KB ID 0000999 

Problem

WARNING: This article is not to cover every problem that will stop you committing the firewall config. It just serves to document problems I’ve encountered, and I how I overcame them.

Solution

I came across the following two problems whilst attempting to setup a ‘chassis cluster‘. both were related to configuration existing on interfaces that I wanted to use as Reth interfaces. essentially I didn’t delete ALL the settings for these interfaces before I started configuring clustering.

Problem 1

[box]root# commit
[edit security zones security-zone untrust]
‘interfaces ge-0/0/0.0’
Interface ge-0/0/0.0 must be configured under interfaces
error: configuration check-out failed[/box]

This was because ge-0/0/0 was automatically converted to fxp0, (which is the management interface). The error is telling me that that physical interface is part of the ‘untrust’ zone, so I need to remove that.

[box]{hold:node0}[edit]
root# delete security zones security-zone untrust interfaces ge-0/0/0.0[/box]

Now it let me commit the configuration.

[box] {hold:node0}[edit]
root# commit
node0:
commit complete

{hold:node0}[edit]
root#[/box]

Problem 2

[box]root@FWA# commit
[edit interfaces ge-0/0/4 gigether-options]
‘redundant-parent’
Logical unit is not allowed on redundant-ethernet member
error: commit failed: (statements constraint check failed)[/box]

This was because ge-0/0/0 was part of Reth0, (which was my outside facing redundant interface), had some configuration on it that shouldn’t be there, to find out what I needed to search the configuration.

[box]{primary:node0}[edit]
root@FWA# show | display set | match ge-0/0/4
set interfaces ge-0/0/4 gigether-options redundant-parent reth0
set interfaces ge-0/0/4 unit 0 family ethernet-switching vlan members vlan-trust[/box]

The first setting tells me its part of Reth0, which is good, but the second one should not be there. I could just delete that one, but I’ll simply delete all configuration for that interface, then add the correct line back like so;

[box] {primary:node0}[edit]
root@FWA# delete interfaces ge-0/0/4

{primary:node0}[edit]
root@FWA# set ge-0/0/4 gigether-options redundant-parent reth0 [/box]

Now it let me commit the configuration.

[box] {hold:node0}[edit]
root# commit
node0:
commit complete

{hold:node0}[edit]
root#

[/box]

Related Articles, References, Credits, or External Links

NA