NSM fails to update device but shows successful
When updating a Device from the NSM the Job Information dialog shows as successful. The Device Status shows as "In Sync" but the device does not show the new configuration, and an additional Delta Config Summerization shows that the NSM configuration is different to that of the device.
ScreenOS has a source/destination object limit per policy. Due to the NSM not "screening" the number of objects that are added to the policy via the GUI when the NSM updates the device, the NSM believes that the update has been successful and reports so via the Job Info dialog log.
In addition to this when trying to add the commands to the device itself via the CLI you may see the following
netscreen-SSG350(policy:18)-> set dst-address grp-servers
Group: Too many entries
Failed command - set group address "Untrust" "hosta" add "grp-servers"
Set address failed
Policy: can't be modified
Failed command - set dst-address grp-servers
Due to this you will not see the commands executed via the NSM (sme_bulkcli) from the output of the Devices "get event" command.
You can either :
* Create another policy to allow you to add more objects to either the source or destination.
* Reduce the number of objects in either the source or destination field.
Additional Notes :
This issue was found on NSM Xpress 2008.2r2 of which no issues relating to the above were found in the NSM 2009.r1/r1a release notes.