Description

This article describes the issue of groups, which are applied under [security policies] , are not creating the required policies for all zones.

Symptoms

A group was formed to create inherit policies from the <*> zone to the test2 zone and the group has to be used to create security policies from all the available zones to the test2 zone.

Solution

The Apply-group will create security policies, only if there is a configuration available at the level [security policies from-zone {NAME.EN_US} to-zone test3] , in which {NAME.EN_US} is a zone name.

Assume that the following zones are available: 

security-zone test1;
security-zone test2;
security-zone test3;
And policies are to be created from the test1 , test2 , and test3 to test3 zones. The following group is configured as follows: 
test {
    security {
        policies {
            from-zone <*> to-zone test3 {
                policy inherit {
                    match {
                        source-address any;
                        destination-address any;
                        application any;
                    }
                    then {
                        permit;
                    }
                }
            }
        }
    }
}
The security policies configuration is as follows: 
root@210-1# show security policies                            
from-zone test1 to-zone test3 {
    policy p1 {
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            permit;
        }
    }
}
default-policy {
    permit-all;
}
If the above group is applied to the [security policies] hierarchy, it will not automatically populate the required policies; but will populate policies only for the zones that have security policies already configured to test3 .

After applying the group, you will get the following inheritance: 
[edit]
root@210-1# show security policies | display inheritance | except # | no-more
from-zone test1 to-zone test3 {
    policy p1 {
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            permit;
        }
    }
    policy inherit {
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            permit;
        }
    }
}
You can see that no policies were created from test2 (or test3 ) to test3 .

The solution is to apply the group at the from-zone [zone1] to-zone [zone2] level, as shown below: 

from-zone test1 to-zone test3 {
    policy p1 {
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            permit;
        }
    }
}
from-zone test2 to-zone test3 {
    apply-groups test;
}
from-zone test3 to-zone test3 {
    apply-groups test;
}
Verfication :

You will now see the policies being inherited: 
[edit]
root@210-1# show security policies | display inheritance | except # | no-more
from-zone test2 to-zone test3 {
    policy inherit {
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            permit;
        }
    }
}
from-zone test1 to-zone test3 {
    policy p1 {
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            permit;
        }
    }
    policy inherit {
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            permit;
        }
    }
}
from-zone test3 to-zone test3 {
    policy inherit {
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            permit;
        }
    }
}

Modification History

2020-06-24: Article reviewed for accuracy; no changes required