Article Detail

Description

This article describes an issue where deleting a security policy from Security Director fails when only a single policy exists in the policy context (from-zone to to-zone).

Symptoms

Deleting a security policy from Security Director fails when there is only one policy in the policy context.
Security Director reports a configuration update failure.
The issue is observed on Junos 21.2R3-S6.11.

There is only one security policy in the context (from-zone and to-zone) on SRX as below.

set security policies from-zone trust to-zone trust policy default-permit match application any
set security policies from-zone trust to-zone trust policy default-permit match destination-address any
set security policies from-zone trust to-zone trust policy default-permit match source-address any
set security policies from-zone trust to-zone trust policy default-permit then permit

Security Director uses the below two commands in RPC format to delete the security policy if there is only one policy in the policy context. This is expected by design.

delete security policies from-zone trust to-zone trust policy default-permit
delete security policies from-zone trust to-zone trust

Security Director reports the following error:

[Error] Configuration update failed. 
Severity : error 
           At : [edit security policies] 
Message : statement not found: from-zone trust to-zone trust

Note: This issue is not occurring on Junos 21.4R2.10 even with same delete CLI command in preview operation.

Please find below netconf trace-option traces for working and non working Junos device

>> Non-Working Device: Junos: 21.2R3-S6.11

Dec 27 09:48:19 [NETCONF] - [17398] Incoming: <?xml version="1.0" encoding="UTF-8"?><rpc message-id="1"><edit-config><target><candidate/></target><default-operation>merge</default-operation><error-option>stop-on-error</error-option><config><configuration>
<security>
<policies>
<policy>
<from-zone-name>trust</from-zone-name>
<to-zone-name>trust</to-zone-name>
<policy operation="delete">
<name>default-permit</name>
</policy>
</policy>
</policies>
</security>
<security><policies><policy operation="delete"><from-zone-name>trust</from-zone-name><to-zone-name>trust</to-zone-name></policy></policies></security></configuration></config></edit-config></rpc>
]]>]]>
Dec 27 09:48:19 [NETCONF] - [17398] Outgoing: <rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns:junos="http://xml.juniper.net/junos/21.2R0/junos" message-id="1"
Dec 27 09:48:19 [NETCONF] - [17398] Outgoing: <rpc-error>
Dec 27 09:48:19 [NETCONF] - [17398] Outgoing: <error-type>application</error-type>
Dec 27 09:48:19 [NETCONF] - [17398] Outgoing: <error-tag>data-missing</error-tag>
Dec 27 09:48:19 [NETCONF] - [17398] Outgoing: <error-severity>error</error-severity>
Dec 27 09:48:19 [NETCONF] - [17398] Outgoing: <error-path>[edit security policies]</error-path>
Dec 27 09:48:19 [NETCONF] - [17398] Outgoing: <error-message>statement not found: from-zone trust to-zone trust</error-message>
Dec 27 09:48:19 [NETCONF] - [17398] Outgoing: </rpc-error>
Dec 27 09:48:19 [NETCONF] - [17398] Outgoing: </rpc-reply>
Dec 27 09:48:19 [NETCONF] - [17398] Outgoing: ]]>]]>
Dec 27 09:48:19 [NETCONF] - [17398] Incoming: <?xml version="1.0" encoding="UTF-8"?><rpc message-id="1"><unlock><target><candidate/></target></unlock></rpc>
]]>]]>
Dec 27 09:48:19 [NETCONF] - [17398] Outgoing: <rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns:junos="http://xml.juniper.net/junos/21.2R0/junos" message-id="1">
Dec 27 09:48:19 [NETCONF] - [17398] Outgoing: <ok/>
Dec 27 09:48:19 [NETCONF] - [17398] Outgoing: </rpc-reply>
Dec 27 09:48:19 [NETCONF] - [17398] Outgoing: ]]>]]>
Dec 27 09:48:20 [NETCONF] - [17398] Incoming: <rpc><close-session/></rpc>]]>]]>

Working device | Junos-21.4R2.10

Dec 27 04:28:09 [NETCONF] - [98254] Incoming: <?xml version="1.0" encoding="UTF-8"?><rpc message-id="1"><edit-config><target><candidate/></target><default-operation>merge</default-operation><error-option>stop-on-error</error-option><config><configuration>
Dec 27 04:28:09 [NETCONF] - [98254] Incoming: <?xml version="1.0" encoding="UTF-8"?><rpc message-id="1"><edit-config><target><candidate/></target><default-operation>merge</default-operation><error-option>stop-on-error</error-option><config><configuration>
<security>
<policies>
<policy>
<from-zone-name>trust</from-zone-name>
<to-zone-name>trust</to-zone-name>
<policy operation="delete">
<name>default-permit</name>
</policy>
</policy>
</policies>
</security>
<security><policies><policy operation="delete"><from-zone-name>trust</from-zone-name><to-zone-name>trust</to-zone-name></policy></policies></security></configuration></config></edit-config></rpc>
]]>]]>
Dec 27 04:28:09 [NETCONF] - [98254] Outgoing: <rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns:junos="http://xml.juniper.net/junos/21.4R0/junos" message-id="1">
Dec 27 04:28:09 [NETCONF] - [98254] Outgoing: <rpc-error>
Dec 27 04:28:09 [NETCONF] - [98254] Outgoing: <error-severity>warning</error-severity>
Dec 27 04:28:09 [NETCONF] - [98254] Outgoing: <error-path>[edit security policies]</error-path>
Dec 27 04:28:09 [NETCONF] - [98254] Outgoing: <error-message>statement not found: from-zone trust to-zone trust</error-message>
Dec 27 04:28:09 [NETCONF] - [98254] Outgoing: </rpc-error>
Dec 27 04:28:09 [NETCONF] - [98254] Outgoing: </rpc-reply>
Dec 27 04:28:09 [NETCONF] - [98254] Outgoing: ]]>]]>
Dec 27 04:28:09 [NETCONF] - [98254] Incoming: <?xml version="1.0" encoding="UTF-8"?><rpc message-id="1"><commit-configuration><log>SD Update -%jobId:2228278%spaceUser:super%crId:118%changeType:inband%moduleName:SD%</log></commit-configuration></rpc>
]]>]]>
Dec 27 04:28:09 [NETCONF] - [98254] Outgoing: <rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns:junos="http://xml.juniper.net/junos/21.4R0/junos" message-id="1">
Dec 27 04:28:11 [NETCONF] - [98254] Outgoing: <ok/>
Dec 27 04:28:11 [NETCONF] - [98254] Outgoing: </rpc-reply>
Dec 27 04:28:11 [NETCONF] - [98254] Outgoing: ]]>]]>

Netconf trace-option logs shows the following difference:

On affected device, the outgoing Netconf response reports Severity: error.
On working device, the same condition is reported as Severity: warning.

Because the affected device returns an error severity, Security Director marks the job as failed.

Solution

To address the device behavior change, Security Director engineering implemented code enhancements to prevent update job failures.

Security Director now generates only a single delete operation when removing the last zone-based security policy rule, instead of issuing two delete commands.

This fix is included in Security Director 23.1R1 (V4 hotpatch).

Modification History

2024-03-03 : Article Published

2025-02-24 : Added link to release notes and PR note