Hi, I have a STX 3.0 bare metal duplex installation here. Followed the instructions on the web site. Only difference is I added two VLAN interfaces (one for the mgmt network, the other for the cluster-host network). Both controllers are up and running (unlocked, available, online). No alarms. I would like to login to the docker registry (registry.local) from a machine which sits on the mgmt and cluster-host network (but does not have access to the OAM network). When I run the docker login cmd like so: docker login -u admin https://registry.local:9001 I get back: Error response from daemon: Get https://registry.local:9001/v2/: Get https://192.168.30.5:9002/token/?account=admin&client_id=docker&offline_token=true&service=192.168.204.1%3A9001: dial tcp 192.168.30.5:9002: connect: network is unreachable 192.168.30.5 is the floating OAM ip address. Digging a bit deeper I found that this curl command: curl -v -s -H "Content-Type: application/json" -X POST -d '{"username": "'admin'", "password": "'PassWord123*'"}' https://registry.local:9001/v2/_catalog returns: < HTTP/1.1 401 Unauthorized < Content-Type: application/json; charset=utf-8 < Docker-Distribution-Api-Version: registry/2.0 < Www-Authenticate: Bearer realm="https://192.168.30.5:9002/token/ ",service="192.168.204.1:9001",scope="registry:catalog:*" < X-Content-Type-Options: nosniff < Date: Fri, 10 Jul 2020 17:36:33 GMT < Content-Length: 145 So the bearer realm address returned seems to point to the OAM network (to which I don't have access, hence the 'network is unreachable' error). I should also point out the the registry-token-server is configured like so: REGISTRY_TOKEN_SERVER_ADDR=192.168.204.1:9002 REGISTRY_TOKEN_SERVER_ISSUER=bird-token-server REGISTRY_TOKEN_SERVER_KS_ENDPOINT=http://192.168.204.1:5000/v3 REGISTRY_TOKEN_SERVER_TLSCERT=/etc/ssl/private/registry-cert.crt REGISTRY_TOKEN_SERVER_TLSKEY=/etc/ssl/private/registry-cert.key REGISTRY_TOKEN_SERVER_REALM=https://192.168.204.1:9002/token/ REGISTRY_TOKEN_SERVER_KEY=/etc/ssl/private/registry-cert-pkcs1.key Here, the REGISTRY_TOKEN_SERVER_REALM is correctly set to https://192.168.204.1:9002/token/. Lastly, the /etc/docker-distribution/registry/config.yml configuration file points to another realm address: auth: token: realm: "https://192.168.30.5:9002/token/" service: "192.168.204.1:9001" issuer: bird-token-server rootcertbundle: /etc/ssl/private/registry-cert.crt What am I missing here? How can I login to the registry from outside the OAM network? Regards, Marc