v26.09

Our biggest release yet. Months of work behind the scenes, now ready. This update gives you more control over who gets network access and from where, fewer firewall-connection settings to maintain with simpler credential rotation, and support for the multiple identity providers throughout the whole application.

What's new

• Integrations. Configure a firewall, proxy or cloud connection once and reuse it across Knocs. Rotate credentials in one place. A far better integration experience for large estates orchestrating multiple control layers or devices. Rotate key material in one place or allow Admins without key material access to add Knocs without complexity or knowledge of secret material. Integrations guide
• Trust Engine. A successful login now gets a richer connection check before network access opens. Apply actions based on the source country or continent, or use live data sources to detect residential proxies, commercial VPNs, Tor or known malicious IPs. Policies now allow you to 'observe' the connection with additional logging, actively challenge the user and restrict access, or block it entirely. Stolen credentials arriving from a blocked connection do not open access. Trust Engine guide
• Multiple identity providers. Offer several SAML providers on one deployment, with distinct accounts and provider-scoped groups. You may have a corporate-IDP and an external or third-parties IDP, or add a third which is your partner organizations IDP. You can now map users and groups from those three sources all in one place. See the authentication guide
• Lots of small improvements are included within this release, too many to mention. Along with library security updates.

Plus a significant number of admin quality-of-life improvements, along with library, security and dependency updates.

Integrations

Until now, each Knoc carried its own copy of the connection details for the system behind it. Ten Knocs on one firewall meant ten copies. Integrations store that connection information once.

• One connection, many Knocs. Reuse an integration, its agent and credentials, when creating a Knoc. Each Knoc still defines the access it provides.
• See them in one place. Browse the firewalls, cloud services and reverse proxies your Knocs use. Search, filter and group.
• Activity per integration. Which Knocs use it, who has been connecting, grant volumes, wait times and failures. Follow a problem from an access path back to the system enforcing it.
• A clearer setup experience. The rebuilt Knoc wizard offers existing integrations, helps configure new ones, and diagrams how the server, agent and resource fit together. Connection checks catch setup problems early.
• Find duplicates. Ask your agents to identify matching connections, then merge them into shared integrations while keeping their Knoc assignments.

Upgrade the Server and then all your orchestration Agents, so you can de-duplicate your Knoc configuration information up to shared Integration items. This is worth the effort!

Read the Integrations guide

Trust Engine

A valid login is a good start. A valid login arriving through a residential proxy deserves a few follow-up questions. The Trust Engine allows you to decide what happens next, per user and per destination, before network access opens.

• Policy-style rules. Choose the conditions that matter and attach it to the Knocs it governs. Start with the supplied Passive, Standard and Strict policies, or create your own. Policies are reusable.
• Decide what deserves attention. Respond to connections from outside your approved countries or networks, over residential proxies, commercial VPNs or Tor, or from addresses reported malicious by GreyNoise or your own blocked-address lists.
• Observe, challenge or block. Observe records and lets access continue, think of it as a signal to your SIEM. Challenge asks for another sign-in (to avoid browser-session theft), a click (intentional friction for the user, appply just-in-time not just-in-case for your always-on Knocs), or a reduced access window than usual. Block refuses the connection and warns the user, but does support an Admin override. The strictest matching response wins.
• See why. The new Activity view shows who connected, from where, which Knoc and policy applied, and what happened. History keeps the rules that applied at the time, so a later edit does not rewrite yesterday's explanation. Admins can override a refused grant with an audited reason.
• Custom sources. Additional threat intelligence sources, including the ability to supply your own through polling.

Read the Trust Engine guide

Multiple identity providers

Offer several SAML identity providers on one Knocknoc deployment. Useful for partner access, multiple organizations, or an acquisition that left you with two directories.

• Each provider gets its own named sign-in button and SAML configuration.
• Accounts stay distinct between providers, even when usernames match. SAML and dynamic groups can be scoped to selected providers.
• Existing groups stay scoped to the original provider on upgrade.

Additional identity providers require an Enterprise license. Read the Authentication guide

Admin quality-of-life

• Faster Knoc setup. Category suggestions, source restrictions that accept network ranges (CIDR), and Palo Alto 'vsys' autofill. Combined with Integrations, this is way more powerful.
• Additional client IP addresses: three new per-Knoc options control the scope of discovered addresses, the address family (ipv4/v6), and accept-only behavior.
• Cleaner admin pages. Search with filters on the Knocs, API keys and audit log pages, an auto-focused search box, exact timestamps on hover, and live "last seen" ages.
• Clearer troubleshooting. Grant and revoke errors name the Knoc, ACL and address involved, the Support view has copy buttons, and Knocknoc warns when GELF log forwarding is set up without encryption.

Agents and reliability

• Unreachable devices are paused. When an agent cannot reach an orchestrated control layer, it pauses that Knoc and reports an error. It will then re-try, however it's now far more graceful than previous.
• Better connections and validation across Check Point, Entra, F5, Kemp, Meraki, MikroTik, OPNsense, Palo Alto, pfSense, Proxmox, SonicWall and Sophos.
• Refused agents. The portal shows agents being turned away, why, and how to fix them, with an indicator in the sidebar. Removed an Agent but didn't actually stop it or delete it? You can see that now.

Integration improvements

• Windows Firewall: ICMP and UDP rules are also matched by name prefix.
• Microsoft Azure NSG: subscriptions are discovered automatically.
• AWS: live connection validation.
• DigitalOcean: "all ports" option.
• Fortinet: The VDOM field now shows in FortiManager mode.
• Palo Alto: vsys smart autofill.

Release date: 30th September 2026

How do I upgrade?

Update the Knocknoc Server and orchestration Agents using the usual operating-system package or installer process. See the updates and upgrades guide. If you want to back up the system at the database level, follow this guide.

Integration de-dupe & merge

After upgrading, visit Integrations > Find duplicates to consolidate repeated connections. Update the relevant agents first so they can compare their configurations.

Existing Knocs keep their legacy access controls until you assign a trust policy. Assigning a policy replaces those per-Knoc source restrictions and GreyNoise settings for access decisions; selecting Legacy restores them.

As always, you choose when your Server and Agents update.