Search Results

Agent error code #NFT052 indicates that nft add element failed for a reason the agent could not attribute to a more specific cause. The set was not reported missing and the element was not reported as overlapping, so the failure came from the command itself. ...

Agent error code #NFT100 indicates that nft delete element failed while revoking a grant. The address is likely still in the set, which means access that should have been withdrawn is still in place. An element that is already gone is not this error. The kern...

Agent error code #NFT400 indicates that the agent could not read the nftables sets. Either the listing command failed, or it ran and returned output the agent could not parse. The agent reads the ruleset in JSON form, so anything that disturbs that output land...

Agent error code #206000 indicates that the script configured on the knoc is not something the agent will run on the platform it is installed on. The agent refuses it before executing anything. On Windows the agent runs PowerShell scripts only, and it refuses ...

Agent error code #200107 means the address group named on the knoc is not on the Palo Alto Networks firewall or in Panorama. The firewall answered the agent's read of that group with Object Not Present. This applies to a knoc in active mode, where Knocknoc ma...

Agent error code #200150 occurs when the Knocknoc agent asks a Palo Alto Networks firewall to register an IP-tag mapping and the firewall rejects the request. This is the Dynamic Address Group mode of the PAN-OS integration: Knocknoc registers the user's IP ag...

Agent error code #200151 occurs when a Knocknoc grant ends and the agent asks a Palo Alto Networks firewall to remove the IP-tag mapping it registered, but the firewall rejects the request. The user's access stays open until the mapping is gone or the tag's ow...

Agent error code #200152 means the Palo Alto Networks firewall turned a User-ID update away because its management plane was occupied, not because anything about the request was wrong. A commit or push in progress is the usual reason. Knocknoc retries these au...

Agent error code #200153 means Knocknoc sent an IP-tag registration through Panorama for a specific firewall serial number, and Panorama could not reach that firewall to pass the request on. This is the User-ID equivalent of #200000, which covers the same prob...

Agent error code #200154 means the Palo Alto Networks firewall rejected the timeout Knocknoc set on the IP-tag mapping. Knocknoc registers each tag with a timeout matching the remaining session length, so the firewall expires the mapping by itself if the agent...

Agent error code #200155 means the Palo Alto Networks firewall does not have the virtual system that the knoc names, so it rejected the IP-tag registration. A firewall in single-vsys mode has one virtual system called vsys1. A firewall in multi-vsys mode has ...

Agent error code #200156 means the Palo Alto Networks firewall or Panorama rejected the API key Knocknoc presented when registering an IP-tag mapping. The credential was refused, so nothing about the request itself was evaluated. This covers the User-ID path s...

Agent error code #200157 means the API key Knocknoc presented is valid, but the administrator it belongs to is not permitted to submit User-ID updates. The firewall authenticated the request and then refused the operation. Registering an IP-tag mapping through...

Agent error code #200158 means the Palo Alto Networks firewall refused a User-ID registration because it is already holding as many registered IP addresses as its model allows. This is a capacity limit, not a busy device. Knocknoc does not retry it, because th...

Agent error code #200200 means the Knocknoc agent could not find out which firewall in an HA pair is active, so it had nowhere to send the grant. It applies only to a knoc configured with an HA peer and talking to firewalls directly. Where the knoc goes throug...

Agent error code #200201 means both firewalls in the HA pair answered the Knocknoc agent and neither reported itself active, so there was nowhere to apply the grant. This is the opposite situation from #200200. The checks worked. What they found is the problem...

Agent error code #299000 is the fallback the agent reports when a backend operation failed without supplying a specific reason. It carries no detail of its own, so the useful information is in the agent log rather than in this message. Every backend has its ow...

Agent error code #299001 indicates that the agent could not decrypt a stored secret (such as an API token or password) before using it to authenticate to a backend. Credentials are held encrypted and decrypted only at the moment they are needed; this error mea...