Viewing and Synchronizing Out-of-Band NAT Policy Changes Manually

Starting in Junos Space Security Director Release 20.1R1, when there is an out-of-band NAT policy change in the device, you can see an icon next to the corresponding policy in device-specific and group NAT policies in Security Director. You can manually synchronize the out-of-band changes for a device-specific policy, only when the automatic synchronization is disabled.

When you hover over the icon next to the policy, the tooltip indicates the out-of-band changes.

When a device is discovered in Security Director, the Managed Status is displayed as Managed in the Security Devices page. For manual synchronization of out-of-band policy changes, the managed status of the device must be SD Changed, Device Changed, or In Sync. You must update the device atleast once from Security Director. In case of logical system (LSYS) or tenant system (TSYS), root device may show the status as Device Changed if a policy is assigned to it. Update the root device so that the status is In Sync.

After you synchronize the policy changes, the policy shows that you’ll need to republish the policy. A dummy publish and update has to be performed in order to set the managed status as In sync.

The custom rule group in a policy is not supported. If the policy has a custom rule group, then the custom rule group is deleted after synchronizing the policy and all the rules are grouped inside device-specific or predefined rule groups.

Note:

Out-of-band changes are not supported if more than one policy is assigned to a device or if rules are configured in All Devices Policy Pre/Post policies.
The out-of-band changes does not support synchronization of duplicate rule-sets in a NAT policy.

Viewing Out-of-Band NAT Policy Changes

To view out-of-band NAT policy changes:

Select Configure > NAT Policy > Policies.
The NAT Policies page appears. An icon is displayed for the policies indicating the out-of-band policy changes.
Right-click the policy or select View Device Policy Changes from the More menu.
The Out of Band Changes page appears.
Click View to view the configuration changes for a device in CLI and XML format.
The view configuration page for the device is displayed.

After viewing the changes, you can choose to import or reject the out-of-band changes from the device.
Click OK.
Note:
To reject all the out-of-band changes, select Reject all changes option. The icon next to the policy will be cleared and the policy changes from the device will not be imported into Security Director. During the subsequent update from Security Director, the out-of-band changes will be overwritten in the device.

To import the out-of-band changes to Security Director, see Importing Out-of-Band NAT Policy Changes Manually.

Importing Out-of-Band NAT Policy Changes Manually

To import out-of-band NAT policy changes:

Select Configure > NAT Policy > Policies.
The NAT Policies page appears. An icon is displayed for the policies indicating the out-of-band policy changes.
Right-click the policy or select View Device Policy Changes from the More menu.
The Out of Band Changes page appears.
Select Select Changes from Device to accept the out of band NAT policy changes from a device.
Select a device and click OK.
Note:
In the case of group policy, you can view all the devices where the policy is associated, but you can select only one device and import the changes. After selecting a device, click Affected Devices to see all the devices where the policy is assigned.

In case of both, group policy and device specific policy, an icon is seen next to the device(s) indicating the out-of-band changes.

The Import Device Configuration Changes page appears.
Select the NAT policy and click Next.
Objects with conflicts are displayed, if any.
Select objects and choose a conflict resolution type. Resolve any conflicts after you verify the information, if needed.
Click Finish.
A summary of the configuration changes is displayed.

You can download the summary report as a ZIP file. The summaryreport.zip file contains the complete rules report as a PDF.
Click OK to complete the import process.
The Job Details page is displayed with status of the import job.
Click OK.
The policies page is displayed with an icon which indicates that the policy was edited and needs publishing to the device.
Click Publish to publish the changes.
During the subsequent update from Security Director, the out-of-band changes will be overwritten in the device(s).

ON THIS PAGE

Viewing and Synchronizing Out-of-Band NAT Policy Changes Manually

Viewing Out-of-Band NAT Policy Changes

Importing Out-of-Band NAT Policy Changes Manually

Related Documentation