This article explains why error messages may appear when executing the “commit check no-synchronize” command on an SRX device that is part of an MNHA cluster.

Please note that in SRX Multinode High Availability cluster, configuration synchronization does not happen by default. You need to configure applications as part of groups and then synchronize the configuration using the peer synchronization option or manage configuration independently on each node. Please check the "Configuration Synchronization Between Multinode High Availability Nodes" section from the Juniper Multinode High Availability Services Documentation located on the following link: https://www.juniper.net/documentation/us/en/software/junos/high-availability/topics/concept/mnha-services.html#xd_4ef6f23671faf559-e9abb87-181b4028117--7c23__section_rjc_yyz_t5b

An SRX MNHA cluster consists of SRX-1 as the primary for Services Redundancy Group 1 (SRG-1) and SRX-2 as the backup peer.

First, a new configuration file prepared in a set format is loaded:

[edit]

root@SRX-1# load set /var/tmp/new-config-set.txt 

load complete

After executing the "commit check no-synchronize" command, the following error is observed: 

[edit]
root@SRX-1# commit check no-synchronize 
error: HOST NAME : SRX-2 <<<
error: 

Can not find address/address-set(obj-192.168.2.0) in default global address book <<<
 : 
source-address-name obj-192.168.2.0

[edit groups GROUP1 security nat source rule-set GROUP1-RULE-SET rule GROUP1-RULE-1 match]
error: 
configuration check-out failed <<<
error: commit prepare on remote peers failed <<<
error: commit peers-synchronize failed <<<

By checking the configuration in the new-config-set.txt file that the customer is trying to load, we find the following two lines mentioning obj-192.168.2.0 that is displayed in the error message above:

set security address-book global address obj-192.168.2.0 192.168.2.0/24
set groups GROUP1 security nat source rule-set GROUP1-RULE-SET rule GROUP1-RULE-1 match source-address-name obj-192.168.2.0

The “commit check no-synchronize” command still performs a commit check on the other MNHA cluster node. However, since the new-config-set.txt file includes the configuration “set security address-book global address …” which is not part of a group configuration which is getting synchronized to the other node, but is required for the new config to commit successfully or is not already present on the remote node, the configuration check-out fails on the remote node.

There are multiple ways to avoid this:

1) Configure the global address object as part of a group configuration to ensure it is synchronized to the other MNHA peer: 

set groups GROUP1 security address-book global address obj-192.168.2.0 192.168.2.0/24

2) Configure the NAT rule to match the "source-address 192.168.2.0/24" instead of "source-address-name obj-192.168.2.0"

3) Pre-configure all the global address objects on the peer device..

Note: The "display detail" option can be used with the commit command to gather more useful information about the issue. The full command in that case would be "commit check no-synchronize | display detail"

Configuration Synchronization Between Multinode High Availability Nodes- https://www.juniper.net/documentation/us/en/software/junos/high-availability/topics/concept/mnha-services.html#xd_4ef6f23671faf559-e9abb87-181b4028117--7c23__section_rjc_yyz_t5b