200154 - Tag Timeout Out of Range

Agent error code #200154 means the Palo Alto Networks firewall rejected the timeout Knocknoc set on the IP-tag mapping.

Knocknoc registers each tag with a timeout matching the remaining session length, so the firewall expires the mapping by itself if the agent is ever unable to remove it. PAN-OS accepts a timeout between 1 and 2,592,000 seconds (30 days).

Knocknoc holds the value inside that range on its own: a session longer than 30 days is registered as 30 days and extended again while the session lives. Reaching this error therefore points at a firewall that accepts a narrower range than the documented one, usually an older PAN-OS release. The agent log line records what was sent as timeoutSeconds, and the firewall's own wording as agent_error_vendor_msg.

Steps to Resolve

Read the Value That Was Rejected

Find the tag registration failed line in the agent log and note timeoutSeconds, then read agent_error_vendor_msg for the range the firewall says it accepts. To collect the log without shell access, open Agents in the admin portal, select the agent, and view its recent log.

Shorten the Session Length

1. In the Knocknoc admin portal, open the knoc and reduce its session length below the range the firewall reported
2. Ask an affected user to request access again and confirm the grant succeeds

Shorter sessions also reduce how long a mapping survives if the agent loses contact with the firewall, so this is worth doing on its own merits.

Check the PAN-OS Version

Confirm the firewall's PAN-OS version under Dashboard > General Information. Releases before 9.0 place tighter limits on the tag timeout than current ones. If the firewall cannot be upgraded, keep session lengths inside the range it reports.