200155 - Virtual System Not Found (User-ID)

Uploading...Agent error code #200155 means the Palo Alto Networks firewall does not have the virtual system that the knoc names, so it rejected the IP-tag registration.

A firewall in single-vsys mode has one virtual system called vsys1. A firewall in multi-vsys mode has several, named by the administrator who created them. The name is case sensitive and is the internal name, not the display label.

Common causes include:

The knoc names vsys1 on a multi-vsys firewall where the relevant virtual system has a different name The knoc names a vsys that exists on some of the firewalls it targets but not all of them The vsys was renamed or removed on the firewall after the knoc was configured A typo, or a display label used in place of the internal name

Steps to Resolve

List the Virtual Systems on the Firewall

From the firewall CLI:

show system setting target-vsys

Or in the UI, open Device > Virtual Systems. The Name column holds the internal name, which is what the knoc needs. Where a Display Name is also set, it is a label and will not work here.

Correct the vsys on the Knoc

In the Knocknoc admin portal, open the knoc and edit its PAN-OS settings Set the virtual system to the internal name from the firewall Save the knoc, then have a user request access again and confirm the grant succeeds

Check Every Targeted Firewall

A knoc that lists several serial numbers sends the same vsys name to all of them. If the failure is limited to some serials, the vsys is missing on those specific devices. Either align the vsys naming across the firewalls, or split the knoc so each group of firewalls gets the name it has.