Search Results

Agent error code #204051 indicates that az network nsg rule create failed. This is the operation that grants a user access. Common causes include: The service principal can read the NSG but not modify it The NSG has reached its rule limit Another process chan...

Agent error code #204052 indicates that az network nsg rule delete failed while revoking a grant. Access that should have been withdrawn may still be in place. Common causes include: The service principal can create rules but not delete them A resource lock o...

Agent error code #204053 indicates that the agent could not find a free priority number to create the rule with. Every NSG rule needs a unique priority, and the agent searches the range 500 to 4096 for one that is unused. This code means either every priority ...

Agent error code #NFT000 indicates that the agent could not run the nft binary on the host it is running on. The nftables backend drives the kernel ruleset by shelling out to nft, so without that binary no grant can be applied. The agent reports this when it...

Agent error code #NFT001 indicates that nft is present on the host but the agent has no way to run it with the privileges it needs. Changing the kernel ruleset requires root, and the agent is neither running as root nor able to escalate. The agent never hardc...

Agent error code #NFT002 indicates that the set name configured on the knoc is not a fully qualified nftables set reference. The agent requires the <family>:<table>:<set> form, for example inet:knocknoc:knoc_ssh_v4. An unqualified name is ambiguous, because ...

Agent error code #NFT003 indicates that the knoc uses the nftables backend but names no set at all, in either address family. Nothing it grants would ever be applied, so the agent has nowhere to add an address. This is reported by Validate connection on the kn...

Agent error code #NFT050 indicates that the configured set could not be found on the agent host. The kernel, not a cached listing, is the authority here: at grant time the code is raised only when nft itself reported the set or its table as missing. It is als...

Agent error code #NFT051 indicates that the address could not be added because it overlaps an entry already in the set. An nftables set declared with flags interval stores ranges and rejects an element that overlaps one it already holds, rather than merging t...

Agent error code #NFT052 indicates that nft add element failed for a reason the agent could not attribute to a more specific cause. The set was not reported missing and the element was not reported as overlapping, so the failure came from the command itself. ...

Agent error code #NFT100 indicates that nft delete element failed while revoking a grant. The address is likely still in the set, which means access that should have been withdrawn is still in place. An element that is already gone is not this error. The kern...

Agent error code #NFT400 indicates that the agent could not read the nftables sets. Either the listing command failed, or it ran and returned output the agent could not parse. The agent reads the ruleset in JSON form, so anything that disturbs that output land...

Agent error code #206000 indicates that the script configured on the knoc is not something the agent will run on the platform it is installed on. The agent refuses it before executing anything. On Windows the agent runs PowerShell scripts only, and it refuses ...

Agent error code #200107 means the address group named on the knoc is not on the Palo Alto Networks firewall or in Panorama. The firewall answered the agent's read of that group with Object Not Present. This applies to a knoc in active mode, where Knocknoc ma...

Agent error code #200150 occurs when the Knocknoc agent asks a Palo Alto Networks firewall to register an IP-tag mapping and the firewall rejects the request. This is the Dynamic Address Group mode of the PAN-OS integration: Knocknoc registers the user's IP ag...

Agent error code #200151 occurs when a Knocknoc grant ends and the agent asks a Palo Alto Networks firewall to remove the IP-tag mapping it registered, but the firewall rejects the request. The user's access stays open until the mapping is gone or the tag's ow...