# Faulted OPC UA connection between Front-End and Tag Gateways **URL:** \ **Category:** Ignition\ **Tags:** ignition81\ **Created:** [July 26, 2024, 3:26pm UTC](https://forum.inductiveautomation.com/t/faulted-opc-ua-connection-between-front-end-and-tag-gateways/93798 "2024-07-26T15:26:01Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![jfan](https://avatars.discourse-cdn.com/v4/letter/j/e8c25b/32.png) [@jfan](https://forum.inductiveautomation.com/u/jfan)\ **Post date:** [July 26, 2024, 3:26pm UTC](https://forum.inductiveautomation.com/t/faulted-opc-ua-connection-between-front-end-and-tag-gateways/93798/1 "2024-07-26T15:26:01Z")
Hi All, I am getting this error while trying to establish an OPC connection between my front-end and tag gateways. How can I address this? status=Bad\_SecurityChecksFailed, description=An error occurred verifying security. ```python UaException: status=Bad_SecurityChecksFailed, message=status=Bad_SecurityChecksFailed, description=An error occurred verifying security. at org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientAcknowledgeHandler.onError(UascClientAcknowledgeHandler.java:258) at org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientAcknowledgeHandler.decode(UascClientAcknowledgeHandler.java:167) at io.netty.handler.codec.ByteToMessageCodec$1.decode(ByteToMessageCodec.java:42) at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:529) at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:468) at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) at io.netty.handler.codec.ByteToMessageCodec.channelRead(ByteToMessageCodec.java:103) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166) at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788) at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:724) at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:650) at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562) at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997) at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) at java.base/java.lang.Thread.run(Unknown Source) 8.1.37 (b2024013011) Azul Systems, Inc. 17.0.9 ``` ---
**Author:** ![amy.sudibyo](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/amy.sudibyo/32/38659_2.png) [@amy.sudibyo](https://forum.inductiveautomation.com/u/amy.sudibyo)\ **Post date:** [July 29, 2024, 7:27am UTC](https://forum.inductiveautomation.com/t/faulted-opc-ua-connection-between-front-end-and-tag-gateways/93798/2 "2024-07-29T07:27:41Z")
Check your gateway network connection settings - by default the connection policy is approved only. You will need to either manually approve the incoming connection or change this setting to unrestricted. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [July 29, 2024, 11:33am UTC](https://forum.inductiveautomation.com/t/faulted-opc-ua-connection-between-front-end-and-tag-gateways/93798/3 "2024-07-29T11:33:14Z")
> [@amy.sudibyo](#): > > gateway network connection settings Not applicable to an OPC UA connection. But Ignition's OPC UA server also defaults to only accepting local connections. ---
**Author:** ![jfan](https://avatars.discourse-cdn.com/v4/letter/j/e8c25b/32.png) [@jfan](https://forum.inductiveautomation.com/u/jfan)\ **Post date:** [July 29, 2024, 11:46am UTC](https://forum.inductiveautomation.com/t/faulted-opc-ua-connection-between-front-end-and-tag-gateways/93798/4 "2024-07-29T11:46:24Z")
How do I allow non-local connections? ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [July 29, 2024, 11:49am UTC](https://forum.inductiveautomation.com/t/faulted-opc-ua-connection-between-front-end-and-tag-gateways/93798/5 "2024-07-29T11:49:20Z")
> **[Ignition's OPC UA Server | Ignition User Manual](https://www.docs.inductiveautomation.com/docs/8.1/ignition-modules/opc-ua/ignitions-opc-ua-server#troubleshooting-a-faulted-connection-to-ignitions-opc-ua-server)** > > Ignition's OPC UA server, provided by the OPC UA module, allows an ignition installation to utilize Ignition's various device driver modules. In addition, with the module installed, OPC UA clients can connect to Ignition's UA server, exposing any... ---
**Author:** ![jfan](https://avatars.discourse-cdn.com/v4/letter/j/e8c25b/32.png) [@jfan](https://forum.inductiveautomation.com/u/jfan)\ **Post date:** [July 29, 2024, 12:06pm UTC](https://forum.inductiveautomation.com/t/faulted-opc-ua-connection-between-front-end-and-tag-gateways/93798/6 "2024-07-29T12:06:39Z")
Think the issue here is something else as I had already completed these steps. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [July 29, 2024, 12:12pm UTC](https://forum.inductiveautomation.com/t/faulted-opc-ua-connection-between-front-end-and-tag-gateways/93798/7 "2024-07-29T12:12:16Z")
What do you get in the log in the other server? Any message about accepting certificates? (The message implies that you haven't properly configured a username/password combination in the right user source.) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 29, 2024, 2:02pm UTC](https://forum.inductiveautomation.com/t/faulted-opc-ua-connection-between-front-end-and-tag-gateways/93798/8 "2024-07-29T14:02:24Z")
The connection between "front end" and "tag" Gateways is usually via Gateway Network and Remote Tag Providers. Are you sure setting up OPC connections is what you want? ---
**Author:** ![jfan](https://avatars.discourse-cdn.com/v4/letter/j/e8c25b/32.png) [@jfan](https://forum.inductiveautomation.com/u/jfan)\ **Post date:** [July 29, 2024, 2:15pm UTC](https://forum.inductiveautomation.com/t/faulted-opc-ua-connection-between-front-end-and-tag-gateways/93798/9 "2024-07-29T14:15:39Z")
yes, we are using the OPC UA connection for a different purpose here. The Gateway connection itself is working. ---
**Author:** ![jfan](https://avatars.discourse-cdn.com/v4/letter/j/e8c25b/32.png) [@jfan](https://forum.inductiveautomation.com/u/jfan)\ **Post date:** [July 29, 2024, 2:18pm UTC](https://forum.inductiveautomation.com/t/faulted-opc-ua-connection-between-front-end-and-tag-gateways/93798/10 "2024-07-29T14:18:35Z")
I confirm that the correct user source is being used as well as the username and password. I will take a look at the log. Thanks! ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 29, 2024, 2:24pm UTC](https://forum.inductiveautomation.com/t/faulted-opc-ua-connection-between-front-end-and-tag-gateways/93798/11 "2024-07-29T14:24:02Z")
On whichever gateway is the server side of the connection, you probably need to go into the OPC UA \> Security \> Server tab in the Gateway and mark this other client certificate as trusted. ---
**Author:** ![jfan](https://avatars.discourse-cdn.com/v4/letter/j/e8c25b/32.png) [@jfan](https://forum.inductiveautomation.com/u/jfan)\ **Post date:** [July 29, 2024, 2:37pm UTC](https://forum.inductiveautomation.com/t/faulted-opc-ua-connection-between-front-end-and-tag-gateways/93798/12 "2024-07-29T14:37:08Z")
thank you! That was the issue.