When updating an SRX device running Junos, the device fails with error "mgd: Missing mandatory statement: 'policy' ". This article explains the reason and offers two workarounds.

The following error message is seen when the SRX is updated from NSM or Junos Space Security Director:

Error Code:

Error Text:
Update fails UpdateDevice Results
sanityCheckCmd Success.
lock Success.
GenerateEditConfig Success.
confirmedCommit Failed .

<commit-results xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns:junos="http://xml.juniper.net/junos/10.1R2/junos" xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0">
<rpc-error>
<error-severity>error
<error-path>[edit security policies]
<error-info>
<bad-element>from-zone LBI to-zone PCN

<error-message>mgd: Missing mandatory statement: 'policy'

<rpc-error>
<error-severity>error
<error-path>[edit security policies]
<error-info>
<bad-element>from-zone ABCto-zone XYZ

<error-message>mgd: Missing mandatory statement: 'policy'

<rpc-error>
<error-severity>error

This is because all the rules relating to zone ABC to zone XYZ are disabled in  NSM  and are pushed to the  SRX / Junos  device.  Junos  does not allow all rules in a policy to be disabled. There should be at least one rule enabled between the two zones. If the rules are not required, they all can be deleted, but all rules can not be disabled.

One solution is to activate at least one rule for the traffic between the ABC to XYZ zones.

Another solution is to delete all the rules for the traffic between the ABC to XYZ zones.

2017-8-30: Added Junos Space Security Director to Products.