Skip to main content

200107 - Address Group Not Found

Agent error code #200107 means the address group named on the knoc is not on the Palo Alto Networks firewall or in Panorama. The firewall answered the agent's read of that group with Object Not Present.

This applies to a knoc in active mode, where Knocknoc manages address objects and adds them to an address group you have already created. Knocknoc does not create the group itself. A group does nothing until a security policy references it, so creating one automatically would report a working grant while allowing no traffic.

The address object for the user is usually created before this fails, since the agent creates the object first and then reads the group. Finding a stray auto-<username>-<ip> object on the firewall after a failed grant is expected, and the next successful grant reuses it.

Common causes include:

  • The group was never created on the firewall
  • The name on the knoc does not match the group exactly. It is case-sensitive, and a trailing space counts
  • The group exists in a different vsys or device group from the one the knoc targets
  • The group was created as a dynamic address group, so it has no static member list for Knocknoc to edit
  • The group was renamed or deleted on the firewall after the knoc was set up

Steps to Resolve

Create the Address Group, or Correct the Name

  1. On a standalone firewall, open Objects > Address Groups and select the vsys the knoc targets. In Panorama, select the device group instead
  2. Confirm a group with exactly the name on the knoc exists, matching case
  3. Confirm its type is Static, not Dynamic. Knocknoc edits the static member list
  4. If it is not there, create it as a static group. It can start empty

The agent log line records the name it asked for as group, which is the quickest way to spot a mismatch against what is on the firewall.

Confirm the vsys or Device Group

A group in the wrong location reads as missing, because the agent asks for it by location as well as by name.

  1. In Knocknoc, check the vsys on the knoc's PAN-OS settings, or the device group when the knoc points at Panorama
  2. On the firewall, check Device > Virtual Systems and confirm the vsys exists and holds the group
  3. In Panorama, check Panorama > Device Groups the same way. Both names are case-sensitive

A group defined in a parent device group is visible to its children, so check where the group actually lives rather than where the rules that use it live.

Reference the Group From a Policy

Creating the group clears this error, but access still will not work until a security policy uses it. Add the group as the source address on the rule that permits the traffic the knoc is protecting, then commit.

Check the API Key Can Read Address Groups

A key without read access to address groups reports #200102 rather than this code, so this step matters only if the code changes after you have created the group. Open Device > Admin Roles, find the role on the account the API key belongs to, and confirm the REST API Objects > Address Groups permission is enabled.

Back to top