Sometimes, SD will try to push the application-traffic-control configuration to the device that already exists in the device. This article explains how to fix the issue.
You will see the below configuration in the preview:
set security policies global policy RULENAME then permit application-services application-traffic-control rule-set RULESETNAME
The Policy update will fail with the error "statement creation failed"
This issue was observed in 24.1 when the customer used the template option in the policy profile with application-traffic-control configuration in 23.1 and upgraded
Please run the below command to find the delta that is causing the problem:
mysql -ujboss -p$(grep mysql.jboss /etc/sysconfig/JunosSpace/pwd | awk -F= '{print $2}') sm_db -e "select policyOptionsConfigXML from PolicyOptionsCMEntity where sdDeviceCM_id in (select id from SDDeviceCMEntity where name='<SRX Device name>')"
mysql: [Warning] Using a password on the command line interface can be insecure.
+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| policyOptionsConfigXML |
| <options><global>
<policy>
<name>$(fw-rule-name)</name>
<then>
<permit>
<application-services>
<application-firewall>
<rule-set>Client-to-internet_appfw</rule-set>
</application-firewall>
<application-traffic-control>
<rule-set>RULESETNAME</rule-set>
</application-traffic-control>
</application-services>
</permit>
</then>
</policy>
</global></options> |
Please reach out to JTAC to remove the highlighted entry in the MySQL table.