This article explains the cause and provides the solution for resolving the firewall policy preview failure that occurs when duplicate or stale rule entries are found in the Security Director database.

When attempting to preview a firewall policy during publishing, the following error is displayed:

Error while converting rule: xxxx of Policy: xxxx. Error message: Rule Name xxxx already exists for device policy from zone ABC to zone XYZ. 

IMPORTANT: Before making any database changes, verify whether multiple policies are assigned to the device. This is the most common cause of this error. Remove unnecessary policy assignments using the web UI first.

This issue occurs when stale policy entries remain in the Junos Space database.

Step 1: Unassign the policy

Unassign the affected policy from the device through the Security Director UI

Step 2: Identify and remove stale database entries

Log in to the Junos Space CLI and access the MySQL database:

[root@space-005056a9eca5 ~]# mysql -ujboss -p$(grep mysql.jboss /etc/sysconfig/JunosSpace/pwd | awk -F= '{print $2}')

mysql> use sm_db;

mysql> select * from SDDeviceCMEntity where name="SRX300";

Replace SRX300 with your device name and record the ID of value from the output. 

Use the ID from the previous step:

mysql> select * from SDDeviceCMEntity_PolicyCMEntity where SDDeviceCMEntity_id="172637";

Example output:

+---------------------+-----------+
| SDDeviceCMEntity_id | policy_id |
+---------------------+-----------+
|              172637 |    303453 |
|              172637 |    399360 |
|              172637 |   8847783 |
|              172637 |  10133280 |
|              172637 |  11108352 |
+---------------------+-----------+
5 rows in set (0.01 sec)

Delete all listed entries to remove stale policy assignments:

mysql> delete from SDDeviceCMEntity_PolicyCMEntity where SDDeviceCMEntity_id="172637";

Attention: For cluster devices, repeat the checks and deletion for each node.

Step 3: Reassign the policy

Assign the firewall policy back to the device and re-check the policy preview.

Note : If the issue persists, please contact JUNIPER JTAC Support for assistance.