diff --git a/ansible/playbooks/roles/preflight/tasks/main.yml b/ansible/playbooks/roles/preflight/tasks/main.yml
index a1ef0f59b4..061b597d34 100644
--- a/ansible/playbooks/roles/preflight/tasks/main.yml
+++ b/ansible/playbooks/roles/preflight/tasks/main.yml
@@ -58,3 +58,8 @@
         path: /etc/systemd/system/default.target.wants/epiphany-lvm-merge.service
         state: absent
         timeout: 300
+
+- name: Validate network configuration
+  assert:
+    that: ansible_default_ipv4.address == hostvars[inventory_hostname].ansible_host
+    fail_msg: "ansible_default_ipv4.address is {{ ansible_default_ipv4.address }} but inventory uses ip: {{ hostvars[inventory_hostname].ansible_host }}. Check default routing configuration, read more in troubleshooting document"
diff --git a/docs/changelogs/CHANGELOG-1.3.md b/docs/changelogs/CHANGELOG-1.3.md
index f76c73985f..5af4656582 100644
--- a/docs/changelogs/CHANGELOG-1.3.md
+++ b/docs/changelogs/CHANGELOG-1.3.md
@@ -43,6 +43,7 @@
 - [#2737](https://github.com/epiphany-platform/epiphany/issues/2737) - Fix asserting number of postgres nodes
 - [#1175](https://github.com/epiphany-platform/epiphany/issues/1175) - Task 'Join to Kubernetes cluster' may fail when Ansible vault already exists
 - [#2420](https://github.com/epiphany-platform/epiphany/issues/2420) - Changing Grafana admin password in the apply mode
+- [#2653](https://github.com/epiphany-platform/epiphany/issues/2653) - Epicli is failing in air-gapped infra mode
 - [#2873](https://github.com/epiphany-platform/epiphany/issues/2873) - Epicli backup fails on schema validation
 
 ### Updated
diff --git a/docs/home/TROUBLESHOOTING.md b/docs/home/TROUBLESHOOTING.md
index 09736bc621..780d1f36d2 100644
--- a/docs/home/TROUBLESHOOTING.md
+++ b/docs/home/TROUBLESHOOTING.md
@@ -48,3 +48,16 @@ ERROR org.apache.kafka.common.errors.InvalidReplicationFactorException: Replicat
 This issue is saying the a replication of 1 is being attempted but there are no brokers '0'. This means that the kafka broker(s) are not running any longer. Kafka will start and attempt to establish connections etc. and if unable it will shutdown and log the message. So, when the verification script runs it will not be able to find a local broker (runs on each broker).
 
 Take a look at syslog/dmesg and run `sudo systemctl status kafka`. Most likely it is related to security (TLS/SSL) and/or network but it can also be incorrect settings in the config file `/opt/kafka/config/server.properties`. Correct and rerun the automation.
+
+## Networking
+
+Epicli uses Ansible to configure machines in cluster. Several tasks in Epiphany rely on ```ansible_default_ipv4``` variable.
+In some specific configuration (mostly on-prem), this variable might be fetched wrong. Those cases are:
+- more than one network interface per machine,
+- changes in hardware configuration (add or remove network interface / rename interface),
+- lack / wrong / multiplied default routing configuration.
+
+When ```ansible_default_ipv4``` is not equal to machine ip address used in inventory, installation fail with relevant error message.
+
+This means that machine's default routing configuration needs to be modified to use the same network interface (and ip address) used in inventory file.
+Here you can read more about [routing configuration](http://linux-ip.net/html/basic-changing.html#basic-changing-default)