This article explains one of the reasons why the packets may be getting dropped by the "pre-id-default: deny" polic,y even if a security policy is configured.

Security policy configured as follows:

set security policies from-zone Trust to-zone Untrust policy Allow match source-address any

set security policies from-zone Trust to-zone Untrust policy Allow match destination-address any

set security policies from-zone Trust to-zone Untrust policy Allow match application any

set security policies from-zone Trust to-zone Untrust policy Allow match dynamic-application any

Still, packets are getting dropped due to the "pre-id-default-deny" policy

Choosing the "dynamic-application" as "any" requires the application to be identified.

This needs an application database to be downloaded.

To check if the application database is downloaded, use the following command.

root@srx> show services application-identification version 

 Application package version: 0

The application was not downloaded because under "Application Visibility", "Device does Not have an APP Track license" was choosen.

See KB105907 [juniper.net]

To resolve this, manually download the application database using the procedure mentioned in KB105902 [juniper.net]

Else, under "Application Visibility", choose "Device HAS an APP Track license" and save.

Wait for the MIST to push the package and install it on the WAN edge.

These events can be seen in WAN Edge Insights.