This article explains the basic steps to troubleshoot ISP issues on SRX.

SRX is not able to ping any publicly hosted IPs/Domain names

The following are the basic steps/checks:

1. Check if the physical WAN interface of SRX is UP - "show interfaces terse | match <isp_interface>"
2. If it is UP, check for any errors in the speed negotiation or if there are any L1-related errors. Also, check the INPUT and OUTPUT bytes on the interface - "show interfaces <isp_interface> extensive"
3. Check if the interface is assigned to a zone - "show configuration security zones | match <isp_interface>"
4. Check if there is an ARP entry for the default gateway - "show arp no-resolve interface <isp_interface>"
5. If there is no ARP entry, check if the interface is sending ARP requests and if an ARP response is received - "monitor traffic interface <isp_interface> no-resolve"
6. If you see an ARP response from the gateway, contact JTAC for deep troubleshooting. If there is no ARP response, contact your ISP.
7. If there is an ARP entry for the interface, check if you can ping the gateway from the ISP interface "ping <gateway_IP> interface <isp_interface>". On a duplicate session, run "monitor traffic interface <isp_interface> no-resolve.
8. Note, the address assigned on the ISP interface should never be /32. If you add the interface address with /32, there will be no direct route to the gateway address.
9. If you see a ping response from the gateway, check if there is a route to the internet (0.0.0.0/0) with next-hop as the gateway address - "show route 0.0.0.0/0". If there is no ping response, contact your ISP.

These are the basic steps if the SRX is unable to reach the internet. If you still see issues after following the steps, contact JTAC for further assistance.

In addition, if the SRX is able to reach the internet, but the LAN network cannot access the internet, please follow the following steps in addition to the steps above:

1. Check if the LAN interface is assigned to a zone - "show configuration security zones | match <lan_interface>"
2. Check if there is a security policy to allow traffic - "show security policies from-zone LAN to-zone WAN | display set"
3. Note, if there is a match condition in the security policy for "dynamic-application", APPID database is required for the policy to trigger. Either delete this match condition or download the APPID database.
4. Check if there is a source NAT enabled - "show configuration security nat source | display set"
5. Check for flow session - "show security flow session interface <lan_interface>", if there are flows and the OUT packet and bytes count are 0, contact ISP.
6. If there are no flow sessions, check for drops - "monitor security packet-drop" and check if the issue can be resolved.

If these steps do not help to resovle the issue, please contact JTAC for further assistance.