topic MDS , VSX configuration revision error in Firewall and Security Management

MDS , VSX configuration revision error

Vinay-singh — Thu, 19 Oct 2023 22:34:25 GMT

Hi Tomer,

We have a setup of MDS R80.40 and VSX Cluster R80.30. we are doing daily change in Policy, some time we change (add/Delete) in Object list and Route in VSX configuration.

recently, we found that we deleted many policy and Object change in MDS also few Change in VSX configuration log in Audit, so we tried to revert from Option "Revert on this Revision".

Go to the Manage & Settings view > Sessions > Revisions. Select the revision you would like to revert to, go to Actions and select Revert to Revision.

but it is given an error in Revison verification :

Revision - Verify - VSX Validation :-
Domain cannot be reverted due to configutation/Networking changes in VSX Objects .
FW-XYZ-Cluster, FW-123-Cluster

Option-1 Manually :

after that, we validate VSX configuration in Audit-log/Revision for FW-XYZ-Cluster and FW-123-Cluster, we manually deleted Route and Object from Object-Group (this (add route and Object) configuration changes did by another team) for both Firewall Cluster,

after that, we again trying to revert on specific Revision. we see that FW-XYZ-Cluster is not showing in Error while doing Revision. but FW-123-Cluster still reflecting in error.

Revision - Verify - VSX Validation :-
Domain cannot be reverted due to configutation/Networking changes in VSX Objects .
FW-123-Cluster.

Option-2 Revision : for VSX configuration changes.

Go to the Manage & Settings view > Sessions > Revisions. Select the revision you would like to revert to, go to Actions and select Revert to Revision.

we again trying to revert on specific VSX configuration Revision, but the error is same like above.

Revision - Verify - VSX Validation :-
Domain cannot be reverted due to configutation/Networking changes in VSX Objects .
FW-123-Cluster.

also, we noticed that when we delete Route "10.x.x.0 255.255.255.0 next-hope 192.168.1.1" from VSX cluster - Property - Topology - Route , and click OK , after completed all ,
we see that deletion logs but when we open that log we are not able to see in detail like adding log ("add 10.x.x.0 255.255.255.0 next-hope 192.168.1.1").

is there any other option to see what changes happens on VSX FW-123-Cluster ?
how we do to rectify this issues ?
is there any BUG for that ?

Thanks,

Vinay Kr Singh

MDS / VSX configuration / Revision issues

Vinay-singh — Thu, 19 Oct 2023 22:31:45 GMT

Hi Tomer,

We have a setup of MDS R80.40 and VSX Cluster R80.30. we are doing daily change in Policy, some time we change (add/Delete) in Object list and Route in VSX configuration.

recently, we found that we deleted many policy and Object change in MDS also few Change in VSX configuration log in Audit, so we tried to revert from Option "Revert on this Revision".

Go to the Manage & Settings view > Sessions > Revisions. Select the revision you would like to revert to, go to Actions and select Revert to Revision.

but it is given an error in Revison verification :

Revision - Verify - VSX Validation :-
Domain cannot be reverted due to configutation/Networking changes in VSX Objects .
FW-XYZ-Cluster, FW-123-Cluster

Option-1 Manually :

after that, we again trying to revert on specific Revision. we see that FW-XYZ-Cluster is not showing in Error while doing Revision. but FW-123-Cluster still reflecting in error.

Revision - Verify - VSX Validation :-
Domain cannot be reverted due to configutation/Networking changes in VSX Objects .
FW-123-Cluster.

Option-2 Revision : for VSX configuration changes.

Go to the Manage & Settings view > Sessions > Revisions. Select the revision you would like to revert to, go to Actions and select Revert to Revision.

we again trying to revert on specific VSX configuration Revision, but the error is same like above.

Revision - Verify - VSX Validation :-
Domain cannot be reverted due to configutation/Networking changes in VSX Objects .
FW-123-Cluster.

is there any other option to see what changes happens on VSX FW-123-Cluster ?
how we do to rectify this issues ?
is there any BUG for that ?

Thanks,

Vinay Kr Singh

Re: MDS , VSX configuration revision error

Chris_Atkinson — Fri, 20 Oct 2023 00:11:00 GMT

Revision control is not supported in some scenarios:

Also for awareness - R80.40 JHF T196:

MDS, Revision validation error VSX configuration

vinaysingh85 — Fri, 20 Oct 2023 04:57:48 GMT

MDS , VSX configuration Validation error while Policy revision

We have a setup of MDS R80.40 and VSX Cluster R80.30. we are doing daily change in Policy, some time we change (add/Delete) in Object list and Route in VSX configuration.

recently, we found that we deleted many policy and Object change in MDS also few Change in VSX configuration log in Audit, so we tried to revert from Option "Revert on this Revision".

Go to the Manage & Settings view > Sessions > Revisions. Select the revision you would like to revert to, go to Actions and select Revert to Revision.

but it is given an error in Revison verification :

Revision - Verify - VSX Validation :-
Domain cannot be reverted due to configutation/Networking changes in VSX Objects .
FW-XYZ-Cluster, FW-123-Cluster

Option-1 Manually :

after that, we again trying to revert on specific Revision. we see that FW-XYZ-Cluster is not showing in Error while doing Revision. but FW-123-Cluster still reflecting in error.

Revision - Verify - VSX Validation :-
Domain cannot be reverted due to configutation/Networking changes in VSX Objects .
FW-123-Cluster.

Option-2 Revision : for VSX configuration changes.

Go to the Manage & Settings view > Sessions > Revisions. Select the revision you would like to revert to, go to Actions and select Revert to Revision.

we again trying to revert on specific VSX configuration Revision, but the error is same like above.

Revision - Verify - VSX Validation :-
Domain cannot be reverted due to configutation/Networking changes in VSX Objects .
FW-123-Cluster.

is there any other option to see what changes happens on VSX FW-123-Cluster ?
how we do to rectify this issues ?
is there any BUG for that ?

As we reverted all VSX changes manually , as we got success to remove one VSX Cluster name from that Validation error list.

But still another one is reflecting in Policy Revison Validation error list.

Thanks,

Vinay Kr Singh

Re: MDS , VSX configuration revision error

vinaysingh85 — Fri, 20 Oct 2023 05:43:10 GMT

Hi Chris, we revert all VSX configuration changes (Route and Object add) manually, and we got successfully remove one VSX Cluster from that error list. But another VSX Cluster still in that error Validation list.

We are not able to identify what was the changes happen that are not allowing to clean from that list. Is ther any option to check and find out what changes are reflecting in Validation..

Re: MDS , VSX configuration revision error

vinaysingh85 — Fri, 20 Oct 2023 07:39:51 GMT

We are not able to identify what was the changes happen that are not allowing to clean from that list. Is ther any option to check and find out what changes are reflecting in Validation..

Re: MDS / VSX configuration / Revision issues

_Val_ — Fri, 20 Oct 2023 11:08:04 GMT

First, R80.30 has been out of support for a while. Second, Database Revision Control is not supported in case you are managing VSX, hence the error you are having when trying to revert.