Prepare and troubleshoot Site connections

1. Separate user login, Site connections and API credentials

Scroll horizontally to view the full table

Expected result A Site connection does not replace user login, and an API Key is not a Site joining password.

2. Prepare addresses and network access

1. Open both Portals and record their full HTTPS root addresses, versions and Site names. A hostname must resolve from the peer server; an actual IP address can also be used.
2. Check that the peer Portal port is reachable from the server network. Browser access alone does not prove that the two servers can reach each other.
3. Use the published address and port reachable by the peer for both native and container deployments. Container-internal addresses and the peer’s 127.0.0.1 are not Site connection addresses.
4. Check time synchronization and persistent data/identity storage. Sign in to the initiating Site with Site management permission.

Expected result Sites collaborate over HTTPS without exposing PostgreSQL or Redis. Use reachable hostnames or IPs; custom DNS is unnecessary.

3. Identity handling for ordinary LAN connections

Each installation retains its Node identity. The first connection verifies and remembers the peer Node, trust root and Runtime Unit; later traffic uses mutual TLS and authorization checks. No manual certificates are needed.

1. Verify the target server address on the trusted deployment network before connecting or adding it through Discover Sites. The first connection trusts the server actually reached.
2. To inspect Devices first, expand the target or select Connect and View Devices. To establish membership, select Add Site / Join.
3. Wait for success, then choose the required sources in Local Capabilities.

Expected result Scanning discovers addresses. Device preview may establish a connection, but does not join a Site or select sources. Each installation retains its private key.

4. Verify an unfinished connection

1. If a connection times out or its result is unconfirmed, select Verify Enrollment beside the original target. The system reads that operation’s result.
2. Once continuation is available, select Continue Joining or Continue Viewing Devices. The first continues membership; the second retains the Device-preview purpose.
3. If Site Joined appeared but the list failed to refresh, close the dialog and refresh the Sites page.
4. If connection records cannot be saved or read, restore browser session storage and reload. While new connections are paused, Verify Enrollment remains available for checking existing results.

Expected result Follow the next step shown after verification. You do not need to enter or add the same address again.

5. Address changes and identity conflicts

An address locates the server; the Node identity identifies the installation. Matching display names do not establish matching identity.

1. If only the IP or hostname changed, discover and verify the new published address while preserving the original persistent identity.
2. For Identity Conflict, check whether the address reaches the wrong server or the server was reinstalled with different identity material.
3. If a reinstall genuinely changed identity, follow the deployment’s identity recovery or replacement procedure, then explicitly recreate required membership, capability selections and Device scopes.

Expected result A new address for the same identity does not become a separate Device configuration, and a changed identity does not silently inherit the old source’s authorization.

6. Select capabilities and scopes after connecting

Scroll horizontally to view the full table

7. Installations with explicit project certificates

If the deployment explicitly uses a project CA, Node certificates or project communication policy, prepare both endpoints’ certificates and connection permissions according to that plan. Ordinary LAN connections do not require these project materials.

1. Use installation records to check each Node identity, project CA, Node certificate and private-key location, validity and revocation state.
2. Verify certificate registration and the active communication policy against the project deployment plan, including direction and capability. The ordinary Site join dialog does not edit these project materials.
3. After the applicable runtime configuration has loaded, scan again. Project Identity Unverified points to project connection configuration. Automatic Site Identity Verification Incomplete points to ordinary LAN versions, connection records and services.

Expected result Add the Site after verifying its configured identity mode. Ordinary LAN needs no CA or shared key.

8. Follow the connection feedback

Scroll horizontally to view the full table

• Connect Sites and choose capabilities
• Select PLCs and read remote data