Skip to main content

200257 - Tag Already Carries Registrations

Agent error code #200257 is a warning from Validate on a knoc that has not been saved yet. The tag it names already has addresses registered on the firewall.

A tag belongs to one knoc. Knocknoc reads back what is registered on the tag and removes any address the knoc did not grant, so stale registrations do not keep admitting users after their access has ended. Saving this knoc on a tag something else uses would remove those registrations.

Common causes include:

  • Another knoc already uses this tag
  • Another product or script registers addresses on the same tag
  • Registrations left behind by an earlier setup, which is safe to have removed

Steps to Resolve

Give the Knoc a Tag of Its Own

Choose a tag no other knoc or tool uses, for example knocknoc-<knoc-name>. Add it to the match criteria of the dynamic address group the policy uses, alongside any existing tag, so both keep working during the change:

'old-tag' or 'knocknoc-vpn'

See What Is Registered Now

From the firewall CLI:

show object registered-ip tag <tag-name>

If every address listed came from an earlier Knocknoc setup that is being replaced, saving the knoc on this tag is fine. Those registrations are removed at the next resynchronisation.