On an SRX device, dynamic feed updates may fail, and the dynamic address summary may show 0 entries for the default and custom dynamic address instances.

Dynamic address feeds require the SRX to resolve the feed server hostname and then establish a TCP connection to the feed server on the configured port, typically HTTPS. If the TCP connection cannot be established, the feed download will fail, and the dynamic address entries will not be updated.

Collect dynamic address traceoptions, if there are any connection-related errors, check the following

DNS resolution

Ensure the SRX can resolve the feed server hostname to an IP address.

Verify that the configured DNS servers are reachable from the SRX.

Confirm that the resolved IP address is correct and belongs to the expected feed server.

If DNS resolution fails, check the device DNS configuration and routing to the DNS server.

If the SRX uses a routing instance for DNS, ensure DNS queries are sent through the correct routing instance.

Routing

Ensure that the SRX has a valid route to reach the dynamic feed server IP address.

Verify the correct routing instance is being used, if applicable.

Confirm the next-hop device can forward traffic toward the feed server.

NAT

If the SRX accesses the feed server through the internet, confirm source NAT is properly configured.

Ensure the translated source IP is allowed upstream.

Verify return traffic from the feed server can reach the SRX.

Upstream firewall or proxy

Check whether any upstream firewall, proxy, or security device is blocking the connection.

Ensure the feed server IP or FQDN is permitted.

Confirm that HTTPS traffic from the SRX to the feed server is not blocked or intercepted incorrectly.

Feed server reachability

Verify that the configured feed server is reachable from the SRX.

Confirm the feed server is listening on the configured port.

After correcting DNS, routing, NAT, or upstream connectivity issues, trigger or wait for the next dynamic feed update and verify that entries are populated.