Description

On SRX devices with NG Juniper Web-Filtering enabled, the UTM engine reports that the cloud web-filter server is DOWN.
Because the SRX cannot communicate with signatures.juniper.net, URL reputation lookups cannot be performed.

Symptoms

Administrators may observe the following:

  • Web traffic is blocked or allowed unexpectedly, depending on the configured fail‑mode.
  • UTM web-filtering logs are missing, delayed, or incomplete.
  • Command output shows cloud communication failure:

show security utm web-filtering status
--------------------------------------------------------------------------
UTM web-filtering status:
Web-filtering type: NG Juniper
Server status : Juniper Cloud server DOWN
Status reason: Server no response(server:signatures.juniper.net, src-ip:x.x.x.x vr-id:0)
JDPI Parser : Enabled
Dynapp-profile-selection : Enabled

 

 

Solution

The SRX is unable to reach the Juniper Cloud server using the configured source IP and routing instance. Common causes include:

  • No valid default route or missing route to the Internet.
  • Firewall or upstream device blocking HTTPS port 443.
  • DNS resolution failures.
  • Incorrect source-interface for UTM cloud communication.
  • NAT misconfiguration.
  • Expired/missing IPS/UTM license.
  • Routing-instance misalignment (traffic sourced from incorrect VR).

You may follow the below steps:

1. Verify Internet Connectivity from SRX 
2. Verify DNS Resolution
3. Check Routing Table
4. Verify Source IP Used for Cloud Communication
5. Check Security Policies (Outbound HTTPS)
6. Verify Licenses

Additional Recommendations

Ensure SRX date/time is correct (NTP recommended).
Try bypassing SSL proxy interference between SRX and cloud servers.
Review NAT rules to confirm that UTM source IP is correctly NATed.

If the issue persists after completing the above steps, collect logs and open a case with Juniper TAC.

Modification History

2026-01-08 : Article Created