This issue is likely caused by the fact that the ProxySG that was upgraded, already ran SGOS version 6 at a certain time.
Here are three examples to help explain what happens when a ProxySG is upgraded.
Example 1 : Box shipped with SGOS version 5, then upgraded to SGOS 6
In this case here, since the ProxySG has never ran SGOS 6, at the time of the upgrade, the ProxySG will automatically convert the SGOS 5 configuration file (including the policy) and convert it to SGOS 6. At this point, two versions of the configuration reside on the disks, the SGOS 5 configuration and the SGOS 6 configuration. If changes are made while the SG is running SGOS 6, it will NOT make those updates to the SGOS 5 configuration file. Should the unit be downgraded back to SGOS 5, the older configuration will be loaded at boot time, which was the configuration active at the time of the upgrade.
Example 2 : Box shipped with SGOS 6, but immediately downgraded to SGOS 5
Sometimes a unit is shipped with a newer OS than what is required by the administrator, in which case a new appliance is downgraded before being installed. In this example here, the box will have a blank SGOS 6 configuration, and at the time of the downgrade, a new SGOS 5 configuration will be created. Changes made while the unit is running SGOS 5 will only be saved to the SGOS 5 configuration file. If at a later time the unit is upgraded to SGOS 6, because a configuration file for SGOS 6 already exists (from the original OS), the unit will NOT automatically the SGOS 5 configuration to the SGOS 6 file, which means after an upgrade, the unit will load a blank policy.
If your ProxySG came with SGOS 6 but was downgraded to SGOS 5, and now needs to be upgraded to SGOS 6, you need to run the CLI command "remove-sgos6-config" prior to your upgrade.
This will delete the blank SOGS 6 file, and convert the SGOS 5 configuration file at the time of the upgrade.