This article explains the issue wherein the LWC is in Juniper Cloud Disconnected state even though the config is done on the JSI portal.

The JSI captive portal shows Juniper Cloud Disconnected and Not Provisioned.

All the config is done on the JSI captive portal.

Check the following:

• The int, ext and cap interface should be in different subnets. Please refer to the link mentioned below:

https://www.juniper.net/documentation/us/en/quick-start/software/jsi/jsi-on-jsp-quick-start-vlwc/topics/topic-map/jsi-step-1-begin.html#task_zlv_lp4_dyb

• Download the extensive RSI from the captive portal >> right hand column >> click on extensive RSI.

• Check the traceroute to see if the external interface is able to reach out to the AWS Proxy.

• In case you are using a proxy yourself, please ensure that your proxy connects to the AWS proxy as defined in the link below:

https://www.juniper.net/documentation/us/en/quick-start/software/jsi/jsi-on-jsp-quick-start-vlwc/topics/topic-map/jsi-step-1-begin.html#concept_phd_2vx_hcc__table_cmc_jgy_xrb

• Please note that adding the following IPs for the AWS proxy are sufficient in to be added in your DNS since the other IP addresses are for firewalls only: 35.71.174.221 and 52.223.32.79

• Ensure that the AWSProxy is configured as a parent proxy to your proxy server and not as a sibling proxy server.

• Ensure that the following config is present on your proxy server:

Example: The Squid configuration directive 

cache_peer AWSProxy-prod.jssprod.junipercloud.net parent 443 0 no-query default

 is used to define an upstream proxy (a "parent" cache) and configure how the local Squid instance interacts with it. 

Please note that this is an example from the squid proxy server (which is where Juniper does its testing).

You need to find the equivalent command for this (check with your proxy server team) and have that configured on your proxy server.

• Once these are done, run the dig or nslookup command on your proxy server to see how many answers you get for the AWSProxy-prod.jssprod.junipercloud.net. 

• It should return the two IP addresses mentioned above: 35.71.174.221 and 52.223.32.79.