200158 - Registered IP Limit Reached

Uploading...Agent error code #200158 means the Palo Alto Networks firewall refused a User-ID registration because it is already holding as many registered IP addresses as its model allows.

This is a capacity limit, not a busy device. Knocknoc does not retry it, because the answer will be the same until something is removed. The limit is per firewall and varies by model, from a few thousand entries on the smaller PA-400 series to hundreds of thousands on the larger platforms. Panorama counts against the limit of each firewall it pushes to, not its own.

The registrations Knocknoc creates carry a timeout, so its own entries expire on their own. Entries left behind by other tooling, or by an earlier configuration that registered without a timeout, stay until something removes them, and those are usually what fills the table.

Common causes include:

Registrations from before Knocknoc managed this tag, made without a timeout, still held by the firewall Another User-ID source (a User-ID agent, a third-party integration, a script) sharing the same firewall A firewall model whose limit is lower than the number of concurrent users the deployment has grown to A tag timeout long enough that entries accumulate faster than they expire, which happens with very long session lengths

Steps to Resolve

See What the Firewall Is Holding

On the firewall CLI:

show object registered-ip all
show object registered-ip tag <tag-name>

The first command's summary line reports the total. Compare it against your model's documented maximum. The second narrows it to the tag this knoc uses, which tells you whether Knocknoc's own entries are the bulk of it or a small part.

Clear Stale Registrations

Entries with no timeout never expire. Once you have confirmed which they are:

debug object registered-ip clear tag <tag-name>

Clearing a tag Knocknoc manages revokes access for anyone currently granted through it. They regain it on their next grant, so do this at a quiet time. Knocknoc re-applies its live grants on the agent's next reconcile.

Check for Other User-ID Sources

In Device > User Identification > User Mapping, look at what else is registering addresses on this firewall. A User-ID agent or an integration registering per-session without timeouts fills the table far faster than Knocknoc does.

Shorten the Session Length

A shorter session length on the knoc means a shorter tag timeout, so entries clear sooner and fewer are held at once. This helps where the deployment has simply grown past what the model can hold.

Consider the Model Limit

If the firewall's limit is genuinely below the number of concurrent users, no amount of tidying will hold. Either move the knoc to a larger platform or split users across firewalls.