This article describes the issue of an SRX administrator receiving the error: timeout communicating with idp-policy daemon message when downloading the IDP security package.

The SRX administrator receives the following error when downloading the IDP security package:

This issue is due to the firewall filter applied to the loopback interface to protect the Routing Engine, as described in KB19844 - Example - Creating a filter to protect a router from outside attack [juniper.net] , which will block the communication between SRX and the IDP server (services.netscreen.com).

Another term must be added to the firewall filter before the default-deny term to allow connections/packets from the IDP server (services.netscreen.com), or deactivate the filter while the package is being downloaded.

Use the additional term as follows to allow the connections destined to port 443 from the SRX (this will allow connections from SRX but not to SRX), as SRX uses an HTTPS connection to the IDP server for downloads:

set firewall family inet filter ProtectRE term Allow-IDP-Downloads from source-port 443
set firewall family inet filter ProtectRE term Allow-IDP-Downloads from tcp-established
set firewall family inet filter ProtectRE term Allow-IDP-Downloads then accept

Make sure that you place this term before the default-deny term.

• Quick Setup Guide for Configuring IDP on a SRX or J-Series device