Skip to main content

298001 - Connection Timed Out

Agent error code #298001 indicates that the agent sent a request to a firewall and no response arrived before the agent gave up.

It covers any call the agent makes to the device, not only an external object refresh: on a Palo Alto Networks firewall it also covers the address object and address group calls used in active mode, and the User-ID calls used for Dynamic Address Groups. The agent allows 10 seconds per request.

This error occurs when the agent can reach the network but does not receive a response from the firewall. Common causes include:

  • A commit or push is running on the firewall, which occupies the management plane
  • The firewall is under heavy load and unable to respond
  • A firewall or network device along the path is silently dropping packets
  • The firewall management interface is temporarily unavailable
  • The device has recently booted and its management plane is still initializing

Steps to Resolve

Verify Network Connectivity

Confirm that the agent can reach the firewall's management interface:

  1. From the machine running the agent, verify basic connectivity to the firewall hostname and port
  2. Check that there are no network devices (firewalls, proxies, or load balancers) between the agent and the target firewall that might be dropping or delaying traffic
  3. If using a proxy, verify the proxy is functioning correctly

Check Firewall Status

Verify that the firewall is operational and its management interface is responsive:

  1. Log into the firewall's management interface directly (via web browser or CLI)
  2. Check the firewall's CPU and memory utilization - extremely high resource usage can cause slow API responses
  3. Review the firewall's logs for any errors or warnings that might indicate performance issues

Review Network Path

If the agent and firewall are on different networks:

  1. Check for any intermediate firewalls or security devices that might be rate-limiting or blocking the connection
  2. Verify that the management port for the firewall is allowed through all network devices (more information will be available in the Knocknoc setup guide for your firewall)

Retry the Operation

Connection timeouts are often transient. The agent will automatically retry the operation, but if the error persists:

  1. Wait a few minutes and check if subsequent operations succeed
  2. If the firewall was under heavy load, the issue may resolve once the load decreases
Back to top