Skip to main content

200201 - Neither Firewall in the HA Pair Is Active

Agent error code #200201 means both firewalls in the HA pair answered the Knocknoc agent and neither reported itself active, so there was nowhere to apply the grant.

This is the opposite situation from #200200. The checks worked. What they found is the problem: the state each firewall reported is in the message alongside the code, and it is the part worth reading.

The agent will only send a grant to a firewall reporting active, active-primary or active-secondary, or to a standalone firewall with HA switched off. A pair where both members report passive, suspended, initial or non-functional has no member enforcing policy for the agent to update.

Common causes include:

  • The pair is mid-failover. Both members pass through non-active states briefly, and a grant landing in that window fails
  • A member was suspended by an administrator, from the CLI or from Device > High Availability, and its peer never took over
  • Both members are non-functional, usually a link monitoring or path monitoring failure taking both out
  • A preemption loop, where the members hand the active role back and forth and neither settles
  • Both members report initial because they cannot see each other over the HA control link

Steps to Resolve

Read the States in the Message

The message names what each firewall reported: the one the knoc points at, and its peer. passive on both means a failover that did not complete. suspended means an administrator or a script put a member aside. non-functional points at monitoring rather than at Knocknoc.

Check the Pair on the Firewall

In the web interface, Dashboard > High Availability widget, on either member. Or from the CLI:

show high-availability state
show high-availability state-synchronization

Look at the local state, the peer state, and whether the pair agrees on which is which. Two members each believing the other is active is a split-brain and needs the HA link investigated.

Resume a Suspended Member

If a member is suspended:

request high-availability state functional

Confirm the pair settles with one active member before expecting grants to work.

Investigate Monitoring Failures

non-functional on both members is usually link or path monitoring. Under Device > High Availability > Link and Path Monitoring, check which monitored object is failing. Until it recovers, neither member will take the active role.

Expect the Occasional Failure During Failover

A grant that lands during a genuine failover fails, and the next one succeeds once a member is active. If these are isolated and correlate with failover events on the firewall, there is nothing to change on the Knocknoc side. Users can retry.

Back to top