Use this guide when the gateway looks unhealthy, disappears from heartbeat views, or keeps failing after restart.
Check enrollment scope and shared secret consistency
Confirm that:
- the gateway enrollment scope is still valid,
- the shared enrollment secret is the same across the gateway services that need it,
- the gateway was not re-provisioned with a stale or mismatched secret.
Check heartbeat freshness
Review the gateway page and confirm:
- heartbeat timestamps are still moving,
- the gateway does not bounce between healthy and unknown,
- the last error points to runtime prerequisites instead of policy state.
Check host runtime prerequisites
On the gateway host, confirm:
- host networking capabilities required for the supported runtime are available,
- the service can bind the expected ports,
- the host can still reach the management path it depends on.
Decide the next move
- If secrets or enrollment scope are wrong, repair them before deeper runtime investigation.
- If the gateway is healthy but traffic still does not move, continue with Troubleshooting policy and routing.
- If the host posture is degraded, fix the host first instead of changing product policy.