Management Center is unable to restore Edge SWG (ProxySG) backup config
Article ID: 196375
Updated On:
Products
Issue/Introduction
You are seeing error "The connection closed unexpectedly. This can be cause by misplaced "exit" commands in the script." while attempting to install an Edge SWG (ProxySG) / ASG backup using Management Center (MC).
Assumption: The backup being installed to a target device was taken from same Edge SWG (ProxySG) / ASG device that is running the same SGOS version.
Environment
Management Center is running supported version Older version of MC that reach end of life could simply disconnect to the proxy where the backup being installed without further clues that says "This can be cause by misplaced "exit" commands in the script"
Cause
Backup file may have included bluecoat CCL that the new proxy rejects.
Example snippet from an Edge SWG (ProxySG) / ASG backup file:
create ccl "bluecoat-image-validation"
edit ccl "bluecoat-image-validation" ;mode
add "BC_Engineering_CA"
add "BC_Engineering_Pre_CA"
exit
SGOS doesn't allow any CCL begins with bluecoat and will throw an error.
"% Reserved
keyword: CCL names cannot begin with "bluecoat-":
Succeeding lines will also error that says "% Invalid input detected at '^' marker." until it reached the "exit" command. This misplaced "exit" will bring the prompt back to privilege mode (enable mode) which the rest of the command line would not work and eventually exits SSH session.
This was bugged (SG-9252) from the original proxy that exposed bluecoat CCLs. This bug is fix starting from SGOS 6.7.4.4 and above . However, once backup include these said bluecoat* CCLs, a manual editing of the backup file is needed.
Resolution
Copy the backup taken and paste/edit it to your favorite text editor.
Review this article and follow instructions in step 5.2 and 5.3 under "Restore on the destination appliance"
5.2 If seen, remove the section in the Archive File:create ccl bluecoat-appliance
edit ccl bluecoat-appliance ;mode
add BC_Engineering_CA
add ABRCA_root
exit
5.3 Search for ccl bluecoat. If found, remove all other CCL including bluecoat-appliance above starting with 'bluecoat', from the beginning of the first reference to 'exit' as shown in step 2. All CCLs starting with bluecoat will error.
Once edited, you can install whole backup using MC script OR install it directly to the proxy via SSH under "configuration terminal" mode.
Additional Information
Behavior:
When installing ProxySG backup via MC, connect to ProxySG via SSH/CLI, "configuration terminal" mode and then execute the command line by line, as seen in the backup file.
Feedback
