Skip to main content

200156 - User-ID Authentication Failed

Agent error code #200156 means the Palo Alto Networks firewall or Panorama rejected the API key Knocknoc presented when registering an IP-tag mapping. The credential was refused, so nothing about the request itself was evaluated.

This covers the User-ID path specifically. A knoc that also refreshes an External Dynamic List reports #298003 for the same problem on that path, and a knoc that uses a separate credential for username mapping can fail on one and not the other.

Common causes include:

  • The API key was regenerated on the firewall, which invalidates the old one
  • The password of the administrator the key belongs to was changed, which also invalidates the key
  • The administrator account was disabled or deleted
  • The key was copied with surrounding whitespace, or truncated
  • The knoc points at a different firewall or Panorama from the one the key was generated on

Steps to Resolve

Generate a Fresh API Key

Generate the key on the same firewall or Panorama the knoc points at, for the administrator account Knocknoc should use. A key generated on one device is not valid on another.

In the firewall or Panorama UI, open Device > Administrators, select the account, and generate an API key for it. Copy the key without leading or trailing whitespace.

Update the Credential in Knocknoc

  1. In the Knocknoc admin portal, open the knoc and edit its PAN-OS settings
  2. Paste the new API key
  3. Save the knoc, then have a user request access again and confirm the grant succeeds

If the knoc uses a separate credential for username mapping, update that one too. They are stored separately and only one may have expired.

Confirm the Administrator Account

In Device > Administrators, check the account the key belongs to still exists and is enabled. An API key generated for an account that has since been removed fails this way rather than reporting the account as missing.

Check the Target Address

An API key is valid only on the device that issued it. If the knoc points at Panorama, the key must be a Panorama key; if it points at a firewall directly, it must be that firewall's. Confirm the hostname on the knoc matches where the key came from.

Back to top