← All modules — full architecture
Meridian Logistics — OpenZiti 2.0 architecture
High-level design — click any component to drill into its low-level design
Module 04: HA edge routers & link selection · verified against OpenZiti v2.0.3
M04 · Data plane
✕ Close
Edge router
Link mesh
Server — controller (M03) · hosted app
Remote tunneler
lines:
mgmt
fabric
host
Control plane (M03)
ctrl1 · ctrl2 · ctrl3 — control channel :1280
On-prem —
North America DC
172.16.10.0/24
· VMware · NAT
M04
Azure — public edge
link listeners
M04
Remote identity
#
remote-users
all routers → all controllers
dials OUT
dials OUT
hosts
edge :3022
er-nam-01
tunneling ER · host
er-nam-02
tunneling ER · HA pair
app-nam-01
yard.meridian.internal
172.16.10.20:80 · nginx
er-pub-01
East US
er-pub-02
Central India
link mesh
:3022
remote-laptop
laptop tunneler
Tip: click a router, the link mesh, the hosted app, the remote identity, or the M03 control plane.
From the course
Enterprise Zero Trust Architecture with OpenZiti 2.0
·
cawachlabs.com
·
Guides
Meridian Logistics is a fictional company. © 2026 CawachLabs · by Girish Reddy. All rights reserved. Not affiliated with or endorsed by the OpenZiti project. Icons adapted from
Lucide
(ISC, parts MIT).
Trademarks
Microsoft, Azure and Microsoft Entra are trademarks of the Microsoft group of companies. Docker is a trademark or registered trademark of Docker, Inc. in the United States and/or other countries. Kubernetes, Helm and SPIFFE are registered trademarks of The Linux Foundation in the United States and/or other countries. OpenTofu is a registered trademark of LF Projects, LLC. Ubuntu is a registered trademark of Canonical Ltd. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries. Elasticsearch and Kibana are trademarks of Elasticsearch B.V., registered in the U.S. and in other countries. Grafana is a trademark of Raintank, Inc. dba Grafana Labs. Other names belong to their owners. CawachLabs is independent and not affiliated with or endorsed by these companies.