Error: "Policy could not be compiled, possibly due to an upgrade problem", policy compile issue when upgrading to 7.4.2+

Products

• ProxySG Software - SGOS

Issue/Introduction

After upgrading SGOS to 7.4.2 or greater the device is not passing user traffic and the event log shows various lines with the error:

Policy could not be compiled, possibly due to an upgrade problem

Environment

Edge SWG which has been upgraded to SGOS 7.4.2 or greater and uses IM Proxy CPL objects. 

Cause

Review the sysinfo section or advanced URL path: '/Policy/current' for any errors in the policy compilation results. 

For example, if you see errors like the following: 

Error: Unknown tag: 'im.client'

or

Error: Unrecognized field identifier: 'x-im-file-path'

When attempting to install the policy you will also see the errors generated: 

These errors cause the policy to fail compilation because policy conditions for the IM Proxy have been removed in 7.4.2.1.

IM proxy functionality was deprecated in 6.7.5.x releases and the functionality was removed in 7.3 with some related policy constructs marked deprecated. All CPL gestures related to IM proxy are removed in the 7.4.2 and 7.4.3 releases.

Resolution

For these CPL objects or other CPL that have been removed in SGOS you'll need to remove or disable those objects from the policy before the proxy can successfully compile the policy. 

To remove the objects, delete them from the rules in the VPM or policy file where they are located. Next, in the VPM navigate to "Operations > View All Objects" and delete the objects from there. Then, apply the policy and confirm there are no errors. If using Management Center the policy should be installed on the target Proxy to confirm there are no errors.

Additional Information

When planning for an upgrade and reviewing the SGOS 7.4.x Upgrade/Downgrade guide, any deprecations and removals should be addressed prior to upgrading to the version where the removal occurred. 

Prior to upgrading there will be a deprecation warning when installing the policy in some cases.

From the prior example, if the im.client is being used in policy there will be a warning for that: 

Deprecation warning: 'Im.client'; Use of the 'Im.client' keyword is deprecated. 

However, there are no deprecation warnings generated for the IM Proxy access log fields (e.g x-im-user-id or x-im-file-path). The log fields CPL objects should also be removed from the policy prior to upgrading. It is suggested to remove the access log field from the log format as well. See Configure an Access Log Format.

Refer to the SGOS 7.4.x Upgrade/Downgrade guide for the Deprecations and Removals and Behavior Changes in SGOS 7.4.3.1 and 7.4.2.1.