This article explains how to fix if the preview changes job fails with the error "Error while converting rule: RULENAME of Policy: DeviceNAME. Error message: Tunnel referred by rule FROMZONE -> TOZONE:RULENAME not exist for device:DEVICENAME"
This issue will occur due to the following reasons:
To see the IPsec VPN assigned to the rule in Security Director, please navigate to Configure > Standard or Unified policies > Open the rules for the affected policy > Go to the problematic rule showing the preview error. You will see the VPN name under Tunnel as per the below screenshot:
Please check the solution section to fix this issue
Use case scenario 1:
If the policy-based VPN is assigned to only some rules, please import the IPsec VPN from Configure > IPSec VPN > IPSec VPNs > more > import VPN.
Once the VPNs are imported, please navigate to the firewall/Unified policy rule and assign the newly imported VPN.
Use case scenario 2:
If the policy-based VPN is assigned to lots of rules, please run the below MySQL query to map the tunnel backend:
mysql -ujboss -p$(grep mysql.jboss /etc/sysconfig/JunosSpace/pwd | awk -F= '{print $2}') sm_db -e "update DCRuleEntity set vpnEndPointMOID = (select id from IPSecVPNEndPointEntity where vpnNameInDevice='<TunnelName>' limit 1) where vpnTunnelName='<TunnelName>'"
Note: Please take the VM snapshot/Database backup before following the above step.
Use case scenario 3:
Check if the IPSec VPN is a Route-based VPN that is assigned to the Rule. If yes, the customer has to change from "Permit and Tunnel" to "Permit" in the action field on the Rule.
Note: Route-based VPN shouldn't be assigned to the policy Rule