When making changes to a security policy configuration, one of the below errors may be seen.

1. IPSec VPN ProxyId check failed for this policy

2. Internal error: policy VPN verification failed

3. Configuration check-out failed

Existing config:
set security policies from-zone TRUST to-zone UNTRUST policy policy_new match source-address 10.0.0.0/24
set security policies from-zone TRUST to-zone UNTRUST policy policy_new match destination-address 10.1.0.0/24
set security policies from-zone TRUST to-zone UNTRUST policy policy_new match application junos-https
set security policies from-zone TRUST to-zone UNTRUST policy policy_new match application junos-telnet

While modifying this as the below, mentioned errors are seen

user@srx# delete security policies from-zone TRUST to-zone UNTRUST policy policy_new match application junos-telnet
user@srx# show | compare
[edit security policies from-zone TRUST to-zone UNTRUST policy policy_new match]
- application [ junos-https junos-telnet ];
+ application junos-https;
user@srx# commit
configuration check-out failed
Error(s):
'policy policy_new, policy policy_new'

1) IPSec VPN ProxyId check failed for this policy
2) Internal error: policy VPN verification failed.
3) configuration check-out failed

This error occurs because a policy with the same source and destination addresses already exists in the current context. Junos does not allow the modification or addition of a new policy if it detects another policy with identical parameters (source and destination IP addresses) in place.

If a security policy with the same match criteria already exists from the same "from-zone" to the same "to-zone", there is no need of a duplicate policy.

To correct this, follow the below steps:

1. Identify the Conflicting Policy that has the same match parameters.

set security policies from-zone TRUST to-zone UNTRUST policy policy_old match source-address 10.0.0.0/24 -----> same source
set security policies from-zone TRUST to-zone UNTRUST policy policy_old match destination-address 10.1.0.0/24 -----> same destination
set security policies from-zone TRUST to-zone UNTRUST policy policy_old match application junos-https -----> same port after changing policy_new

2. Modify/Remove the Existing Policy.

delete security policies from-zone TRUST to-zone UNTRUST policy policy_old