This article explains the root cause of the source-interface knob in AAMW not functioning as expected on SRX devices.

The ATP Cloud Control Plane connection fails when a source-interface is configured under the AAMW. Despite specifying a custom interface (e.g., reth2.0) as the source, the system uses the IP address of the FXP interface (e.g., fxp0.0) to initiate the connection.

root> show configuration services advanced-anti-malware

connection {
    url https://srxapi.eu-west-1.sky.junipersecurity.net;
    authentication {
        tls-profile aamw-ssl;
    }
    proxy-profile PROXY-PROFILE;
    source-interface reth2.0; <<<<<<<
}

Traffic towards the Squid proxy is seen originating from the FXP interface IP instead of the configured reth2.0.

root> show security flow session destination-port 8080 node 1

Session ID: 2050, Policy name: self-traffic-policy/1, HA State: Active, Timeout: 8, Session State: Valid
In: 10.219.174.146/60528 --> 10.39.195.28/8080;tcp, Conn Tag: 0x0, If: .local..0, Pkts: 4, Bytes: 256,
Out: 10.39.195.28/8080 --> 10.219.174.146/60528;tcp, Conn Tag: 0x0, If: reth1.0, Pkts: 0, Bytes: 0,

Session ID: 2051, Policy name: self-traffic-policy/1, HA State: Active, Timeout: 12, Session State: Valid
In: 10.219.174.146/52975 --> 10.39.195.28/8080;tcp, Conn Tag: 0x0, If: .local..0, Pkts: 3, Bytes: 192,
Out: 10.39.195.28/8080 --> 10.219.174.146/52975;tcp, Conn Tag: 0x0, If: reth1.0, Pkts: 0, Bytes: 0,

Total sessions: 2

The source-interface feature for AAMW has been incomplete since Day 1. In earlier software versions, even if source-interface was configured, the SRX device would correctly select the appropriate routing/interface for outbound connections. The feature requires a redesign. An enhancement request is needed to address this limitation.

Workaround

Instead of using source-interface, configure the source-address knob, which consistently works as expected.

{primary:node1}[edit]
root# delete services advanced-anti-malware connection source-interface reth2.0

{primary:node1}[edit]
root# set services advanced-anti-malware connection source-address 192.168.100.10

{primary:node1}[edit]
root# show | compare
[edit services advanced-anti-malware connection]
+ source-address 192.168.100.10;
- source-interface reth2.0;

{primary:node1}[edit]
root# commit and-quit

After applying the workaround, the sessions towards the Squid proxy correctly use the IP address of reth2.0 as the source.

root> show security flow session destination-port 8080 node 1

Session ID: 2075, Policy name: self-traffic-policy/1, HA State: Active, Timeout: 14, Session State: Valid
In: 192.168.100.10/62825 --> 10.39.195.28/8080;tcp, Conn Tag: 0x0, If: .local..0, Pkts: 2, Bytes: 128,
Out: 10.39.195.28/8080 --> 192.168.100.10/62825;tcp, Conn Tag: 0x0, If: reth1.0, Pkts: 0, Bytes: 0,

Total sessions: 1