Unable to update policy services database

Products

• ISG Proxy
• ProxySG Software - SGOS

Issue/Introduction

Customer received the following error when attempting to update policy services database

"Failed trying to extract and activate the Policy Services payload file"

Cause

Analyzing the sysinfo under "URL_Path /Policy/current" line yield the following. 

; Empty CPL object
; Policy could not be loaded at startup
; Possible cause:
;     - a system downgrade occurred and policy includes features
;       that are not supported in this version
;
; The following compilation problems were reported:
; 
;   Error: <Admin> layer authentication requires that the realm support BASIC or Connection credentials. BASIC credentials should be enabled or a new realm should be specified.: 'CorpZ-Admin'
;   vpm-cpl:21:     authenticate(CorpZ-Admin) authenticate.force(no) ; Rule 1

As Policy Service requires policy compilation, having an error in existing policy installation would stop Policy Service from applying the latest patch. 

 

 

Resolution

Any errors from policy installation needs to be addressed prior to updating Policy Services otherwise the error above would appear.

In this case the resolution would be to enable Basic credentials in the IWA realm settings:

1. Access the Management Console.
2. Go to Configuration > Authentication > Realms and Domains.
3. Select the IWA realm name used for admin authentication.
4. Click Show under Advanced settings EdgeSWG management console authentication method.
5. Check the box for Allow Basic Credentials.
6. Click Apply and re-install the policy.