SRX Admin upgrades to Junos 21.4R3-S4.9 and the Unified Security Policy stopped working. The blocking is not happening as per the policy config. As a result, Useful applications like microsoft-update and icmp are getting blocked even if it's not defined in the block policy.

Post upgrading to Junos 21.4R3-S4.9, the Unified Security Policy stops working and the filtering does not work as expected or configured.

Cause:

The dynamic-application Group ID is considered along with the Application ID for dynamic-application lookup.

Example:

ICPMP:

Head-> Prefix:(70/32/4) Count: (1)       Flags: (0x00000040)     Type: (dynamic-application)     Ptr: (0x1c18ea8c0)
                        dynamic-application-name: junos:ICMP
                        Data: Position Id: (15) reference count: (1) explicit

And its Group ID is:

   Dynamic Application Group - Id:(70), Appl Count:(7) - ICMP - junos:web:remote-access:interactive-desktop
   Dynamic Application Group - Id:(48), Appl Count:(1) - GARP - junos:web:proxy

Fixed Junos : 23.2R2-S3 24.2R2 24.4R2 25.1R1


From the above fixed Junos releases and higher, the group IDs are made to be a part of the lookup information.