Description

Customer dont have App DB license and the Default Template pushes dynamic-application config parameter along with the Security Policy.
This config line (dynamic-application) needed to be removed from each Security Policy.

Symptoms

This could result in incorrect policy match and due to which, could cause NAT issues or any feature which is tied to policy match results.

Solution

As customer don't have App DB license and no App DB installed, SRX is unaware or unable to detect the Dynamic Applications.
The Default Template always pushed "dynamic-application" config parameter along with the Security Policy.

In order to remove this config line, we can use the "Additional CLI Commands for SRX" under "CLI CONFIGURATION".

Please note that, wildcards are not supported while trying to use *(star) for security zones (from-zone * to-zone *).
Currently we don't have any API calls to edit the Template for for achieving this.

Individual config line needs to be configured for each security policy under "Additional CLI Commands for SRX"

Example config : delete security security policies from-zone trust to-zone untrust policy TEST match dynamic-application

Modification History

2024-07-26 : Article Created