Warning: "Some of the connectors in the site are unable to connect to the internal address for the application"

Products

• ZTNA App Protection
• Symantec ZTNA

Issue/Introduction

Users may experience the following symptoms in the ZTNA Admin Console:

• One or more applications show a Warning (Yellow) status.
• The error message displays: "Some of the connectors in the site are unable to connect to the internal address for the application."

Environment

• ZTNA connector

Cause

This issue is typically caused by a routing conflict on the Linux server where the ZTNA connector is deployed.

By default, Docker uses the 172.17.0.0/16 subnet for its internal bridge network (docker0). If a physical or virtual network interface on the host server is also configured with an IP address in the 172.17.x.x range, it creates a routing conflict.

This prevents the connector from correctly performing its internal health checks to the application's internal address, even if separate user traffic paths remain functional.

Resolution

 

1. Identify the Conflict:
   Log in to the connector host server and check the network interface configuration:
   Review this command before running it(command may be different depending on Linux distribution)

   ip addr show
   

   Look for any interface (other than docker0) that has an IP address within the 172.17.0.0/16 range.

2. Remediate the Interface by following one of the solutions most suitable for your enviroment:

   • Disable the conflicting network interface if it is not required.
   • Reconfigure the interface to use a different, non-conflicting subnet.
   • Reconfigure docker network

Additional Information

• Networking overview