Description

While pushing security policies on the firewall cluster through Junos Space, we could see that the policies are not being pushed on to both nodes, they are only being pushed on the primary node, not the secondary.

Symptoms

While trying to commit configuration, secondary noder prints the following logs: 
messages:Dec 25 14:36:12 xxxxxxxxxx idpd[54420]: Attack HTTP:APACHE:LOG4J-JNDI-MGNR-RCE does not belong to the current platform version

And commit error is seen on the screen: 
{primary:node0}[edit]
root@SRX5k# commit 
node0: 
configuration check succeeds
node1: 
[edit security idp idp-policy MY_IDP_POLICY rulebase-ips rule TEST match attacks]
  'predefined-attacks HTTP:APACHE:LOG4J-JNDI-MGNR-RCE'
     Attack HTTP:APACHE:LOG4J-JNDI-MGNR-RCE will not be added to the compiled policy.
error: configuration check-out failed
node0: 
error: remote commit-configuration failed on node1
error: commit failed

Solution

In some rare cases there will be IDP out of sync between the nodes. To resolve such situation, we need to:
  1. Disable IDP configuration which contains the logged (in messages log) attacks, like "rule TEST" above as it contains "HTTP:APACHE:LOG4J-JNDI-MGNR-RCE" + commit the configuration.
  2. Once done, install the full IDP security package with: "request security idp security-package download full-update" and "request security idp security-package install".
  3. Enable the IDP configuration part that you had disabled (in our example - "rule TEST").
  4. Further commits should not throw a commit failure.

Modification History

2024-01-15 : Article Created