Skip to main content

200254 - Firewall Cannot Fetch the External Dynamic List

Agent error code #200254 means the firewall has the external dynamic list, but reports that its last attempt to fetch the list failed. Until it succeeds, the firewall keeps using whatever it last fetched, so newly granted users are not admitted.

The firewall fetches the list from the Knocknoc server itself. The Knocknoc agent only asks it to.

Common causes include:

  • The firewall does not trust the certificate the Knocknoc server presents. This is the most common cause
  • The firewall cannot reach the Knocknoc server: a missing route, a security policy, or DNS on the firewall's management plane
  • The list's Source URL is not this knoc's allowlist URL, or carries an old token
  • A proxy configured on the firewall is intercepting the request

Steps to Resolve

Read the Firewall's Own Status

From the firewall CLI:

request system external-list show type ip name <list-name>

The output says whether the last fetch was valid and, on many releases, why it failed.

Trust the Server's Certificate

  1. Import the certificate authority that issued the Knocknoc server's certificate under Device > Certificate Management > Certificates
  2. Add it to a certificate profile under Device > Certificate Management > Certificate Profile
  3. Select that profile on the list under Objects > External Dynamic Lists > Certificate Profile
  4. Commit, then use Test Source URL on the list to confirm

Check the URL and Reachability

Copy the allowlist URL from the knoc's page in Knocknoc into the list's Source. Test Source URL on the list confirms the firewall can reach it.

Still Having Issues?

We can help you out, contact us at [email protected].