Skip to main content

200152 - Firewall Busy or Rate Limited

Agent error code #200152 means the Palo Alto Networks firewall turned a User-ID update away because its management plane was occupied, not because anything about the request was wrong. A commit or push in progress is the usual reason.

Knocknoc retries these automatically, a few times, a couple of seconds apart. Reaching the user as a failed grant means every attempt was refused, so the firewall was busy for the whole window.

PAN-OS does not always record these rejections in its own logs, which is why a firewall administrator can see nothing wrong at the time of a failed grant. The message the firewall returned is in the agent log as agent_error_vendor_msg.

Common causes include:

  • A commit on the firewall, or a push from Panorama, overlapping the grant
  • A configuration lock held by another administrator
  • Many API clients sharing one API key, taking the management plane to its request limit
  • Automation committing on a schedule that happens to coincide with grant activity

Steps to Resolve

Match the Failure Against Commit Activity

  1. Note the timestamp on the tag registration failed line in the agent log
  2. In Panorama, open the task manager and list commits and pushes around that time
  3. On the firewall, check Monitor > Logs > Configuration for commits by other administrators or by automation

An overlap confirms the cause. Nothing to change on the Knocknoc side beyond expecting the occasional retry.

Reduce Commit Overlap

  • Move scheduled commits and pushes outside the hours when users request access
  • Batch configuration changes into fewer commits rather than committing after each edit
  • Where an automation tool commits per change, have it commit once at the end of a run

Give the Agent More Room to Retry

The agent's PanosWait setting controls the pause between retries, in seconds, and defaults to 2. On a firewall that commits slowly, raising it gives the retries a longer window to land:

PanosWait = 5

This delays every PAN-OS operation the agent performs while a retry is pending, since they run in sequence, so raise it in single seconds rather than to tens.

Use a Dedicated API Key

If the same API key is shared with monitoring or automation tooling, create a separate API user for Knocknoc. That way Knocknoc's requests are not queued behind another client's.

Back to top