Policy errors applying UPE updates via MC after switching from Java to Web based VPM

Products

• Management Center - VA

Issue/Introduction

UPE policies generated via Management Center are pushed to on-premise as well as Cloud SWG proxy servers.

Admins managed the UPE policy via Java, but were forced into switching to the Web based VPM due to end of life.

After applying a basic change to an existing policy (adding a comment or a new domain), definition errors were reported when saving including the following example errors: 

Error: No definition found for: 'condition=__Proxy__P1234'
vpm-cpl:15219
Error: No definition found for: 'condition=__Proxy__P5678'
vpm-cpl:14546
Error: No definition found for: 'condition=__Proxy__P6789'
vpm-cpl:13514

Applying the same change via the Java VPM resulted in no errors.

Environment

ProxySG.

Cloud SWG.

Management Center.

WebVPM.

Cause

Cannot referencing a nested condition in the layer guard.

WebVPM should take care of the name change automatically, but since we refer to the nested condition explicitly in the CPL layer it couldn't adjust the name and threw the error.

Resolution

Replaced the definitions in the layer guard so that nested conditions not included.

Using the following example, the condition=__Proxy__P1234 within the layer guard was changed from 

<Forward Example> condition=__Proxy__P1234 server_url.category=("TestCategory")  ; Layer guard so only traffic to Testcategory on proxy port 1234 is admitted.

to

<Forward Example> url.port=1234 server_url.category=("TestCategory")  ; Layer guard so only traffic to Testcategory on proxy port 1234 is admitted.