diff --git a/src/backend/ci/core/common/common-api/src/main/kotlin/com/tencent/devops/common/api/auth/Header.kt b/src/backend/ci/core/common/common-api/src/main/kotlin/com/tencent/devops/common/api/auth/Header.kt
index b6cc5b371f3..a5a8d8df291 100644
--- a/src/backend/ci/core/common/common-api/src/main/kotlin/com/tencent/devops/common/api/auth/Header.kt
+++ b/src/backend/ci/core/common/common-api/src/main/kotlin/com/tencent/devops/common/api/auth/Header.kt
@@ -87,3 +87,5 @@ const val AUTH_HEADER_DEVOPS_SIGN_INFO = "X-DEVOPS-SIGN-INFO"
 
 const val AUTH_HEADER_PLATFORM = "X-DEVOPS-PLATFORM"
 const val AUTH_HEADER_APP_VERSION = "X-DEVOPS-APP-VERSION"
+
+const val AUTH_HEADER_GATEWAY_TAG = "X-GATEWAY-TAG"
diff --git a/src/backend/ci/core/common/common-client/src/main/kotlin/com/tencent/devops/common/client/Client.kt b/src/backend/ci/core/common/common-client/src/main/kotlin/com/tencent/devops/common/client/Client.kt
index 1c2dcf82011..26a8d997605 100644
--- a/src/backend/ci/core/common/common-client/src/main/kotlin/com/tencent/devops/common/client/Client.kt
+++ b/src/backend/ci/core/common/common-client/src/main/kotlin/com/tencent/devops/common/client/Client.kt
@@ -224,7 +224,18 @@ class Client @Autowired constructor(
 
     // devnet区域的，只能直接通过ip访问
     fun <T : Any> getScm(clz: KClass<T>): T {
-        return getGateway(clz, GatewayType.IDC_PROXY)
+        // 从网关访问去掉后缀，否则会变成 /process-devops/api/service/piplines 导致访问失败
+        val serviceName = findServiceName(clz).removeSuffix(serviceSuffix ?: "")
+        // 获取为feign定义的拦截器
+        val requestInterceptor = SpringContextUtil.getBeansWithClass(RequestInterceptor::class.java)
+        return Feign.builder()
+            .client(feignClient)
+            .errorDecoder(clientErrorDecoder)
+            .encoder(jacksonEncoder)
+            .decoder(jacksonDecoder)
+            .contract(jaxRsContract)
+            .requestInterceptors(requestInterceptor)
+            .target(clz.java, buildGatewayUrl(path = "/$serviceName/api", gatewayType = GatewayType.IDC_PROXY))
     }
 
     fun <T : Any> getImpl(clz: KClass<T>): T {
diff --git a/src/backend/ci/core/common/common-web/src/main/kotlin/com/tencent/devops/common/web/FeignConfiguration.kt b/src/backend/ci/core/common/common-web/src/main/kotlin/com/tencent/devops/common/web/FeignConfiguration.kt
index 3db833b11ed..bc09377061c 100644
--- a/src/backend/ci/core/common/common-web/src/main/kotlin/com/tencent/devops/common/web/FeignConfiguration.kt
+++ b/src/backend/ci/core/common/common-web/src/main/kotlin/com/tencent/devops/common/web/FeignConfiguration.kt
@@ -28,25 +28,35 @@
 package com.tencent.devops.common.web
 
 import com.tencent.devops.common.api.auth.AUTH_HEADER_DEVOPS_JWT_TOKEN
+import com.tencent.devops.common.api.auth.AUTH_HEADER_GATEWAY_TAG
 import com.tencent.devops.common.client.consul.ConsulConstants
 import com.tencent.devops.common.client.consul.ConsulContent
 import com.tencent.devops.common.security.jwt.JwtManager
 import com.tencent.devops.common.service.trace.TraceTag
 import feign.RequestInterceptor
+import org.slf4j.LoggerFactory
 import org.slf4j.MDC
 import org.springframework.beans.factory.annotation.Autowired
+import org.springframework.beans.factory.annotation.Value
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
+import org.springframework.context.annotation.Primary
 import org.springframework.web.context.request.RequestContextHolder
 import org.springframework.web.context.request.ServletRequestAttributes
 
 @Configuration
 class FeignConfiguration {
 
+    @Value("\${spring.cloud.consul.discovery.tags:#{null}}")
+    private val tag: String? = null
+
+    private val logger = LoggerFactory.getLogger(FeignConfiguration::class.java)
+
     /**
      * feign调用拦截器
      */
     @Bean
+    @Primary
     fun requestInterceptor(@Autowired jwtManager: JwtManager): RequestInterceptor {
         return RequestInterceptor { requestTemplate ->
             val attributes =
@@ -87,4 +97,14 @@ class FeignConfiguration {
             }
         }
     }
+
+    @Bean
+    fun gatewayTagRequestInterceptor(): RequestInterceptor {
+        return RequestInterceptor { requestTemplate ->
+            logger.info("add X-HEAD-CONSUL-TAG $tag")
+            if (!requestTemplate.headers().containsKey(AUTH_HEADER_GATEWAY_TAG)) {
+                requestTemplate.header(AUTH_HEADER_GATEWAY_TAG, tag)
+            }
+        }
+    }
 }
diff --git a/src/gateway/core/lua/util/tag_util.lua b/src/gateway/core/lua/util/tag_util.lua
index d26de520b0c..8983382ac69 100644
--- a/src/gateway/core/lua/util/tag_util.lua
+++ b/src/gateway/core/lua/util/tag_util.lua
@@ -25,7 +25,7 @@ function _M:get_tag(ns_config)
     local devops_project = ngx.var.project_id
     local default_tag = ns_config.tag
     local tag = default_tag
-    local header_tag = ngx.var.http_x_devops_tag
+    local header_tag = ngx.var.http_x_gateway_tag
 
     if header_tag == nil then
         if devops_project ~= nil and devops_project ~= '' then
@@ -91,7 +91,7 @@ function _M:get_tag(ns_config)
         end
 
         -- 设置tag到http请求头
-        ngx.header["X-DEVOPS-TAG"] = tag
+        ngx.header["X-GATEWAY-TAG"] = tag
     else
         tag = header_tag
     end