Description

This is article explains how empty commit is behaving as commit full after system was upgraded to 22.4R3.25

Solution

Firewall process emitted below warning during commit check at the time of mgd initial commit.

During initial commit, all configuration bits are set as mark changed, so that all daemons read the full configuration for commit check and consume the relevant configs.
As part of same exercise, dfwd process emits below warning during commit check:
 
Creating initial configuration:  ...
Firewall process: <xnm:warning xmlns="http://xml.juniper.net/xnm/1.1/xnm" xmlns:xnm="http://xml.juniper.net/xnm/1.1/xnm">
Firewall process: <source-daemon>dfwd</source-daemon>
Firewall process: <message>'icmp' protocol is not recommended for 'inet6' family.</message>
Firewall process: </xnm:warning>
 
 
Warning comes due to below incorrect configuration:
set firewall family inet6 filter <filter-name> term <term-name> from next-header icmp
 
And due to that, change bits are not reset appropriately, resulting into all further commits turning into a commit full.

Modification History

2024-07-09 : Article Created