Troubleshooting Guide › Deploying Policies › Rule with Variable Does Not Deploy On Endpoint

Rule with Variable Does Not Deploy On Endpoint

Symptom:

I created a policy that contains a rule with a variable and deployed the policy to an endpoint, but the rule is not implemented on the endpoint.

Solution:

Use the following procedure to troubleshoot the policy deployment:

1. Verify that the value of the policyfetcher_enabled configuration setting in the policyfetcher section on the endpoint is 1.

   A value of 1 for this configuration setting specifies to run policyfetcher. If policyfetcher is not running, it cannot deliver the policy to the endpoint.

2. Check the policyfetcher log for errors.

   Note: The policyfetcher log is in the ACInstallDir/Log directory, where ACInstallDir is the directory in which you installed CA Access Control.

3. Use CA Access Control Endpoint Management to verify that the variable is defined on the endpoint.

   Note: If the variable is not defined on the endpoint, the policy status is Deploy Pending.

   If the variable is not defined on the endpoint, create a new policy version that contains a selang rule that defines the variable, and deploy the new policy version to the endpoint.

4. Verify that the following are true:
   • The policy is assigned to the endpoint

     If the policy is not assigned to the endpoint, use CA Access Control Enterprise Management to assign the policy.

   • The deployment script for the policy does not contain errors.

     If the deployment script for the policy contains errors, create a new policy version that fixes the errors and deploy the new policy version to the endpoint.

   • The policy status is not Out of Sync.

     If the policy status is Out of Sync, a variable value may have changed in the CA Access Control endpoint. Redeploy the policy to clear the Out of Sync status.

5. Audit deployment information to verify that:
   • The endpoint has correctly compiled the policy
   • The DEPLOYMENT object for the policy does not contain any deployment errors

   If policy did not correctly compile or the DEPLOYMENT object contains errors, fix the errors and redeploy the policy.

6. Restart CA Access Control.

More information:

Guidelines for Using Variables