When logical systems are configured on SRX devices and the IDP policy is loaded, the following may occur:
This article provides a workaround to compile the policy successfully.
If multiple IDP policies are configured along with logical systems on the SRX, the device may fail to load the active policy or it may load the last good known policy: The output of show security idp policy-commit-status detail may report the following failures:
show security idp policy-commit-status detail
root@SRX-LAB> show security idp policy-commit-status detail node0: -------------------------------------------------------------------------- [sc_ids_parse_dfa_group_fields]: sc_ids_parse_rexp(dg_c19e-1f0d0p0s0n0h1p0_555) failed [sc_ids_parse_attack]: sc_ids_parse_dfa_group_fields() failed [sc_ids_parse_data]: sc_ids_parse_load_attacks() failed [sc_ids_parser] sc_ids_parse_data() failed [sc_parser_compile]: parser for ids failed [sc_subs_policy_compile]: sc_pmanager_policy_compile() failed [sc_subs_policy_compile]: current pfeman malloc failure 1
IDP trace-options may report logs similar to the following:
Jun 16 07:21:07 idpd_policy_load: idp policy parser compile succeeded Jun 16 09:30:51 sensorconf: dfa compiler flags 0x000000f1, compilation needed 'no' Jun 16 09:30:51 sensorconf: dfa compiler flags 0x000000f1 Jun 16 09:30:51 idpd_need_policy_compile:731 Active policy path /var/db/idpd/sets/idp-policy-combined.set Jun 16 09:31:05 Active Policy (idp-policy-combined) rule base configuration is changed so need to recompile active policy Jun 16 09:31:16 lsys policy should recompile Jun 16 09:31:33 Starting policy(idp-policy-combined) compile with compress ; dfa compile flags(0x000000f1)... Jun 16 09:42:53 Policy compiled successfully. ..... Jun 16 09:43:46 idp_policy_loader_command: sc_klibs_subs_policy_pre_compile() returned 0 (EOK) Jun 16 09:43:51 idp_policy_loader_command: sc_klibs_subs_policy_pre_compile() returned 0 (EOK) Jun 16 09:43:51 idpd_policy_load: idp policy parser pre compile succeeded, after (1) retries Jun 16 09:43:51 idpd_policy_load: policy parser compile subs s0 name /var/db/idpd/bins/idp-policy-combined.bin.gz.v.1 buf 0x0 size 0zones 0xc57072f z_size 272 detector /var/db/idpd//bins/detector.so ai_buf 0x0 ai_size 0 ai idmap_buf 0x1ce0200 idmap_size 132 Jun 16 09:44:41 idp_policy_loader_command: sc_klibs_subs_policy_compile() failed Jun 16 09:44:41 idp_policy_loader_command: sc_klibs_subs_policy_compile() returned -35 (EAGAIN) Jun 16 09:44:41 idpd_policy_load: idp policy parser compile failed Jun 16 09:44:41 idp_policy_loader_command: sc_klibs_subs_policy_pre_compile() returned 0 (EOK) Jun 16 09:44:46 idp_policy_loader_command: sc_klibs_subs_policy_pre_compile() returned -35 (EAGAIN) Jun 16 09:44:51 idp_policy_loader_command: sc_klibs_subs_policy_pre_compile() returned 0 (EOK) Jun 16 09:44:51 idpd_policy_load: idp policy parser pre compile succeeded, after (2) retries Jun 16 09:44:51 idpd_policy_load: policy parser compile subs s0 name /var/db/idpd/bins/idp-policy-combined.bin.gz.v.1 buf 0x0 size 0zones 0xc57072f z_size 272 detector /var/db/idpd//bins/detector.so ai_buf 0x0 ai_size 0 ai idmap_buf 0x1ce0200 idmap_size 132 Jun 16 09:45:28 idp_policy_loader_command: sc_klibs_subs_policy_compile() failed Jun 16 09:45:28 idp_policy_loader_command: sc_klibs_subs_policy_compile() returned -12 (FAILED) Jun 16 09:45:28 idpd_policy_load: idp policy parser compile failed Jun 16 09:45:28 IDP policy loading failed policy :[/var/db/idpd/bins/idp-policy-combined.bin.gz.v];detector:/var/db/idpd/sec-repository/installed-detector/libidp-detector.so.tgz.v;reason:[idp policy parser compile failed] Jun 16 09:45:30 idp_policy_loader_command: sc_klibs_subs_policy_pre_compile() returned -35 (EAGAIN) Jun 16 09:45:35 idp_policy_loader_command: sc_klibs_subs_policy_pre_compile() returned -35 (EAGAIN) Jun 16 09:45:40 idp_policy_loader_command: sc_klibs_subs_policy_pre_compile() returned -35 (EAGAIN) Jun 16 09:45:45 idp_policy_loader_command: sc_klibs_subs_policy_pre_compile() returned 0 (EOK) Jun 16 09:45:45 idpd_policy_load: idp policy parser pre compile succeeded , after (3) retries Jun 16 09:45:45 idpd_policy_load: policy parser compile subs s0 name /var/db/idpd/bins/ last-good-policy.bin.gz.v.1 buf 0x0 size 0zones 0x1cf0e25 z_size 272 detector /var/db/idpd//bins/detector.so ai_buf 0x0 ai_size 0 ai idmap_buf 0x1ce0200 idmap_size 132 Jun 16 09:45:46 idp_policy_loader_command: sc_klibs_subs_policy_compile() returned 0 (EOK) Jun 16 09:45:46 idpd_policy_load: idp policy parser compile succeeded
On a logical system (LSYS), a single policy called idp-policy-combined will be created. This policy will contain all IDP policies (active, as well as configured). Due to installation of the policy template, the combined policy binary contains all policies in templates.xsl (such as Client-And-Server-Protection, DMZ_Services, Web_Server), although only the one policy will be active and inspected. This results in a policy binary which is very big, causing the policy push to the PFE to fail with a PFE heap allocation failure:
idp-policy-combined
templates.xsl
[Fri May 27 22:50:20 2016 LOG: Emergency] Scheduler Oinker [Fri May 27 22:50:20 2016 LOG: Emergency] Frame 00: sp = 0xa8f08310, pc = 0x20041b20 [Fri May 27 22:50:20 2016 LOG: Err] [Policy /var/db/idpd/bins/idp-policy-combined.bin.gz.v.1 load Failed] [Reason: Could not allocate the memory due to less available heap memory] [Fri May 27 22:50:20 2016 LOG: Info] [Possible Solution Please try to load small policy] [Fri May 27 22:50:20 2016 LOG: Err] usp_ipc_idp_ioctl_handler:424: sc_process_ioctl failed
To successfully compile the IDP policy, all the inactive IDP policies configured have to be deactivated.
deactivate security idp idp-policy Client-And-Server-Protection deactivate security idp idp-policy Client-And-Server-Protection-1G deactivate security idp idp-policy Client-Protection deactivate security idp idp-policy Client-Protection-1G deactivate security idp idp-policy DNS_Service deactivate security idp idp-policy File_Server deactivate security idp idp-policy Getting_Started deactivate security idp idp-policy IDP_Default deactivate security idp idp-policy DMZ_Services deactivate security idp idp-policy Server-Protection deactivate security idp idp-policy Server-Protection-1G deactivate security idp idp-policy Web_Server