# Not receiving any IPs / decisions from central API

**URL:** <https://discourse.crowdsec.net/t/not-receiving-any-ips-decisions-from-central-api/1682>\
**Category:** Uncategorized\
**Created:** [March 1, 2024, 9:26am UTC](https://discourse.crowdsec.net/t/not-receiving-any-ips-decisions-from-central-api/1682 "2024-03-01T09:26:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dagger](https://avatars.discourse-cdn.com/v4/letter/d/41988e/32.png) [@dagger](https://discourse.crowdsec.net/u/dagger)\
**Post date:** [March 1, 2024, 9:26am UTC](https://discourse.crowdsec.net/t/not-receiving-any-ips-decisions-from-central-api/1682/1 "2024-03-01T09:26:32Z")

</div>

I believe I have setup a my security engine wit a central LAPI correctly and connected it to a firewall bouncer.  
However, the engine does not seem to be receiving updates from the Central API (console), which I assume would be blocklist decisions.

The engine logs a `FORBIDDEN` message, of which I am unsure if that is expected.

```auto
Mar 01 09:15:26 ch1 systemd[1]: Started CrowdSec is a free, modern & collaborative behavior detection engine, coupled with a global IP reputation network..
Mar 01 09:15:27 ch1 crowdsec[365156]: time="2024-03-01T09:15:27Z" level=warning msg="crowdsec agent is disabled"
Mar 01 09:15:27 ch1 crowdsec[365156]: time="2024-03-01T09:15:27Z" level=info msg="Enabled feature flags: <none>"
Mar 01 09:15:27 ch1 crowdsec[365156]: time="2024-03-01T09:15:27Z" level=info msg="Crowdsec v1.6.0-"
Mar 01 09:15:27 ch1 crowdsec[365156]: time="2024-03-01T09:15:27Z" level=info msg="Loading CAPI manager"
Mar 01 09:15:28 ch1 crowdsec[365156]: time="2024-03-01T09:15:28Z" level=info msg="CAPI manager configured successfully"
Mar 01 09:15:28 ch1 crowdsec[365156]: time="2024-03-01T09:15:28Z" level=info msg="Machine is enrolled in the console, Loading PAPI Client"
Mar 01 09:15:28 ch1 crowdsec[365156]: time="2024-03-01T09:15:28Z" level=info msg="Start push to CrowdSec Central API (interval: 5s once, then 10s)"
Mar 01 09:15:28 ch1 crowdsec[365156]: time="2024-03-01T09:15:28Z" level=info msg="Starting PAPI decision receiver"
Mar 01 09:15:28 ch1 crowdsec[365156]: time="2024-03-01T09:15:28Z" level=warning msg="scenario list is empty, will not pull yet"
Mar 01 09:15:28 ch1 crowdsec[365156]: time="2024-03-01T09:15:28Z" level=info msg="Starting Polling API Pull" interval=10 source=papi
Mar 01 09:15:28 ch1 crowdsec[365156]: time="2024-03-01T09:15:28Z" level=info msg="CrowdSec Local API listening on 127.0.0.1:9674"
Mar 01 09:15:28 ch1 crowdsec[365156]: time="2024-03-01T09:15:28Z" level=info msg="Start sending metrics to CrowdSec Central API (interval: 19m59s once, then 30m0s)"
Mar 01 09:15:28 ch1 crowdsec[365156]: time="2024-03-01T09:15:28Z" level=info msg="Starting PAPI pull (since:0001-01-01 00:00:00 +0000 UTC)" interval=10 source=papi
Mar 01 09:15:28 ch1 crowdsec[365156]: time="2024-03-01T09:15:28Z" level=info msg="starting polling client" component=longpollclient url="https://papi.api.crowdsec.net/v1/decisions/stream/poll"
Mar 01 09:15:28 ch1 crowdsec[365156]: time="2024-03-01T09:15:28Z" level=info msg="Start decisions sync to CrowdSec Central API (interval: 10s)" interval=10 source=papi
Mar 01 09:15:28 ch1 crowdsec[365156]: time="2024-03-01T09:15:28Z" level=info msg="capi metrics: sending"
Mar 01 09:15:28 ch1 crowdsec[365156]: time="2024-03-01T09:15:28Z" level=error msg="unexpected status code: 402" component=longpollclient url="https://papi.api.crowdsec.net/v1/decisions/stream/poll"
Mar 01 09:15:28 ch1 crowdsec[365156]: time="2024-03-01T09:15:28Z" level=error msg="{\"error\":\"Forbidden for plan 'COMMUNITY'\",\"timestamp\":0}" component=longpollclient method=poll request-id="Root=1-65e19cb0-637989b1332d9179022747e7" url="https://papi.api.crowdsec.net/v1/decisions/stream/poll"
Mar 01 09:15:28 ch1 crowdsec[365156]: time="2024-03-01T09:15:28Z" level=error msg="failed to poll: user is not authorized to use PAPI" component=longpollclient url="https://papi.api.crowdsec.net/v1/decisions/stream/poll"

