SRX devices are reporting a “Log Term Connection Failed” status when attempting to stream logs to Mist at srx-log-terminator.eu.mist.com over TLS (port 6514).

This issue may arise due to one or more of the following:

• Incorrect log stream configuration or Mist-pushed settings.
• SRX failing to establish a TLS session with Mist’s log terminator (e.g., firewall or network blockages).
• Improper source IP assigned in Mist that doesn’t align with the SRX's actual WAN interface IP, resulting in authentication/verification failures on the Mist side.

• Persistent “Log Term Connection Failed” error messages in SRX logs or Mist portal.
• No successful TLS connection despite apparent configuration.
• Logs not appearing in the Mist UI due to failure in log streaming.

Step 1: Connectivity Testing

On the SRX, run connectivity tests to Mist’s log server using the correct source IP:

junos_cli > telnet srx-log-terminator.eu.mist.com port 6514 source "<correct-source-ip>"

Confirm the host is reachable and there are no blocking issues along the path.

Step 2: Validate Mist-Provided Configuration

Ensure the Mist-assigned configuration blocks are present and correctly formatted in the SRX:

set groups mist-wa services ssl initiation profile app_usage ...

set groups mist-wa security log stream app_usage host srx-log-terminator.eu.mist.com ...

set groups mist-wa security log stream app_usage transport protocol tls ...

Confirm there's no typo or misconfiguration, particularly in the hostname or transport settings.

Step 3: Verify TLS Session

Perform a live capture or session check to confirm the SRX initiates and completes a TLS handshake on port 6514:

Step 4: Update Log Source IP in Mist Dashboard

In the Mist dashboard:

1. Navigate to WAN Edges → Select the device.
2. Under Application Visibility, update the log source IP to match the actual WAN interface IP on the SRX.

This ensures Mist identifies the device correctly and can associate incoming log streams to the right source.