This article explains how to troubleshoot and fix if policy push fails with the commit error. Here is the screenshot for the same:
To identify the issue, please enable netconf traceoption on the SRX using the below commands:
set system services netconf ssh
set system services netconf traceoptions file netconf-ops.log
set system services netconf traceoptions file size 3m
set system services netconf traceoptions file files 20
set system services netconf traceoptions file world-readable
set system services netconf traceoptions flag all
Please deploy the policy to the SRX and check netconf-ops.log.
Also, please check interactive-commands logs, you will see the command is getting rollback:
Sep 2 03:22:09 xxxx mgd[50071]: UI_LOGIN_EVENT: User 'sduser' login, class 'j-super-user' [50071], ssh-connection 'x.x.x.x 7804 x.x.x.x', client-mode 'netconf'
Sep 2 03:22:10 xxxx mgd[50071]: UI_NETCONF_CMD: User 'sduser' used NETCONF client to run command 'lock cannot reconstruct arguments'
Sep 2 03:22:11 xxxx mgd[50071]: UI_NETCONF_CMD: User 'sduser' used NETCONF client to run command 'edit-config cannot reconstruct arguments cannot reconstruct arguments'
Sep 2 03:22:11 xxxx mgd[50071]: UI_NETCONF_CMD: User 'sduser' used NETCONF client to run command 'commit confirmed confirm-timeout=60 log=EMS System Commit b5c893f3-6094-4ead-b93f-a363d7218f5c EMS_REQ_ID:7fb9626c-c672-99e1-8e86-ce098a1ba008'
Sep 2 03:22:11 xxxx mgd[50071]: UI_COMMIT: User 'sduser' requested 'commit' operation (comment: EMS System Commit b5c893f3-6094-4ead-b93f-a363d7218f5c EMS_REQ_ID:7fb9626c-c672-99e1-8e86-ce098a1ba008)
Sep 2 03:22:18 xxxx mgd[50071]: UI_NETCONF_CMD: User 'sduser' used NETCONF client to run command 'discard-changes'
Sep 2 03:22:18 xxxx mgd[50071]: UI_LOAD_EVENT: User 'sduser' is performing a 'rollback'
Sep 2 03:22:19 xxxx mgd[50071]: UI_NETCONF_CMD: User 'sduser' used NETCONF client to run command 'unlock cannot reconstruct arguments'
Sep 2 03:22:19 xxxx mgd[50071]: UI_LOGOUT_EVENT: User 'sduser' logout
Here, b5c893f3-6094-4ead-b93f-a363d7218f5c is the Job ID. The same can be found from the WebUI for the deploy job.
Check if you are getting the following error:
Sep 4 10:23:58 [NETCONF] - [32211] Incoming: <?xml version="1.0" encoding="UTF-8"?>
<rpc message-id="cdc0c08d-db5a-4e1a-87da-5c69c81e7fca" xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"><commit><confirmed /><confirm-timeout>60</confirm-timeout><log>EMS System Commit 7c5817fe-fca3-463d-bead-d033502164ed EMS_REQ_ID:53614de9-9c31-9909-a73c-a9381ddbae13</log></commit></rpc>]]>]]>
Sep 4 10:23:58 [NETCONF] - [32211] Outgoing: <nc:rpc-reply xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns:junos="http://xml.juniper.net/junos/23.4R2-S4.9/junos" message-id="cdc0c08d-db5a-4e1a-87da-5c69c81e7fca">
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: [edit security idp idp-policy Recommended rulebase-ips rule TCP/IP match attacks]
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: </edit-path>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: <statement>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: predefined-attack-groups "[Recommended]IP - Critical"
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: </statement>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: <message>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: requires 'idp-sig' license
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: </message>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: </warning>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: <rpc-error>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: <error-type>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: protocol
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: </error-type>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: <error-tag>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: operation-failed
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: </error-tag>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: <error-severity>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: error
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: </error-severity>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: <error-path>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: [edit security idp idp-policy Recommended rulebase-ips rule TCP/IP match]
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: </error-path>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: <error-info>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: <source-daemon>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: idpd
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: </source-daemon>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: <bad-element>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: attacks
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: </bad-element>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: </error-info>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: <error-message>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: Please install the Signature Database
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: </error-message>
Sep 4 10:24:04 [NETCONF] - [32211] Outgoing: </rpc-error>
Sep 4 10:24:05 [NETCONF] - [32211] Outgoing: <error xmlns="http://xml.juniper.net/xnm/1.1/xnm" xmlns:xnm="http://xml.juniper.net/xnm/1.1/xnm">
Sep 4 10:24:05 [NETCONF] - [32211] Outgoing: <message>
Sep 4 10:24:05 [NETCONF] - [32211] Outgoing: configuration check-out failed
Sep 4 10:24:05 [NETCONF] - [32211] Outgoing: </message>
Sep 4 10:24:05 [NETCONF] - [32211] Outgoing: </error>
Sep 4 10:24:05 [NETCONF] - [32211] Outgoing: </routing-engine>
Sep 4 10:24:05 [NETCONF] - [32211] Outgoing: <routing-engine junos:style="show-name">
Sep 4 10:24:05 [NETCONF] - [32211] Outgoing: <name>node0</name>
Sep 4 10:24:05 [NETCONF] - [32211] Outgoing: <nc:rpc-error>
Sep 4 10:24:05 [NETCONF] - [32211] Outgoing: <nc:error-type>protocol</nc:error-type>
Sep 4 10:24:05 [NETCONF] - [32211] Outgoing: <nc:error-tag>operation-failed</nc:error-tag>
Sep 4 10:24:05 [NETCONF] - [32211] Outgoing: <nc:error-severity>error</nc:error-severity>
Sep 4 10:24:05 [NETCONF] - [32211] Outgoing: <nc:error-message>
Sep 4 10:24:05 [NETCONF] - [32211] Outgoing: remote commit-configuration failed on node1
Sep 4 10:24:05 [NETCONF] - [32211] Outgoing: </nc:error-message>
Sep 4 10:24:05 [NETCONF] - [32211] Outgoing: </nc:rpc-error>
Sep 4 10:24:05 [NETCONF] - [32211] Outgoing: commit failed
Sep 4 10:24:05 [NETCONF] - [32211] Outgoing: </commit-results>
Sep 4 10:24:05 [NETCONF] - [32211] Outgoing: </nc:rpc-reply>
Sep 4 10:24:05 [NETCONF] - [32211] Outgoing: ]]>]]>
As per the logs, committing the IDP attack configuration is failing on node1.
Please check if the IDP license is installed on node1 of SRX cluster using the below command:
> show system license
License usage:
Licensed Licensed Licensed
Feature Feature Feature
Feature name used installed needed Expiry
idp-sig 1 0 1 invalid
remote-access-ipsec-vpn-client 0 2 0 permanent
remote-access-juniper-std 0 2 0 permanent
In this example, the license is invalid on node1. Please install the IDP license on the SRX firewall to fix such issues.
Note: The RCA could be different for your setup. The troubleshooting steps to identify the issue are mentioned in the symptoms for all.
If you are still facing the same issue, please contact JTAC for assistance