6

I have two Juniper SRX240's in a cluster. After re-ordering some security policies on the primary device and committing them ok I now can not make any other changes without the warning

error: Policy is out of sync between RE and PFE cluster1.node1. Please resync before commit.

error: configuration check-out failed

I have found this KB article http://kb.juniper.net/InfoCenter/index?page=content&id=KB25143&smlogin=true and I have rebooted both of the nodes (multiple times now) and they are still out of sync.

I found out about a command "commit synchronize force" but that won't work on a SRX 240.

Does anyone know how I can force a resync of these two devices? They are currently live so I can't keep rebooting them in the middle of the day.

I am running version: JUNOS 12.1R6.5

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Jan 5, 2021 at 1:29

2 Answers 2

3

You description is implying the issue is between the primary and secondary nodes, but the article is referencing an out of sync between the Control Plane and Data Plane ( or Routing Engine and Packet Forwarding Engine.

If it is indeed the PFE out of Sync you might also try the hidden command 'commit full'.

I know I had an issue where my 2 routing engines were out of sync. I don't recall if it was on a cluster SRX or something like a VC switch or dual RE router. In my case it was because I had issued a 'commit confirmed' and let the timer expire. The backup RE was out of sync. I had to log into the backup RE and manually do a 'rollback 1' to get them back in sync.

1

I found out how to sort this out.

After a reboot of both nodes you must connect back to the node that was the original master and has the latest set of changes BEFORE the configs went out of sync.

My problem was I assumed node 1 had the latest set of changes but after rebooting both nodes and then manually making node 0 the primary node I found I could commit changes which then sync'ed back to node 1.

2
  • Ok, this hasn't fixed it. The very next config change has resulted in the same policy out of sync error message May 20, 2013 at 7:57
  • Are you not using "commit sync"? (or the related setting "set system commit sync")
    – LapTop006
    May 20, 2013 at 9:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.