Juniper SRX240 Clustering - Policy out of sync

Question

I have two Juniper SRX240's in a cluster. After re-ordering some security policies on the primary device and committing them ok I now can not make any other changes without the warning

error: Policy is out of sync between RE and PFE cluster1.node1. Please resync before commit.

error: configuration check-out failed

I have found this KB article http://kb.juniper.net/InfoCenter/index?page=content&id=KB25143&smlogin=true and I have rebooted both of the nodes (multiple times now) and they are still out of sync.

I found out about a command "commit synchronize force" but that won't work on a SRX 240.

Does anyone know how I can force a resync of these two devices? They are currently live so I can't keep rebooting them in the middle of the day.

I am running version: JUNOS 12.1R6.5

Answer 1

You description is implying the issue is between the primary and secondary nodes, but the article is referencing an out of sync between the Control Plane and Data Plane ( or Routing Engine and Packet Forwarding Engine.

If it is indeed the PFE out of Sync you might also try the hidden command 'commit full'.

I know I had an issue where my 2 routing engines were out of sync. I don't recall if it was on a cluster SRX or something like a VC switch or dual RE router. In my case it was because I had issued a 'commit confirmed' and let the timer expire. The backup RE was out of sync. I had to log into the backup RE and manually do a 'rollback 1' to get them back in sync.

Answer 2

I found out how to sort this out.

After a reboot of both nodes you must connect back to the node that was the original master and has the latest set of changes BEFORE the configs went out of sync.

My problem was I assumed node 1 had the latest set of changes but after rebooting both nodes and then manually making node 0 the primary node I found I could commit changes which then sync'ed back to node 1.