This article explains how to find RCA if there is an outage occurring in the Network by pushing the policy from the Security Director to the SRX

To identify the cause, please run the below command from SRX:

> show system commit

0 2024-09-09 16:24:49 NZST by USER via netconf

  SD Update -%jobId:4522061%spaceUser:SpaceUSER%crId:66242%changeType:inband%moduleName:SD%nodeId:node1%

1 2024-09-09 15:12:00 NZST by USER via synchronize

  SD Update -%jobId:4522011%spaceUser:SpaceUSER%crId:66233%changeType:inband%moduleName:SD%nodeId:node0%

Based on the time when the issue occurred, please confirm if it is showing "by USER via netconf". That means the configuration changes are done by Space. If it is showing "by USER via cli", it means it is done via CLI.

Collect the JobID from the above output and search for it under Monitor > Job management in SD. Once open the Job, you will be able to see the configuration changes pushed to the device

Suppose you see any deletion in the preview from the Job. You can confirm that the customer has made some unwanted changes which caused a production impact.

If it is deleting all rules even if the customer has done publish before the update, the RCA is stated below:

SD will show bad preview changes when the device configuration is not fully synchronized with the database. This issue will occur when the device is not responding to the sync request sent by the Junos space or is missed somewhere in the network.

Note: This is a rare situation that is not reproducible in the Lab. To avoid such issues in the future, please check the preview changes before doing the update on the SRX. If you are seeing the bad preview, please do resync with network on the device or a commit on SRX will also do the same.