This article lists the common mistakes while using the UTM (Unified Threat Management) feature on the Branch SRX series platforms.

Symptoms:

• Warning messages are reported when trying to configure UTM
• Warning messages about an expired trial license are reported
• Cannot download database updates
• Traffic is not hitting the expected UTM policy

For UTM configuration help, refer to the following articles:

• Antivirus Express    (KB16440) [juniper.net]
• Antivirus Sophos     (KB21889) [juniper.net]  
• Integrated Web Filtering    (KB16334) [juniper.net]       
• Enhanced Web Filtering    (KB22483) [juniper.net]       
• Redirect Web Filtering    (KB16444) [juniper.net]
• Antispam     (KB17286) [juniper.net]
• Content Filtering     (KB17285) [juniper.net]

Also, for additional configuration help and examples, refer to the Technical Documentation:  UTM (Unified Threat Management)

Common UTM issues 

The common UTM configuration errors found in JTAC are as follows. Step thru this checklist to confirm your setup and configuration:

1. Confirm feature is supported on your SRX device.

   Refer to the table of UTM features supported on SRX Series for your version of Junos:  
   Feature Explorer (UTM)

   Note:  UTM features will only run on high memory (highmem) devices. It will not run on lowmem devices.  Refer to KB15413 [juniper.net] on how to tell if your device is highmem.

2. Confirm licenses.

   These UTM features require a subscription license: Antispam, Antivirus, and Web filtering. You may have forgotten to load the license or the trial license may have expired. Run the following command to verify the licenses are installed:

     user@SRX> show system license 

   For information on how to activate, install, and verify the subscription license, refer to KB16675 - SRX Getting Started - Install license for Antivirus, Web Filter, IDP, or Antispam [juniper.net] .

3. Confirm DNS configuration.

   Run the following command to confirm that DNS is configured:

   user@SRX> show configuration system name-server

   If DNS is not configured, there may be issues with downloading pattern updates.

   For information on how to configure DNS, refer to KB15656 SRX Getting Started - SRX Getting Started - Configure DNS [juniper.net] .

4. Confirm NTP configuration.

   Run the following command to confirm NTP is configured:

   user@SRX> show configuration system ntp

   If NTP is not configured, this may affect the UTM features that have a subscription; there may be issues with downloading pattern updates. Also, if NTP is not configured, there may be an issue with scheduling Web Filtering based on time or day of week; see  KB19467 [juniper.net] .

   For information on how to configure and verify NTP, refer to KB15756 SRX Getting Started - Configure Time and NTP Client [juniper.net] .

5. Confirm the UTM policy is applied to the appropriate Security Policy.

   Note : It is mandatory to apply a UTM policy to Security Polices in order to use the UTM features. Otherwise, traffic will not hit the expected UTM policy.

   The UTM policy is always applied to transit traffic (in the Security Policy hierarchy) as follows:

     user@SRX# set security policy from-zone untrust to-zone trust policy test then permit application-services utm-policy <policy name>

   The above command illustrates applying a specific utm-policy for a security policy from the untrust to the trust zone. As a consequence of this command, all the traffic directed from the untrust to the trust zone would also be examined against the utm-policy.

Other UTM issues

• HIGH CPU after enabling UTM features
  In such a scenario it is advised to collect the UTM related information as mentioned in the KB21781-[SRX] Data Collection Checklist - Logs/data to collect for troubleshooting [juniper.net] and open a case with your technical support representative.
• False Positives
  There might be a scenario wherein the UTM feature such as Antispam or Web Filtering may block legitimate traffic. It is advised to collect the UTM related information as mentioned in the KB21781-[SRX] Data Collection Checklist - Logs/data to collect for troubleshooting [juniper.net] and open a case with your technical support representative.

2019-12-26: Removed Kaspersky references.
2020-08-03: Modified "show system name-server" to "show configuration system name-server"