Skip to main content

200301 - Generate Key Credentials Refused

Agent error code #200301 means Generate key on the Integrations page reached the device and the device refused the username or password. Knocknoc does not keep either, so nothing needs cleaning up.

Common causes include:

  • The username or password was mistyped, or the password has been changed
  • The administrator account is disabled, locked out after failed attempts, or does not exist on this device
  • The account's admin role does not allow the XML API
  • The account authenticates through an external server (RADIUS, TACACS+, SAML) that rejected it or that the device could not reach

Steps to Resolve

Sign In With the Same Account

Sign in to the device's web interface with the same username and password. If that fails too, the problem is the account rather than Knocknoc.

Allow the XML API for the Account

In the firewall or Panorama UI, open Device > Admin Roles, select the role the account uses, and on the XML API tab enable the features Knocknoc needs (see the Palo Alto backend guide for the list). Commit, then try Generate key again.

Check the Target Device

An account on Panorama is not an account on its managed firewalls. Confirm the address in the integration is the device the account belongs to.