Thanks for the quick response.
No errors on the CE. On the CM I don't see any recent PERMISSION DENIED errors - there are some from earlier today but we've been working on the configuration. Those errors are, for completeness:
/var/log/condor/CollectorLog:10/10/19 10:59:13 PERMISSION DENIED to
condor_pool@xxxxxxxxxxxxxxx from host 111.222.333.444 for command 1 (UPDATE_SCHEDD_AD), access level ADVERTISE_SCHEDD: reason: ADVERTISE_SCHEDD authorization policy contains no matching ALLOW entry for this request; identifiers used for this host: 111.222.333.444,
host-111-222-333-444.nubes.stfc.ac.uk, hostname size = 1, original ip address = 111.222.333.444
/var/log/condor/CollectorLog:10/10/19 12:54:24 PERMISSION DENIED to
condor_pool@xxxxxxxxxxxxxxx from host 111.222.333.444 for command 1 (UPDATE_SCHEDD_AD), access level ADVERTISE_SCHEDD: reason: ADVERTISE_SCHEDD authorization policy contains no matching ALLOW entry for this request; identifiers used for this host: 111.222.333.444,
host-111-222-333-444.nubes.stfc.ac.uk, hostname size = 1, original ip address = 111.222.333.444
/var/log/condor/NegotiatorLog:10/10/19 14:59:57 PERMISSION DENIED to
condor_pool@xxxxxxxxxxxxxxx from host 111.222.333.444 for command 421 (Reschedule), access level DAEMON: reason: DAEMON authorization policy contains no matching ALLOW entry for this request; identifiers used for this host: 111.222.333.444,
host-111-222-333-444.nubes.stfc.ac.uk, hostname size = 1, original ip address = 111.222.333.444