Skip to main content

200151 - Failed to Unregister Tag

Agent error code #200151 occurs when a Knocknoc grant ends and the agent asks a Palo Alto Networks firewall to remove the IP-tag mapping it registered, but the firewall rejects the request. The user's access stays open until the mapping is gone or the tag's own timeout expires.

A mapping that is already absent is not this error. PAN-OS reports that case as an error whose message ends in does not exist, ignore unreg, and Knocknoc treats it as a successful removal, because the mapping being gone is what the revoke was asking for.

A firewall that never answered is not this error either. Unreachable, refused and timed-out requests report the #298001 to #298006 range, which is worth knowing before reading on: nothing below applies to a device the agent could not talk to.

Every tag Knocknoc registers carries a timeout matching the session length, so a mapping the agent cannot remove still expires on the firewall by itself. That is the backstop, not the intent: until it expires the user keeps the access the revoke was meant to withdraw.

Common causes include:

  • A commit or push was running on the firewall, so PAN-OS turned the request away. The agent retries these.
  • The API key lacks the User-ID Agent permission for the vsys being targeted.
  • The target firewall was not connected to Panorama when the request was proxied to it.

Steps to Resolve

Read the Firewall's Own Message

Raise the agent's LogLevel to debug and reproduce the revoke. The tag unregistration failed line records the entry, the target firewall, and the firewall's own wording in agent_error_vendor_msg. The message table on the #200150 page covers what each one means. To collect the log without shell access, open Agents in the admin portal, select the agent, and view its recent log.

Confirm Whether the Mapping Is Still There

From the firewall CLI:

show object registered-ip all

If the IP is still registered against the tag, the removal did not take effect and the user retains access until the tag's timeout expires. To close the access immediately, remove the mapping from the firewall CLI, substituting the address and the tag name from the knoc:

debug object registered-ip clear tag <tag-name>

On Panorama, connect to the target firewall first, or run the command on the firewall itself. The tag also expires on its own at the timeout Knocknoc registered, so the access closes without intervention once that elapses.

Verify the API Key Permissions

Registration and removal need the same User-ID Agent permission, so a knoc that grants successfully and fails only on revoke is unlikely to be a permissions problem. If both directions fail, check Device > Admin Roles for the role attached to the API user and confirm the XML API User-ID Agent option is enabled for the vsys in the knoc.

Back to top