```

Maybe related, I have two secnarios installed, but they are not showing up on the console website

```auto
cscli scenarios list

SCENARIOS
────────────────────────────────────────────────────────────────────────────────────────────
 Name 📦 Status Version Local Path                               
────────────────────────────────────────────────────────────────────────────────────────────
 crowdsecurity/ssh-bf ✔️ enabled 0.3 /etc/crowdsec/scenarios/ssh-bf.yaml      
 crowdsecurity/ssh-slow-bf ✔️ enabled 0.4 /etc/crowdsec/scenarios/ssh-slow-bf.yaml 
────────────────────────────────────────────────────────────────────────────────────────────

```

![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/47dd784842a7b9de9aa57a9bd280ee008d39656a.png)

```auto
cscli console status
╭────────────────────┬───────────┬──────────────────────────────────────────────────────╮
│ Option Name │ Activated │ Description │
├────────────────────┼───────────┼──────────────────────────────────────────────────────┤
│ custom │ ✅ │ Forward alerts from custom scenarios to the console │
│ manual │ ✅ │ Forward manual decisions to the console │
│ tainted │ ✅ │ Forward alerts from tainted scenarios to the console │
│ context │ ❌ │ Forward context with alerts to the console │
│ console_management │ ✅ │ Receive decisions from console │
╰────────────────────┴───────────┴──────────────────────────────────────────────────────╯

```

I feel like something is not righ with my connection to the console API.  
I’d appreciate any advice 🙂

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [March 1, 2024, 9:58am UTC](https://discourse.crowdsec.net/t/not-receiving-any-ips-decisions-from-central-api/1682/2 "2024-03-01T09:58:44Z")

</div>

If you run `cscli metrics` do you see decisions with origin as `CAPI`? The error message you are getting is fine, as the `papi` client is only for `enterprise` customers but it will attempt to make the first reach out.

Im guessing you are using a custom built binary? as the version print statement does not look our normal one.

Also after the enrollment did you follow the prompt to `Restart the crowdsec service after you have accepted`?

---

<div class="post-metadata">

**Author:** ![dagger](https://avatars.discourse-cdn.com/v4/letter/d/41988e/32.png) [@dagger](https://discourse.crowdsec.net/u/dagger)\
**Post date:** [March 1, 2024, 10:29am UTC](https://discourse.crowdsec.net/t/not-receiving-any-ips-decisions-from-central-api/1682/3 "2024-03-01T10:29:28Z")

</div>

Looks like the problem solved itself after I connected my local datasource.  
My (apparently false) assumption was that those two things would work independently.

Is this because users of the community plan “must” share?

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [March 1, 2024, 12:53pm UTC](https://discourse.crowdsec.net/t/not-receiving-any-ips-decisions-from-central-api/1682/4 "2024-03-01T12:53:40Z")

</div>

> [@dagger](#):
>
> Is this because users of the community plan “must” share?

To get access to the community blocklist, you dont _have_ to share. However, if you do not you will only get a small portion of the list so it fairer agaisnt those who do share.

These limits do **NOT** apply to third party lists which you will always get