In Security Director 24.1R5, publishing a security policy to an SRX4100 device may generate unexpected deletion statements for certain Intrusion Detection and Prevention (IDP) configuration entries.

• When a security policy is published from Security Director to an SRX4100 device that has IDP policies configured with the packet-log feature enabled, the View Configuration page may indicate that Security Director is attempting to remove specific IDP configuration entries associated with the packet-log feature from the device configuration.

delete security idp idp-policy <IDP-Policy-Name> rulebase-ips rule <Rule-name> then notification packet-log

delete security idp idp-policy <IDP-Policy-Name> rulebase-ips rule <Rule-name> then notification packet-log

Root Cause:

This issue occurs because of a schema parsing problem between Security Director and the device configuration. During the parsing process, Security Director may incorrectly interpret certain IDP configuration elements and generate unintended deletion entries.

SRX4100 devices belong to the SRXTVP device family. Within the DMI schema, these devices are generally categorized under the common identifier srxtvp rather than being listed individually. This classification contributes to the configuration parsing behavior that results in the erroneous IDP deletion entries.

Resolution:

To resolve the issue, perform the following steps:

1. Upgrade the setup to Junos Space Network Management Platform 26.1R1 HotPatch V2
2. Next, upgrade Junos Space Security Director to 26.1R1
3. Once the setup is on 26.1R1, install the latest Space NMP 26.1R1 HPv2 and SD 26.1R1 HPv1 patches using the installations instructions outlined here: Installation Instructions (page 33)
4. Delete the existing Firewall and IPS policies from Security Director.
5. Check the View Configuration again and verify that no unintended IDP deletion entries are generated. 
6. If the preview results are correct, deploy the policy to the device.