Authorized in ZeroTier but No Address? Two Separate Settings
Approving a member and handing it an address are two settings. Read the pool, the assignment mode and the client's applied state before inventing an IP.
ZeroTier shows the member as OK, the network is joined, and there is still no address to ping. That combination feels like a bug and is usually a configuration split: approving a member is one switch, and handing it an address is another. A network can accept a device and never assign it anything, because the pool or the assignment mode was never set up.
Read both sides before changing either one. The answer is visible in two places, and only one of them is on the controller.
Authorization and assignment are different switches
Authorization answers whether this node may participate in the network. Address assignment answers what the network hands it once it participates, and that answer comes from an address pool plus an assignment mode. Neither setting implies the other. One is a permission and the other is an allocation.
A controller configuration typically carries a managed route, an address range and the mode that decides whether auto-assignment is used. Copying a network ID from another environment brings the membership and none of that configuration.
This is why a device can appear healthy in the member list while its assigned-address column stays empty. The controller has accepted it and has nothing to give. Both statements are true at the same time.
| Layer | What it decides | Where it is configured |
|---|---|---|
| Membership | Whether the node may join | Member authorization on the network |
| Pool | Which addresses exist to hand out | Network address range |
| Assignment mode | Whether they are handed out automatically | Network v4/v6 assignment settings |
Reading the member's effective state
Ask the client what it actually received rather than what the controller intended. The plain list shows status and address columns, and the JSON form shows the network configuration the client applied, including managed addresses and routes.
zerotier-cli listnetworks
zerotier-cli -j listnetworks | jq '.networks[] | {nwid, status, assignedAddresses}'Compare the two outputs for the same network ID, not for the physical adapters that appear in the operating system's own list. A row that reports OK with an empty address set confirms the assignment gap rather than a connectivity fault. Reading the wrong row is the other half of this mistake.
A status of ACCESS_DENIED points back at authorization, and that is a different repair. If the command cannot read the local authentication token at all, the problem is local permissions rather than a controller rejection, and the fix is on the machine you are sitting at.
When the client ignores what the controller sends
The client has its own settings that decide whether managed configuration is applied. A profile that disables managed addresses, managed routes or default-route handling will discard what the network sends, and the member list will still look correct from the controller's side.
Those flags affect only the local node. Changing them does not alter what other members receive, and it does not repair a pool that was never defined.
So the diagnosis has two branches: the controller owns no address to give, or the client refused the one it was given. Those lead to different repairs on different machines. The JSON output distinguishes them, because either the address is absent from the network's configuration or it is present and missing from the client's applied state.
What to fix instead of inventing an address
Typing an arbitrary static address is the tempting third option and the worst one. A random address can collide with another node, sit outside the routes the network propagates, or fall in a range that firewall rules treat differently. It also hides the missing pool from whoever looks at the network next. Fix the assignment instead, and let the controller and client agree on the result.
Ask the administrator what the network is supposed to hand out, then verify the pool covers the intended range and the assignment mode is enabled. Re-join after the change rather than expecting the client to poll its way into a new configuration immediately.
Once an address appears, test what you actually needed: a peer, a service, or a subnet behind a gateway. Reaching a LAN behind a member needs routing and forwarding beyond membership, and general internet access needs an exit node, so a working address is the beginning of that test rather than the end of it.