This article confirms that even after renaming an address object, the security policy still references the old unexisting object.
Even after renaming an address object, the security policy still references the old unexisting object.
1. Change the name of the address object[edit security zones security-zone untrust address-book]root@jtac-srx# rename address internet to address wifi ----> Changing the address book name from internet to wifi.[edit security zones security-zone untrust address-book]root@jtac# showaddress wifi 192.168.168.168/32; ----> The address book's name has changed to wifi2. Commit the configuration after changing the address object name[edit]root@jtac# commit[edit security policies from-zone untrust to-zone trust]'policy internet'warning: Source address or address_set (internet) not found. Please check if it is a SecProfiling Feed.commit complete---> This indicates that the specified address object "internet" is not defined.3. Upon checking the address objects and security policy config after the commit.root@jtac-srx> show configuration security policies from-zone untrust to-zone trust policy policy_ internet | display setset security policies from-zone untrust to-zone trust policy policy_ internet match source-address internet ---> The old name is still used in the security policy address book.set security policies from-zone untrust to-zone trust policy policy_ internet match destination-address anyset security policies from-zone untrust to-zone trust policy policy_ internet match application anyset security policies from-zone untrust to-zone trust policy policy_ internet then permitroot@jtac-srx> show configuration security zones security-zone untrust address-book | display setset security zones security-zone untrust address-book address wifi 192.168.1.10/32 ---> The address book's name has been changed.
The rename command will only change the name in the address book/object. It will require a manual change in other configurations (like security policies/NAT) where the address object/book is referred. [edit security zones security-zone untrust address-book]root@jtac-srx# rename address internet to address wifi [edit security policies from-zone untrust to-zone trust policy policy_ internet]root@jtac-srx# delete match source-address internet root@jtac-srx# set match source-address wifi[edit]root@jtac# commit-and-quitcommit completeroot@jtac-srx> show configuration security policies from-zone untrust to-zone trust policy policy_ internet | display setset security policies from-zone untrust to-zone trust policy policy_ internet match source-address wifiset security policies from-zone untrust to-zone trust policy policy_ internet match destination-address anyset security policies from-zone untrust to-zone trust policy policy_ internet match application anyset security policies from-zone untrust to-zone trust policy policy_ internet then permitroot@jtac-srx> show configuration security zones security-zone untrust address-book | display setset security zones security-zone untrust address-book address wifi 192.168.1.10/32Use the command "replace" instead of "rename" at the top of the hierarchy. This will change the address book/object's name throughout the configuration.[edit]root@jtac-srx# replace pattern internet with wifi [edit]root@jtac# commit-and-quitcommit completeroot@jtac-srx> show configuration security policies from-zone untrust to-zone trust policy policy_ internet | display setset security policies from-zone untrust to-zone trust policy policy_ internet match source-address wifiset security policies from-zone untrust to-zone trust policy policy_ internet match destination-address anyset security policies from-zone untrust to-zone trust policy policy_ internet match application anyset security policies from-zone untrust to-zone trust policy policy_ internet then permitroot@jtac-srx> show configuration security zones security-zone untrust address-book | display setset security zones security-zone untrust address-book address wifi 192.168.1.10/32
https://www.juniper.net/documentation/us/en/software/junos/security-policies/topics/topic-map/security-address-books-sets.html