Symptoms

Having a standard Active/Standby setup, with a single Sync-Failover Device Group, Auto-Sync, with ASM enabled. When importing an ASM policy (named 'ddddd') into the inactive policies list, the following results in GUI screen, Security :: Application Security : Security Policies : Inactive Policies. On active device: Security Policy Name - Version ddddd - 2016-02-25 10:39:49 ddddd_2 - 2016-03-01 00:11:46 On standby device: Security Policy Name - Version ddddd - 2016-03-01 00:11:41 ddddd_2 - 2016-02-25 10:39:49 According to the 'Version' field (time stamps), the 'ddddd' on active is actually 'ddddd_2' on standby and then the other two policies are not the same. The group ends up with three different policies on the two devices.

Impact

Three different policies are created on the two devices.

Conditions

-- Active/Standby configuration. -- ASM provisioned. -- Import security policy to the inactive policies list.

Workaround

None.

Fix Information

The import policy process now results in a consistent state on both devices in a device group.

Behavior Change