One reason for anti-virus update failure is because there are no routes to reach the internet in the inet (default) routing table.

An SRX device updates the anti-virus signature from the update server (example - http://update.juniper-updates.net/AV/SRX550/ ). It will look for routes in the inet (default) routing table. We must be able to reach the name server and update server from the inet routing table.

Anti-virus signature update failed:

root@LAB_SRX> show security utm anti-virus status
UTM anti-virus status:

Anti-virus key expire date: 2017-02-01 00:00:00
Update server: http://update.juniper-updates.net/SAV/
Interval: 1440 minutes
Pattern update status: next update in 1433 minutes
Last result: download version file failed <<<<<<<<<< Anti-virus signatures update failed
Anti-virus signature version: Not loaded      
Scan engine type: sophos-engine
Scan engine information: Load failure (general error)

There could be many different causes. In this particular scenario, we will look at a routing issue that caused the anti-virus signature update failure.

Check the reachability of the name server and the update server (example - http://update.juniper-updates.net/AV/SRX550/ )

While checking reachability in the above destination, make sure they are reachable from the default routing instance (inet).

In this case, there is no internet reachability from the inet table.

root@LAB_SRX> ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
ping: sendto: No route to host
ping: sendto: No route to host
^C
--- 8.8.8.8 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss


root@LAB_SRX# run show route

inet.0: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

10.0.0.0/8 *[Direct/0] 00:01:11
                                          > via lo0.0
10.0.0.1/32 *[Local/0] 00:01:11
                                              Local via lo0.0

R1.inet.0: 4 destinations, 4 routes (4 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

80.10.111.0/24 *[Direct/0] 00:12:31
                                           > via ge-0/0/4.0
80.10.111.1/32 *[Local/0] 00:12:31
                                              Local via ge-0/0/4.0
192.168.11.0/24 *[Direct/0] 00:12:31
                                            > via ge-0/0/3.0
192.168.11.1/32 *[Local/0] 00:12:31
                                           Local via ge-0/0/3.0

Import a route from the routing table which has internet connectivity.

Here, the routing table R1.inet.0 has a route to the internet. Be sure to import directly connected routes from inet to R1, in order to complete the routing for return traffic.

Importing R1 interface route to inet: