Description

This article explains why a commit fails on the SRX device (standalone or cluster) due to an un-synchronized policy between the RE (routing engine) and the PFE (packet forwarding engine).

Symptoms

When there is out of sync policy between RE and PFE, the commit may fail with the following error on the SRX devices with early Junos versions.

[edit security]
     'policies'
          Policy is out of sync between RE and PFE <SPU-name(s)> .
  Please resync before commit.
error: configuration check-out failed


Starting from the following versions, there will be a warning instead of commit failure:

junos:12.3X48-D70 junos:12.3X48-D75 junos:15.1X49-D142 junos:15.1X49-D150 junos:17.3R3 junos:17.4R2 junos:18.1R3 junos:18.2R1 junos:18.2R2 junos:18.3R1

root@HUB# commit
warning: policy might be out of sync between RE and PFE fpc0. Please request security policies check/resync
commit complete


This issue is seen in branch as well as HE devices in both standalone and clustered modes.

Solution

On commit, security policies are pushed to the Packet Forwarding Engine (PFE) from the Routing Engine (RE). It is absolutely required for the policies on RE and PFE to be in sync for a commit to be successful. However, in certain scenarios these policies may be out of sync on RE and PFE; this causes commit to fail for early Junos versions or a warning for versions after listed above. It may also cause core-dump files to generate if the commit is tried repeatedly.

The out-of-sync can be due to:

  • A policy message from RE to PFE is lost
  • Something went wrong on the RE, such as a policy uid being re-used.


How to check if there is an out-of-sync issue

To see if the out-of-sync issue has occurred, compare the checksum value on the RE and PFE using the following commands.

Important : The checksum value on the RE and PFE must be the same.

Junos OS 18.4 R1 and later

To check if the PFE is out-of-sync with the RE, run the following command (introduced in Junos OS 18.4R1) which compares the values and provides the sync/no-sync results:

user@host> request security policies check
 

Start sending policies ...
Success
Total sent 2 policies.

Policy Checking Result:
 PFE fpc4.pic0         in-sync
 PFE fpc4.pic1         out-of-sync

Below Junos OS 18.4R1

On the RE:

To display the checksum, run the command:

user@SRX>show security policies checksum > Hidden command; has to be typed completely
Sample output:
Logical system: root-logical-system
 From zone     To zone   Checksum
 untrust       trust     0xe0fc5791-d7ec5b89-cbc66724-35d706c1

On the PFE:

Branch SRX Devices:

To display the checksum, run the command:

user@SRX>start shell  < For branch SRX devices
 user % vty fwdd
 FLOWD_OCTEON( vty)# show usp policy checksum

Sample output:

Logical system: root-logical-system
 From zone          To zone   checksum
 untrust            trust     0xe0fc5791-d7ec5b89-cbc66724-35d706c1

 

High-End SRX Devices:

To display the checksum on all XLRs with one command :

user@SRX>start shell < For High End SRX
user % srx-cprod.sh -s spu -c "show usp policy checksum"
======== Start SPU0.0, node0.fpc0.pic0, spu ========
================ node0.fpc0.pic0 ================
 
Logical system: root-logical-system
From zone To zone checksum
trust trust 0x3d92a15d-21d68dd8-4e224d9e-de232346
 
======== End SPU0.0, node0.fpc0.pic0 ========
 
======== Start SPU0.1, node0.fpc0.pic1, spu ========
================ node0.fpc0.pic1 ================
 
Logical system: root-logical-system
From zone To zone checksum
trust trust 0x3d92a15d-21d68dd8-4e224d9e-de232346
 
======== End SPU0.1, node0.fpc0.pic1 ========

Follow these steps to resolve this issue:

  1. Execute > request security policies resync  command and check to see if you are able to commit now.

  2. If this did not work, try to run the # commit synchronize or # commit synchronize force command. Please note that it is recommended to use the force option only if the commit synchronize fails.

  3. If this too does not work, reboot the SRX device. Please reboot both of the nodes in case of a chassis cluster. It is recommended not to reboot both the SRX at the same time in production environment.

If none of the above solution works or if core-dumps are generated while trying to commit, please open a case with your technical support representative.

Modification History

2019-04-19: Related link to SRX document updated.
2023-01-27: Updated with the current commit behavior for out of sync scenario.
4/9/2024: changed from "It is recommended not to reboot the SRX in production environment." to  "It is recommended not to reboot both the SRX at the same time in production environment. "

Related Information