After onboarding an SRX device to Mist, traffic may fail to pass through the firewall. This behavior is typically observed when the Application Identification (AppID) package is not installed or not running on the SRX. As a result, traffic can be denied by the default logical‑system policy.

Traffic is dropped by the SRX and logs indicate denial by the default logical‑system policy, for example:
Denied by Policy "default-policy-logical-system-00"

This may affect basic services such as DNS or NTP shortly after Mist onboarding.

1. Verify whether Application Identification (AppID) is installed on the SRX by running: show services application-identification version | no-more

2. If the version shows 0 or AppID is not installed, download the AppID package: request services application-identification download

3. Confirm the download is successful: request services application-identification download status

4. Once the download is complete, install the package: request services application-identification install

5. Check the installation status: request services application-identification install status

6. After installation is complete, verify the installed version: show services application-identification version

7. Test traffic again to confirm it is passing through the SRX.

If traffic still does not pass, collect the output of: show security packet-drop records and share it on the support case for further analysis.