Troubleshooting
Common issues and how to resolve them. If none of these fit, contact
support or email cpwordlist@neuralconfig.com
with your Cloudpath FQDN and roughly when the problem happened.
My account is stuck “pending review”
Section titled “My account is stuck “pending review””Only hosted Cloudpath servers (*.cloudpath.net) are approved
automatically. If you entered a self-hosted FQDN, your account waits for an
admin to approve it, and outbound calls stay disabled until then. Email
cpwordlist@neuralconfig.com to request review. See
Activate your account.
If you entered a hosted *.cloudpath.net FQDN and it’s still pending, double-check
the FQDN for typos, re-save it, and confirm it ends in .cloudpath.net.
Test Connection fails
Section titled “Test Connection fails”The dashboard’s Test Connection returns the specific reason:
| Message | Cause and fix |
|---|---|
| ”Your account is pending admin review.” | The account isn’t active yet — see above. |
| ”No Cloudpath FQDN configured.” | Enter your Cloudpath FQDN and save. |
| ”No Cloudpath credentials configured.” | Enter the Cloudpath API username and password and save. |
| ”Authentication failed: …” | The credentials were rejected by Cloudpath. Re-enter them and confirm the API account is valid and enabled. |
| ”Connection failed: …” | The Cloudpath server couldn’t be reached at that FQDN. Verify the hostname. |
The enrollment webhook is failing
Section titled “The enrollment webhook is failing”If passphrases aren’t changing, the notification step’s call to /api/change-dpsk
is likely returning an error. The codes mean:
| Code | Meaning and fix |
|---|---|
401 | The Shared Secret is missing or wrong. Re-copy the API Call URL from the dashboard. If you regenerated the secret, the old URL stops working — paste the new one. |
400 | Missing or malformed enrollmentId, or the tenant isn’t fully configured. Confirm the URL uses enrollmentId=${GUID} and that your FQDN and credentials are saved. |
404 | No DPSK was found for the enrollment. Make sure the notification step runs after “Generate a DPSK”. |
409 | A device is already connected on the DPSK, so the passphrase wasn’t changed. This is expected on re-enrollment and is safe to ignore. |
502 | Cloudpath authentication failed or the server was unreachable. Run Test Connection to confirm your credentials and FQDN. |
The passphrase still shows as a random string
Section titled “The passphrase still shows as a random string”- Confirm both workflow steps are present, in order, after “Generate a DPSK”, and that you published the workflow. See Add the enrollment workflow steps.
- Confirm the notification URL contains your correct Shared Secret.
- If the service was briefly unreachable, the display page falls back to the original Cloudpath passphrase after 15 seconds — that’s by design, and the passphrase still works. See How enrollment and fallback work.
The passphrase lookup returns “not found” / expired
Section titled “The passphrase lookup returns “not found” / expired”/api/get-dpsk mappings are cached for 5 minutes after a change. If a user
leaves the display page open longer than that and it retries, the lookup returns
404 — but the new passphrase is already set on the controller and still works.
Re-running the enrollment refreshes the mapping.
Passphrase conflicts
Section titled “Passphrase conflicts”If a generated phrase happens to match an existing DPSK in the pool, the service retries with a new phrase up to 3 times. With the full word list this is rare and usually resolves on its own.