Skip to main content

200256 - No Dynamic Address Group Matches the Tag

Agent error code #200256 is a warning from Validate. The agent looked for a dynamic address group whose match criteria name the knoc's tag, and found none where it looked. A registration on a tag no group matches is accepted by the firewall but admits nobody.

The check looks in the knoc's own location (its virtual system, or its device group in Panorama), in shared, and on a firewall, in the configuration pushed from Panorama. A group somewhere else is not seen, so the warning can be ignored when the group is known to exist.

When a group it did find matches on a tag that differs from the knoc's only in case or by a few characters, the warning names that tag and the group, and offers it as the value for the knoc's tag. Usually one of the two is misspelt.

Steps to Resolve

Find or Create the Group

  1. Under Objects > Address Groups, find the dynamic group used by the security policy that grants access
  2. Open its Match criteria and confirm the tag is named exactly as on the knoc, for example 'knocknoc-vpn'. Tag names are case sensitive
  3. If no group exists, create one with Type set to Dynamic and the tag as its match criteria, then reference it in the policy and commit