Policy installation query

[Steve-Pearson]

I have a query regarding the Install On column in the policy.

Obviously this says where the rule should be installed, and by default it is set to Policy Targets.

I believe back in the day that it was fairly common practice to put the cluster or gateway object in here, which was fine.

I'm currently troubleshooting an issue  on R81.20 but the policy is fairly old and needs some serious tidying up. In the Install On column i'm seeing one of 3 different entries throughout the policy. One is Installation Targets, no problem, the next is the cluster object again no problem, but the third one confuses and concerns me a little.

It's name is Gateways but has a symbol that i'm not familiar with (see attached screen grab)

The concerning thing is that I can't really interact with it. Double clicking does nothing, hovering on it displays a little box with it's name and gives me a creation and modified date, which are both the same and relate to a date in August last year when the system was upgraded from R81.10 to R81.20. I can right click and select Where Used to get a list of usages, but I can't edit the object.

I also tried searching the object database but it's not found

Searching in GuiDBedit I see it in 2 places:

as the display name on an object called SDT_InstallOn under Other/sd_topics

as an object name under Read Only Configuration/setup

Can anyone advise on this at all please?

My thoughts are, as there is only a single policy with a default InstallOn set to "All Gateways" and there is only a single cluster of 2 gateways. to remove it, leaving the InstallOn set to Policy Targets. (and also remove the cluster object too) 

Thanks,

Steve

[Lesley]

I would create a new rule above the one with the gateway object. Just a. Copy and change the install on target as you want. Then check logs if rule works as it should. Check also the rule with the gateway object in it to see if it has no hits anymore after your change. If all is good I would move away from this objects due the fact it is unclear what it is. 
Second tip pay extra attention also to nat rulebase especially automatic rules that are greyed out. The objects in those rule have their install on target hidden in the object itself. For example a host object with nat ip and real ip

[the_rock]

You can change that under policy editor what object policy package is installed on.

Andy

[PhoneBoy]

This could very well be a legacy object (likely if the management has gone through several upgrades).
Policy Targets is usually what you want in the Install On column unless the rule involves Dynamic Objects (then explicit gateways need to be listed).