Search Results

Agent error code #KEMP004 indicates that Knocknoc opened or attempted a connection to the Kemp LoadMaster but the request did not complete within the allowed time. A timeout differs from a refused connection (#KEMP000). The host is reachable enough to start a ...

Agent error code #KEMP005 indicates that Knocknoc reached the LoadMaster but the API endpoint was not found. The API returned HTTP 404 Not Found, which usually means the API Interface is not enabled. Knocknoc manages the global allowlist through the LoadMaster...

Agent error code #KEMP100 indicates that Knocknoc could not read the global ACL allowlist it is supposed to manage. A failure here usually points at a permissions or API availability problem rather than a missing list. If the allowlist simply has no entries ye...

Agent error code #KEMP101 indicates that Knocknoc could read the global ACL but the call to add an address to the allowlist failed. An add failure usually points at a permissions boundary on the write path or a transient LoadMaster error. Common causes include...

Agent error code #KEMP102 indicates that Knocknoc could read the global ACL but the call to remove an address from the allowlist failed. This typically happens when a grant expires and Knocknoc tries to revoke access. The address remaining in the allowlist aft...

Agent error code #KEMP400 indicates that Knocknoc reached the Kemp LoadMaster and received a response, but the response did not match the expected shape. The most common case is a non-success status carrying an error message in the body. Less commonly, a succe...

Configure 1Kosmos as a SAML identity provider (IdP) for Knocknoc. Once connected, your users authenticate against 1Kosmos — including its biometric and passwordless factors — and Knocknoc maps their group membership to access entitlements. This example assumes...

Ping Identity SSO Configure PingOne as a SAML identity provider (IdP) for Knocknoc. Users authenticate against Ping, and Knocknoc maps their group membership to access entitlements. This example assumes your Knocknoc instance is at https://<tenant>.knoc.cloud....

IPsets with firewalld On RHEL-family hosts — and any distribution that uses firewalld as its firewall front-end — Knocknoc does not talk to firewalld directly. As with the main IPSet backend, Knocknoc orchestrates the kernel's native IPSets, and firewalld simp...

The Knocknoc OpenBSD Agent is orchestration software for managing just-in-time network access. It runs as the unprivileged _knocknoc-agent user, connects to your Knocknoc server over WebSocket, and enforces access locally through the configured integrations. ...

Knocknoc integrates with the PF packet filter to dynamically control network access on a host that the agent runs on directly. As users authenticate and grants expire, the agent adds and removes their IPs from a PF table; your own pass/block rules reference th...

Knocknoc normally grants access to the single IP a user authenticates from. Agentic Access and Companions extend that for two cases: granting time-limited access to an automated agent, and keeping access for a user's other companions, such as a second device o...

Knocknoc can orchestrate F5 Networks BigIP and related devices via two mechanisms, including iRules "Data group List" and the AFM. Typically iRules are used as they can be deployed across both high-end F5 devices and lower/smaller deployments. The iRules can r...

Knocknoc integrates with Cisco Meraki to dynamically control which source IPs are allowed through Meraki MX firewall policy. The integration uses the Meraki Dashboard API to maintain a single Policy Object Group per Knoc. The orchestration is performed by a Kn...

Agent error code #F5000 indicates that the Knocknoc agent could not establish a network connection to the F5 BIG-IP management endpoint at all. The connection failed before any authentication could take place. This is distinct from authentication (#F5001) and ...

Agent error code #F5001 indicates that the F5 BIG-IP rejected the username and password supplied by the Knocknoc agent. The device returned HTTP 401 Unauthorized when the agent tried to obtain an authentication token. This is distinct from authorization failur...

Agent error code #F5002 indicates that the F5 BIG-IP accepted the credentials but the user's role does not have permission to perform the requested operation on the data-group. The device returned HTTP 403 Forbidden. This is distinct from authentication failur...

Agent error code #F5003 indicates that the TLS handshake with the F5 BIG-IP management endpoint failed. The agent reached the device but could not verify its certificate. Common causes include: The BIG-IP presents its default self-signed management certificate...