This article explains the timeout issue while retrieving complete rule details from a policy. The call fails with HTTP 504 at exactly 600 seconds.

The affected versions are 24.1R5 and 26.1

Here are the API details:

GET /api/juniper/sd/policy-management/firewall/policies/detailedPolicy/{policy-id}
Header:
Accept: application/vnd.juniper.sd.policy-management.firewall.policy+json;version=2;q=0.02

Here is the Root Cause of the issue:

The frontend Apache reverse proxy enforces a connection timeout (ProxyTimeout 600 in /etc/httpd/conf.d/webConf/webProxy.conf). If the number of rules and addresses are huge, the backend JBoss server takes ~12 minutes to process, construct, and serialize the entity graph from the database. Apache severed the connection at the 10-minute (600-second) threshold before JBoss finished transmitting, resulting in the HTTP 504 Gateway Timeout. 

Please follow the workaround below to fix the issue:

 1. Update ProxyTimeout to 1200 (or 1800) in /etc/httpd/conf.d/webConf/webProxy.conf.

 2. Reload Apache: systemctl reload httpd (or service httpd reload).

 3. Ensure client tools/scripts (curl, Postman, automation scripts) have their read/socket timeout configured above 15 minutes.

Steps to be followed:

# cd /etc/httpd/conf.d/webConf/

# cp webProxy.conf /home/admin/webProxy.conf

# vi webProxy.conf

Update ProxyTimeout to 1200 (or 1800) in /etc/httpd/conf.d/webConf/webProxy.conf by editing the file using the command "vi /etc/httpd/conf.d/webConf/webProxy.conf"

The changes will be part of the upcoming release.