This article explains why an application policy configured on MIST is not being pushed to SRX.

The application policy is configured in the MIST UI but is not being pushed to the SRX device.

For example, In the MIST UI, the application policy lan_ISP is configured, as shown below:

However, no security policy with lan_ISP is being applied to the SRX device. This can be verified with the following commands:

mist@SRX> show security policies policy-name lan_ISP

Additionally, checking the configuration does not display any matching entries for lan_ISP:

mist@SRX> show configuration | display set | match lan_ISP

This issue occurs when network mapping in the security policy is not configured under the LAN section of the device. To create a security policy on an SRX device, the from-zone is required. If the network is not mapped to any LAN interface, Mist will be unable to identify the from-zone, causing the security policy configuration to fail to push.

To resolve this issue:

1. Verify that the network configured in the LAN section is also mapped to the application policy.
2. Ensure that the full network name matches exactly, as it is case-sensitive.

In the symptoms section above, the security policy failed to create due to a case sensitivity mismatch. The network mapped to the LAN was named "LAN" (uppercase), while the network mapped to the application policy was "lan" (lowercase), causing the configuration to fail.

Note: If you have multiple networks and security policies, use the following API to identify all configuration errors at the bottom section of the response:

https://api.mist.com/api/v1/sites/<site-id>/devices/00000000-0000-0000-1000-<device-mac>/config_cmd