200159 - User-ID Cannot Carry a Network Source

Agent error code #200159 occurs when a knoc's predefined source is a network, such as 192.168.100.48/29, and the knoc grants access by registering an IP against a dynamic address group tag.

A registered IP is a single address, with no field for a netmask, and the tag registration is the only thing the knoc applies in this mode. The agent refuses the grant rather than registering the network's first address and reporting the whole range as granted, which would leave most of the range with no access while the portal showed it open.

An active or passive+ knoc behaves differently. There the address group or the external dynamic list already grants the whole network, so the agent applies it and skips only the optional username mapping, which reaches the agent log rather than this error.

Steps to Resolve

Use an Address Group Knoc for a Network Source

A PAN-OS address object holds a network, so a knoc that manages an address group can grant the whole range. Point the knoc at an address group rather than a dynamic address group tag, and the network source works as configured.

Or Name Single Addresses Instead

If the knoc has to stay on the tag registration path, change its predefined sources to single addresses. A knoc accepts up to five, so a small set of hosts can be listed individually.

Which sources a knoc grants is set under Grant access to on the knoc, where each entry is an IP address or a network in CIDR form.

Still Having Issues?

We can help you out, contact us at [email protected].