This article explains that a firewall policy job may fail with a DCS error because some applications are no longer supported for use as dynamic-application match criteria.

You may observe the following error:

Error:
<commit-results>
<nc:rpc-error>
<nc:error-type>protocol</nc:error-type>
<nc:error-tag>operation-failed</nc:error-tag>
<nc:error-severity>error</nc:error-severity>
<source-daemon>
none
</source-daemon>
<nc:error-path>
[edit security policies from-zone Juniper-CORP-LAN to-zone untrust-WAN_0 policy Employee_Access]
</nc:error-path>
<nc:error-info>
<nc:bad-element>
match
</nc:bad-element>
</nc:error-info>
<nc:error-message>
The legacy dynamic-application (junos:SMTPS) can't be configured. HTTPS/IMAPS/POP3S/SMTPS have been removed from this release.
</nc:error-message>
</nc:rpc-error>
<nc:rpc-error>
<nc:error-type>protocol</nc:error-type>
<nc:error-tag>operation-failed</nc:error-tag>
<nc:error-severity>error</nc:error-severity>
<nc:error-message>
configuration check-out failed
</nc:error-message>
</nc:rpc-error>
</commit-results>

As per Unified Security Policies, the applications, HTTPS/IMAPS/POP3S/SMTPS, have been removed from Junos OS and therefore, cannot be assigned to a firewall policy as dynamic-applications match criteria starting in Junos OS Releases 19.4R1 and 20.1R1.

Consequently, you will have to remove these applications from the firewall policy; you can add the required services (SVCS) for any  services instead of APPS.

Note: As per CSO, APPS defines L7 applications and SVCS is related to layer 4 services.

2024-01-02 : Article Created