Skip to main content

200150 - Failed to Register Tag

Uploading.Agent error code #200150 occurs when the Knocknoc agent asks a Palo Alto Networks firewall to register an IP-tag mapping and the firewall rejects the request. This is the Dynamic Address Group mode of the PAN-OS integration: Knocknoc registers the user's IP against a tag, and a Dynamic Address Group on the firewall matches that tag to admit the traffic.

The code is the general one for a rejected registration. When the agent can tell why the firewall said no, it reports a more specific code instead: #200152 (busy), #200153 (target not connected), #200154 (tag timeout out of range), #200155 (unknown vsys), #200156 and #200157 (authentication and authorization). Seeing #200150 means the firewall's reply did not match any of those.

The firewall did reply, which is what separates this from a connectivity failure. A device that never answered, refused the connection, or failed TLS reports the #298001 to #298006 range instead. When a knoc targets several serial numbers and they fail for different reasons, no single code fits, so the agent reports #200150 and the per-serial log lines carry each cause.

Reading the Agent Log

The firewall's own wording is the fastest route to the cause, and it appears in the agent log rather than in the portal. Two fields carry it:

    agent_error_vendor_msg: the text PAN-OS returned, for example vsys vsys1, ip 10.1.2.3, tag knocknoc already exists, ignore. panosMessage: the same text on the PAN-OS API returned an error line, which also records the HTTP status and the request URL. This line is at DEBUG level.

    The failure line also records the entry and the target, so a burst of failures can be told apart:

    level=ERROR msg="tag registration failed" serial=019901003774 ip=10.1.2.3/32 username=jsmith
  tag=knocknoc host=https://panorama.example.com vsys=vsys1 attempt=3 timeoutSeconds=3600
  error.agent_error_code=200150 error.agent_error_vendor_msg="..."

    To collect this without shell access to the agent host, open Agents in the admin portal, select the agent, and view its recent log. Raising the agent's LogLevel to debug adds the per-request line above; trace adds the full request and response bodies.

    Common causes include:

      A commit or push was running on the firewall when the request arrived, so PAN-OS turned it away. The agent retries these, and reports #200152 when it can recognize them. The API key lacks the User-ID Agent permission for the vsys being targeted. The target firewall is managed by Panorama and was not connected when the request was proxied to it. The Dynamic Address Group on the firewall does not match the tag name configured in Knocknoc, so registration succeeds but nothing is admitted. This shows as a working grant with no access rather than as this error.

      Steps to Resolve

      Read the Firewall's Own Message

        Raise the agent's log level to debug (or trace for full bodies) and reproduce the grant Find the tag registration failed line and read agent_error_vendor_msg Match it against the table below
        Message from PAN-OS What it means ... already exists, ignore The IP-tag pair is already registered. Knocknoc treats this as success and the grant is not affected. ... does not exist, ignore unreg Seen when removing a mapping that is already gone. Also treated as success. Commit in progress, try again later The management plane was busy. Knocknoc retries. not connected Panorama could not reach the target firewall. See #200153. Invalid credential, Invalid key The API key is wrong or expired. See #200156. not authorized, permission denied The key works but lacks the User-ID Agent permission. See #200157. timeout ... range The session length produced a tag timeout PAN-OS will not accept. See #200154.

        Check the Registered Mappings on the Firewall

        From the firewall CLI:

        show object registered-ip all

        If the IP is already listed against the tag, the registration Knocknoc attempted was a repeat. Repeats are normal: the agent re-registers on every reconcile and whenever it extends a session.

        Verify the API Key Permissions

        The API key needs the User-ID Agent permission for the vsys in the knoc. In the firewall or Panorama UI, check Device > Admin Roles for the role attached to the API user, and confirm the XML API User-ID Agent option is enabled.

        Check for a Commit in Progress

        In Panorama, open the task manager and look for a commit or push overlapping the time in the agent log. User-ID updates are rejected while one runs, and nothing is written to the firewall's own logs when that happens.

        Back to top