This article defines a scenario wherein a customer defines a custom service in Contrail Service Orchestration (CSO) and attaches this service to a policy for deployment. However, the deployment fails on the virtualized network function (VNF) (SRX in this case).

The article clarifies that the error is due to "junos" being a reserved identifier and recommends using acceptable input names while defining a custom service to avoid deployment failure.

The CSO firewall policy deployment fails with the following error when the CSO job is inspected for errors:

error-severity>\n<nc:error-message>cannot use reserved identifier</nc:error-message>\n<nc:error-info>\n<nc:bad-element>junos-netbios-datagram</nc:bad-element>\n</nc:error-in

As per the configuration for the job specified above, we see the following configuration rendered and being pushed to the VNF:

set applications application netbios-datagram term junos-netbios-datagram protocol udp
set applications application netbios-datagram term junos-netbios-datagram destination-port 138
set applications application netbios-datagram term junos-netbios-datagram alg netbios

Similarly, when you try to manually configure the same from the CLI of the VNF, you see the same error message:

{primary:node0}[edit]
[email protected]# set applications application netbios-datagraam term junos-netbios-datagram protocol udp   
error: cannot use reserved identifier: junos-netbios-datagram

The error is because the keyword "junos-" is a reserved keyword that is being used by the service definition under junos-defaults. Therefore, in order to create a custom service, you will need to choose a name other than one that starts with "junos-".

However, if you want to specifically use junos, you can try tweaking the first letter "j" to uppercase, which may be accepted as a name, that is, Junos-netbios-datagram.

Note: This is a VNF-specific validation that has not yet been added to the CSO UI input as of CSO 6.2 version. Users, therefore, need to be create input names carefully to avoid deployment failures.

2022-06-30: Initial version