key> <username>@<ip>
ssh -i <private_key> <username>@<dns-name>

Use the DNS name to setup the controller with Host OpenZiti Anywhere.

1.4 Setup Ziti Administration Console (ZAC)


ZAC provides GUI for managing the OpenZiti network. If you prefer UI over CLI to manage network, please following the ZAC Setup Guide to setup ZAC before going to the next section.


To setup npm executables, you can follow install Node.js guide.

For example, this is how to install the version of node needed for ZAC.

Setup the repo:

cd ~
curl -sL -o
sudo bash

Install nodejs:

sudo apt install nodejs

After the nodejs is installed, following the rest of ZAC Setup Guide to setup ZAC.

1.5 Helpers

Following helpers are needed to complete the guides for router and services.

1.5.1 Add Environment Variables Back to the Shell

Source the environment variables when you log back in the shell

source ~/.ziti/quickstart/$(hostname -s)/$(hostname -s).env

If the environment variables are sourced correctly, you can do the following to check:




1.5.2 Change Ziti edge admin password

Find the Current admin edge login password of controller (if you forget the password):

grep "export ZITI_PWD" ~/.ziti/quickstart/$(hostname -s)/$(hostname -s).env

Or if you have environment variable setup correctly:

echo $ZITI_PWD

To update the passwd

ziti edge update authenticator updb -s

Important: if you change the password, you must update the passwd (ZITI_PWD) in the "~/.ziti/quickstart/$(hostname -s)/$(hostname -s).env" file.

1.5.3 Some useful command for the Router

login the CLI


Verify ER status

ziti edge list edge-routers

Delete the ER

ziti edge delete edge-routers $ROUTER_NAME
ziti edge delete edge-routers $ROUTER_ID

Update the ER

ziti edge update edge-router $ROUTER_NAME [flags]
ziti edge update edge-router $ROUTER_ID [flags]

example to update attributes:

ziti edge update edge-router $ROUTER_NAME -a private