This KB article is designed to guide users in resolving a commit error encountered during the configuration process. The error, which will be specified below, can hinder the successful application of changes. This article provides comprehensive, step-by-step instructions to effectively address the issue and enable users to proceed with the commit process seamlessly.

# commit check

node1:

configuration check succeeds

node0:

[edit security policies from-zone trust to-zone untrust]

'policy allow-all'

Dynamic application or group (junos:TEAMVIEWER) not found. >>> could be that dynamic application or any other

[edit security policies from-zone trust to-zone untrust]

'policy allow all'

Internal error: policy dynamic application verification failed.

error: configuration check-out failed

node1:

error: remote commit-configuration failed on node0

error: configuration check-out failed

This commit error is typically observed in a Chassis Cluster setup and manifests in the following ways:

• Inability to Commit Changes Involving Dynamic Applications:
  • Users may encounter difficulties committing any configuration changes that involve dynamic applications. This includes but is not limited to modifications in application signatures, policies, or settings related to dynamic applications.
• Global Impact on Commit Process:
  • When a policy with dynamic applications is already present, attempting to commit changes unrelated to dynamic applications also results in an error. This global impact can impede the commitment of various configuration changes.
• Node Discrepancy in Loading Application Database:
  • It is essential to check if both nodes are loading the applications referenced in the configuration. Utilizing the command >show services application-identification application summary can reveal any disparities. If one of the nodes isn't showing any apps listed, it might indicate that the respective node isn't loading the application database, contributing to commit errors and configuration inconsistencies.

To address the commit error related to dynamic applications and ensure consistent application identification across both nodes in the Chassis Cluster setup, follow these steps:

• Download the Latest Application Identification Package:
  • Use the following documentation to download and install the Application Identification Package: KB23416 - [SRX] Application identification package automatic synchronization in chassis cluster [juniper.net]
• Verification:
  • After the update, use the command >show services application-identification application summary to confirm that both nodes are loading the applications as expected.
• Commit Changes:
  • Once the application identification package is successfully updated on both nodes, attempt to commit the configuration changes again. The commit process should proceed without encountering errors related to dynamic applications.

By following these steps, you ensure that the Chassis Cluster nodes are synchronized with the latest application identification package, resolving the commit error and allowing for smooth configuration updates.

https://supportportal.juniper.net/s/article/SRX-Application-identification-package-automatic-synchronization-in-chassis-cluster