Description

This article confirms that even after renaming an address object, the security policy still references the old unexisting object.

Symptoms

Even after renaming an address object, the security policy still references the old unexisting object.
 

1. Change the name of the address object

[edit security zones security-zone untrust address-book]
root@jtac-srx# rename address internet to address wifi ----> Changing the address book name from internet to wifi.

[edit security zones security-zone untrust address-book]
root@jtac# show
address wifi 192.168.168.168/32; ----> The address book's name has changed to wifi

2. Commit the configuration after changing the address object name

[edit]
root@jtac# commit
[edit security policies from-zone untrust to-zone trust]
'policy internet'
warning: Source address or address_set (internet) not found. Please check if it is a SecProfiling Feed.

commit complete

---> This indicates that the specified address object "internet" is not defined.

3. Upon checking the address objects and security policy config after the commit.

root@jtac-srx> show configuration security policies from-zone untrust to-zone trust policy policy_ internet | display set
set security policies from-zone untrust to-zone trust policy policy_ internet match source-address internet ---> The old name is still used in the security policy address book.
set security policies from-zone untrust to-zone trust policy policy_ internet match destination-address any
set security policies from-zone untrust to-zone trust policy policy_ internet match application any
set security policies from-zone untrust to-zone trust policy policy_ internet then permit

root@jtac-srx> show configuration security zones security-zone untrust address-book | display set
set security zones security-zone untrust address-book address wifi 192.168.1.10/32 ---> The address book's name has been changed.

Solution

The rename command will only change the name in the address book/object. It will require a manual change in other configurations (like security policies/NAT) where the address object/book is referred. 

[edit security zones security-zone untrust address-book]
root@jtac-srx# rename address internet to address wifi 

[edit security policies from-zone untrust to-zone trust policy policy_ internet]
root@jtac-srx# delete match source-address internet 
root@jtac-srx# set match source-address wifi

[edit]
root@jtac# commit-and-quit
commit complete


root@jtac-srx> show configuration security policies from-zone untrust to-zone trust policy policy_ internet | display set
set security policies from-zone untrust to-zone trust policy policy_ internet match source-address wifi
set security policies from-zone untrust to-zone trust policy policy_ internet match destination-address any
set security policies from-zone untrust to-zone trust policy policy_ internet match application any
set security policies from-zone untrust to-zone trust policy policy_ internet then permit

root@jtac-srx> show configuration security zones security-zone untrust address-book | display set
set security zones security-zone untrust address-book address wifi 192.168.1.10/32


Use the command "replace" instead of "rename" at the top of the hierarchy. This will change the address book/object's name throughout the configuration.

[edit]
root@jtac-srx# replace pattern internet with wifi 

[edit]
root@jtac# commit-and-quit
commit complete


root@jtac-srx> show configuration security policies from-zone untrust to-zone trust policy policy_ internet | display set
set security policies from-zone untrust to-zone trust policy policy_ internet match source-address wifi
set security policies from-zone untrust to-zone trust policy policy_ internet match destination-address any
set security policies from-zone untrust to-zone trust policy policy_ internet match application any
set security policies from-zone untrust to-zone trust policy policy_ internet then permit

root@jtac-srx> show configuration security zones security-zone untrust address-book | display set
set security zones security-zone untrust address-book address wifi 192.168.1.10/32

Modification History

2024-08-30 : Article Created

Related Information

https://www.juniper.net/documentation/us/en/software/junos/security-policies/topics/topic-map/security-address-books-sets.html