Description

This article applies to CSO version 6.3

An sdwan policy deployment failed with the following error message:

'Error while deploying the device configuration'

Symptoms

Error from CSO SDWAN policy deployment job logs:

Jan 31, 2023, 7:48:37 AMGathering the configuration
Jan 31, 2023, 7:48:37 AMInitiating the deployment on device
Jan 31, 2023, 7:48:37 AMComputing the diff with the previous rules.
Jan 31, 2023, 7:48:37 AMInitiating the rule ordering algorithm.
Jan 31, 2023, 7:48:42 AMRule ordering is complete.
Jan 31, 2023, 7:48:42 AMFinalizing the configuration.
Jan 31, 2023, 7:48:53 AMDevice deployment started.
Jan 31, 2023, 7:49:01 AMDevice deployment in progress.
Jan 31, 2023, 7:49:08 AMError while deploying the device configuration, trying to restore previous config

 

After further log analysis in CSO, the below error was found from a microservice named config-service:

detail": "<nc:rpc-reply xmlns:nc=\"urn:ietf:params:xml:ns:netconf:base:1.0\" xmlns:junos=\http://xml.juniper.net/junos/20.4R0/junos\\ message-id=\"101\">\nnc:rpc-error\nnc:error-typeprotocol</nc:error-type>\nnc:error-tagoperation-failed</nc:error-tag>\nnc:error-severityerror</nc:error-severity>\n<source-daemon>\nmgd\n</source-daemon>\nnc:error-path\n[edit applications application VN_IPT_Ports]\n</nc:error-path>\nnc:error-info\nnc:bad-element\nterm\n</nc:bad-element>\n</nc:error-info>\nnc:error-message\nnumber of elements exceeds limit of 8\n</nc:error-message>\n</nc:rpc-error>\nnc:rpc-error\nnc:error-typeprotocol</nc:error-type>\nnc:error-tagoperation-failed</nc:error-tag>\nnc:error-severityerror</nc:error-severity>\nnc:error-message\ncommit failed: (number of elements exceeds limit)\n</nc:error-message>\n</nc:rpc-error>\n</nc:rpc-reply>\n]]>]]>\
 

The log above points to a custom application called “VN_IPT_Ports”, which was user-configured and it was returning the error that “nnumber of elements exceeds limit of 8”

 

Additional investigation found that there were 10 terms inside the application definition configured in the CSO GUI.
As per Junos, only 8 terms should be configured inside a custom application. This means the user was reaching a device limitation.

<applications>
                <application >
                                <name>VN_IPT_Ports</name>
                                <term>
                                                <name>5001-tcp</name>
                                                <protocol>tcp</protocol>
                                                <destination-port>5001</destination-port>
                                </term>
                                <term>
                                                <name>443-tcp</name>
                                                <protocol>tcp</protocol>
                                                <destination-port>443</destination-port>
                                </term>
                                <term>
                                                <name>5015-tcp</name>
                                                <protocol>tcp</protocol>
                                                <destination-port>5015</destination-port>
                                </term>
                                <term>
                                                <name>2528-tcp</name>
                                                <protocol>tcp</protocol>
                                                <destination-port>2528</destination-port>
                                </term>
                                <term>
                                                <name>5090-tcp</name>
                                                <protocol>tcp</protocol>
                                                <destination-port>5090</destination-port>
                                </term>
                                <term>
                                                <name>5060-5061-tcp</name>
                                                <protocol>tcp</protocol>
                                                <destination-port>5060-5061</destination-port>
                                </term>
                                <term>
                                                <name>5060-udp</name>
                                                <protocol>udp</protocol>
                                                <destination-port>5060</destination-port>
                                </term>
                                <term>
                                                <name>5090-udp</name>
                                                <protocol>udp</protocol>
                                                <destination-port>5090</destination-port>
                                </term>
                                <term>
                                                <name>9000-10999-udp</name>
                                                <protocol>udp</protocol>
                                                <destination-port>9000-10999</destination-port>
                                </term>
                                <term>
                                                <name>7000-8999-udp</name>
                                                <protocol>udp</protocol>
                                                <destination-port>7000-8999</destination-port>
                                </term>
                </application>
</applications>

Solution

To resolve this issue reduce the terms to 8 and deploy the policy again.
After making the suggested changes, sdwan policy was deployed without any issues.

Modification History

.