Description

This article addresses the NSM update High End SRX-IDP failing.

Symptoms

NSM update High End SRX-IDP fail. The same error will appear in CLI as "packet-log" when committing the update.

NSM update fail.

Error Code:

Error Text:
Update fails UpdateDevice Results
sanityCheckCmd Success.
lock Success.
GenerateEditConfig Success.
validate Success.
confirmedCommit Failed .

<rpc-reply message-id="1" xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns:junos="http://xml.juniper.net/junos/11.4R6/junos" xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0">
<rpc-error>
<error-severity> error
<error-path> [edit security idp idp-policy DC6_DMZ_SRX01 rulebase-ips rule 1 then notification]
<error-info>
<bad-element> packet-log

<error-message> mgd: when pcap is enabled then end point details should also be configured

<rpc-error>
<error-severity> error
<error-message>
commit failed: (statements constraint check failed)




unlock Success.
Error Details:
Logs:
<configuration>
<security>
<idp>
<idp-policy>
<name> DC6_DMZ_SRX01
<rulebase-ips>
<rule>
<name> 1
<match>
<attacks>
<custom-attack-groups> MS13-020 Vul in OLE Automation Could Allow RCE (2802968)
<predefined-attacks operation="delete"> NFS:MS-WINDOWS-NFS-NULL-DOS


<then>
<notification operation="create">
<log-attacks>
<alert />

<packet-log>
<pre-attack> 10
<post-attack> 20
<post-attack-timeout> 1




<rule operation="delete">
<name> 2



<custom-attack-group operation="delete">
<name> Vul in Win Remote Desktop Protocol (RDP) Brute Force Attempt

<custom-attack-group operation="delete">
<name> Vul in Win Shell Could Allow RCE (2286198)

<custom-attack-group operation="create">
<name> MS13-020 Vul in OLE Automation Could Allow RCE (2802968)
<group-members> HTTP:STC:OLE-AUTO-RCE





Using CLI:
root@junosdut# commit
[edit security idp idp-policy junosdust rulebase-ips rule 1 then notification]
'packet-log'
when pcap is enabled then end point details should also be configured
error: commit failed: (statements constraint check failed)

Solution


This issue is happening due to the missing of following mandatory configuration in the High end srx-idp device:

  1. set security idp sensor-configuration packet-log source-address <srx-ip>
  2. set security idp sensor-configuration packet-log host <syslog server>
  3. set security idp sensor-configuration packet-log host port 514
To set the 'packet Log' data we need to configure the above CLIs in High end SRX-IDP devices and then import the device.