Skip to main content

Kemp LoadMaster

Knocknoc integrates with the Kemp LoadMaster to dynamically control network access. Knocknoc dynamically manages the LoadMaster's global allowlist. As users authenticate and grants expire, Knocknoc adds and removes entries in the allowlist, so access is granted in seconds.

This is an active integration: Knocknoc pushes changes to the LoadMaster directly. If you would prefer a poll-based setup where a device fetches a Knocknoc-hosted feed on its own schedule, use the EDL (Passive) Knoc type instead.

Requirements

  • A LoadMaster running firmware with the RESTful API (LMOS 7.x or newer).
  • The API Interface enabled so Knocknoc can reach the LoadMaster API.
  • A LoadMaster user account (username and password) with permission to manage the global ACL.
  • Network reachability from the host running Knocknoc to the LoadMaster management address.

Step 1: Enable the API Interface

  1. In the WUI, go to Certificates & Security > Remote Access.
  2. Enable the API Interface.
  3. If you restrict management access by source address, allow the IP that Knocknoc connects from.

Kemp LoadMaster Remote Access page with the API Interface enabled

Step 2: Enable the Packet Routing Filter

The global allowlist lives under the Packet Routing Filter. Go to System Configuration > Network Setup > Packet Routing Filter and confirm it is enabled.

Kemp LoadMaster Packet Routing Filter page showing it enabled

Step 3: Create a user

  1. Go to System Configuration > System Administration > User Management.
  2. Add a new user (for example knocknoc-agent) with a strong password, and grant it All Permissions.

Kemp LoadMaster User Management page with a user that has All Permissions

Step 4: Configure the Knocknoc Backend

In the Knocknoc admin wizard, create a Knoc and choose the Application type, Active mode, Kemp LoadMaster vendor. Fill in:

Field Value
Kemp LoadMaster URL https://<loadmaster-host> (include the port if non-default)
Insecure Tick only if the LoadMaster uses a self-signed certificate
Username The LoadMaster user from Step 3.
Password That user's password.

Click Validate connection to confirm Knocknoc can reach the LoadMaster and read the allowlist, then save.

The create-knoc wizard walks through the following steps.

Configure Settings - choose the Active mode.

Create-knoc wizard Configure Settings step with Active mode selected

Configure Settings - enter the Kemp LoadMaster details. Select the Kemp LoadMaster vendor and fill in the URL, username and password. Tick Insecure only for a self-signed certificate.

Kemp LoadMaster backend fields in the Configure Settings step

Knoc Options - set the grant behaviour.

Knoc Options step of the create-knoc wizard

Agent - choose the agent that reaches the LoadMaster. Only agents that support the Kemp LoadMaster backend can be selected.

Agent step showing the Kemp-capable agent selected

Select users - grant access to users or groups.

Select users step of the create-knoc wizard

Review - run the connection check and create the Knoc. The read-only connection check confirms the LoadMaster is reachable and the allowlist is readable before you save.

Review step with the Kemp LoadMaster connection check passing

Error Codes

The Knocknoc agent reports structured error codes when Kemp LoadMaster operations fail. You can find more details on resolving these issues here.

Vendor Documentation

Back to top