CHKP055 - Identity Awareness Cannot Hold a Network

Agent error code #CHKP055 occurs when a knoc's predefined source is a network, such as 192.168.100.48/29, and the knoc grants access through a Check Point Identity Awareness gateway.

Identity Awareness maps one address per identity: add-identity takes a single ip-address field with no netmask, and delete-identity and show-identity work the same way. There is nowhere in that request to carry a range. The agent refuses the grant rather than pushing the network's first address and reporting the whole range as granted, which would leave most of the range with no access while the portal showed it open.

Steps to Resolve

Name Single Addresses Instead

Change the knoc's predefined sources to single addresses rather than a network. A knoc accepts up to five, so a small set of hosts can be listed individually.

Which sources a knoc grants is set under Grant access to on the knoc, where each entry is an IP address or a network in CIDR form.

Or Grant the Network Through a Different Backend

Identity Awareness is Knocknoc's only integration with Check Point today, and it is built for per-user access, not per-network access, so a network source is out of scope for it regardless of gateway configuration. If the environment genuinely needs to grant a whole network rather than named hosts, point the knoc at a different backend type that manages a range-holding object (an nftables or ipset set, a cloud security group, or similar).