Management Center is unable to restore SG backup config

book

Article ID: 196375

calendar_today

Updated On:

Products

Management Center Management Center - VA Advanced Secure Gateway Software - ASG ProxySG Software - SGOS

Issue/Introduction

You are seeing error "The connection closed unexpectedly. This can be cause by misplaced "exit" commands in the script." while attempting to install an SG/ASG backup using Management Center.

Assumption:   The backup being installed to a target device was taken from same SG or ASG device that is running the same SGOS  version.  

Cause

Backup file may have included bluecoat CCL that the new proxy rejects.  

Example snippet from a ProxySG/ASG backup file: 

create ccl "bluecoat-image-validation"   
edit ccl "bluecoat-image-validation" ;mode
add "BC_Engineering_CA"
add "BC_Engineering_Pre_CA"
exit

 

SGOS doesn't allow any CCL begins with bluecoat and will throw an error.   

"% Reserved
keyword: CCL names cannot begin with "bluecoat-":

 

Succeeding lines will also error that says "% Invalid input detected at '^' marker."  until it reached the "exit" command.  This misplaced "exit"  will bring the prompt back to privilege mode (enable mode) which the rest of the command line would not work and eventually exits SSH session.  

This was bugged (SG-9252) from the original proxySG that exposed bluecoat CCLs.   This bug is fix starting from SGOS 6.7.4.4 and above .  However, once backup include these said bluecoat* CCLs, a manual editing of the backup file is needed.

Environment

Management Center is running supported version     Older version of MC that reach end of life could simply disconnect to the Proxy where the backup being installed without further clues that says "This can be cause by misplaced "exit" commands in the script"

Resolution

Copy the backup taken and paste/edit it  to your favorite text editor.  

Review https://knowledge.broadcom.com/external/article?articleId=165985 and follow instruction in step  5.2 and 5.3 under "Restore on the destination appliance"  

5.2   If seen, remove the section in the Archive File:

create ccl bluecoat-appliance
edit ccl bluecoat-appliance ;mode
add BC_Engineering_CA
add ABRCA_root
exit

 

5.3    Search for ccl bluecoat.  If found, remove all other CCL including bluecoat-appliance above starting with 'bluecoat', from the beginning of the first reference to 'exit' as shown in step 2.  All CCLs starting with bluecoat will error.

 

Once edited, you can install whole backup using MC script OR install it directly to proxySG via SSH under "configuration terminal" mode.   

Additional Information

Behavior: 

When installing Proxy backup via Management Center, MC  connects to said ProxySG via SSH/CLI, "configuration terminal" mode  then execute the command line by line. as seen in the backup file.