On SRX Series devices, In Chassis Cluster, when security alg trace options are deactivated together as part of single commit, it causes the entire security hierarchy to get deactivated.
 

- SRX devices in Chassis Cluster having security alg trace options configured.
- Triggered by deactivating the ALG, alg-support-library, alg-manager traceoptions together in single commit.

{primary:node0}
user@router# show | display set | match traceoptions

set security alg traceoptions file sip-alg-trace
set security alg traceoptions file size 10m
set security alg traceoptions file files 5
set security alg traceoptions level verbose
set security alg alg-manager traceoptions flag all
set security alg alg-support-lib traceoptions flag all
set security alg <sip|ftp...> traceoptions flag all

when the above mentioned traceoptions are deactivated together as part of single commit.

{primary:node0}
user@router# show | display set | match deactivate

deactivate security alg alg-manager traceoptions
deactivate security alg alg-support-lib traceoptions
deactivate security alg <sip|ftp...> traceoptions
deactivate security alg traceoptions

/config/juniper.conf:288:(42) syntax error: traceoptions
  [edit security alg alg-manager]
    'alg-manager inactive: traceoptions flag all;'
      syntax error
[edit security alg]
  'alg-manager'
    warning: statement has no contents; ignored
[edit security alg]
  'alg-support-lib'
    warning: statement has no contents; ignored
load complete (1 errors)

{primary:node0}[edit]
user@router# commit
warning: You have changed enhanced services mode.
You must reboot the system for your change to take effect.
If you have deployed a cluster, be sure to reboot all nodes.
node0:
commit complete

{primary:node0}[edit]
user@router# show security
##
## inactive: security
##

commit

It causes the entire security hierarchy to get deactivated.

{primary:node0}[edit]
user@router# show | display set | match deactivate 
     
deactivate chassis cluster redundancy-group 1 interface-monitor
deactivate security idp
deactivate security alg traceoptions
deactivate security alg sip traceoptions
deactivate security flow traceoptions
deactivate security nat destination rule-set PAT rule WASP
deactivate security nat proxy-arp interface reth4.0
deactivate security zones security-zone Private interfaces reth4.0
deactivate security <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
deactivate interfaces reth4




 

If user deletes the trace options instead of deactivating it, then the deactivation of security stanza is not seen OR if the user follow the commit at every step after running one by one command, like below example then also issue {deactivation of security stanza} not seen.

deactivate security alg alg-manager traceoptions------>Commit
deactivate security alg alg-support-lib traceoptions------>Commit
deactivate security alg <sip|ftp...> traceoptions------>Commit
deactivate security alg traceoptions------->Commit

Note: This is an expected behavior for now and need to follow workaround solution mentioned to avoid the issue.

PR   : 1482426 [single-source-commit] - When deactivating ALG trace options it also deactivates the security stanza