topic Re: Policy Target 'Install On' in Firewall and Security Management

Policy Target 'Install On'

Ravi_Ahir — Thu, 05 Mar 2020 10:01:33 GMT

We have Selected 'Policy Targets' as to install on for Cluster. Policy Targets contains the specific gateway cluster.

Now When I install policy on 'Cluster-1' with target set as 'Cluster-1' 0nly in the situation when I do Policy Install on 'Cluster -2' it still shows installed policy changes on Cluster-1 under 'View Chnages'.

I am not sure if I explained it well.

Thanks

Ravi

Re: Policy Target 'Install On'

PhoneBoy — Fri, 06 Mar 2020 01:49:08 GMT

I'm not really following.
Screenshots might help.

Re: Policy Target 'Install On'

Ravi_Ahir — Fri, 06 Mar 2020 07:52:35 GMT

If you see attached files, Install on is set to 'Policy Targets' which are specific to cluster only. Now When I go to install policy it shows 419 changes which we made on other clusters not on 'P-cluster'. None of the change related to 'P-cluster' but still it shows under changes list while I do install on 'P-cluster'.

Re: Policy Target 'Install On'

PhoneBoy — Fri, 06 Mar 2020 18:29:21 GMT

Did you make ANY change to ANY objects along the way?
Those object changes apply to all policy packages, even if they're not used in the package.
They are only pushed to the gateway when a policy install takes place.

Re: Policy Target 'Install On'

Maarten_Sjouw — Sat, 07 Mar 2020 08:10:29 GMT

Lets assume the following:

you have 1 policy that is used for Cluster_1 and Cluster_2
you make some changes
you push policy to Cluster_1
Now you want to push the policy to Cluster_2
You see that there are changes waiting to be installed.

This is correct, those changes had not been applied to Cluster_2 yet so they show as not finished, it is the same policy you made changes to.

Re: Policy Target 'Install On'

Ravi_Ahir — Mon, 09 Mar 2020 07:39:11 GMT

Just not I have deleted rule on another cluster and it shows the changes on 'Cluster_P'.

Re: Policy Target 'Install On'

Ravi_Ahir — Mon, 09 Mar 2020 07:41:28 GMT

I have deleted 1 Policy on 'Cluster_1' and its not used on 'Cluster_2' still it shows waiting install on 'Cluster_2'.

We have 15 cluster in our environment. So if I delete 1 policy on 'Cluster_1' it shows pending install on all rest of 14 clusters.

Re: Policy Target 'Install On'

Maarten_Sjouw — Mon, 09 Mar 2020 07:50:36 GMT

As all your clusters use the same policy and there is a change in the policy, regardless the change, it will show that there was a change in the policy. When you delete a line, all line numbers have changed in the policy.

Re: Policy Target 'Install On'

Ravi_Ahir — Mon, 09 Mar 2020 07:57:51 GMT

We have separate policy install package 'Target' used for each clusters. So each clusters are using different policies.

I mean to say Perimeter firewall will not have same policies as inside firewall. Still if I made any changes on Inside firewall its shows on Perim firewall in pending install.

Is this something known or same policy thing?

Regards,

Ravi

Re: Policy Target 'Install On'

Maarten_Sjouw — Mon, 09 Mar 2020 08:22:45 GMT

If each policy is only related to a specific cluster, do you have the installation target set?
If not it will still think each policy is related to each cluster.
When you make changes to a object (other than rules) it is relevant to all policies and I really do not believe that the underlying technology will differentiate between gateways.

When you do use the installation targets, you do not need to use the install-on column on top of that, this will only give you a lot of work when you need to replace a cluster or rename...

Re: Policy Target 'Install On'

Ravi_Ahir — Mon, 09 Mar 2020 09:07:46 GMT

If each policy is only related to a specific cluster, do you have the installation target set? - Yes it set to specific cluster target only.

I have observed this thing in scenario where 'Object_X' is used only on 'Cluster_1' and I do changes on 'Object_X' it will set to install for all the clusters.

Though I need to try other possible way to fix.

Re: Policy Target 'Install On'

CSR — Mon, 09 Mar 2020 09:23:58 GMT

I'm not sure but maybe any Object which is used in the Policy for Cluster-1, in that particular object in NAT properties maybe its configured to install the Policy target on All/Cluster-2.
Refer to the attached screenshot for reference and check if it helps.

Regards,

CSR