Copying the configuration of the old SRX device into the new SRX device after initiating Return Material Authorization (RMA), and then enrolling the new device through the Sky ATP Portal may cause the new device to crash.
This article gives the cause for the device to crash, and suggests what must be done to avoid the problem.
Policy Enforcer (PE) supplies an Authorization Token that is used for the Security Intelligence functionality. If a device requires an RMA (due to some hardware failure), customers typically copy the configuration to the new SRX device ( KB21134 - [SRX] RMA replacement of a node in a Chassis Cluster [juniper.net] ) in order to reduce down time. However, if the new device is not disenrolled first through Policy Enforcer or through the Sky ATP Portal Disenrollment script, which will remove all Advanced Anti-Malware and Security Intelligence configuration such as the Authorization Token, the new SRX device will crash due to conflicted configuration.
To avoid this problem, it is advised to disenroll the new device as follows:
Execute the disenrollment script that is available on the Sky ATP Security Portal in the SRX Command Line Interface (CLI).
For more information, see Removing an SRX Series Device From Juniper Sky Advanced Threat Prevention .
Execute the enrollment procedure through PE or the Sky ATP Security Portal.
For enrollment through PE, see Creating Sky ATP Realms and Enrolling Devices or Associating Sites .
For enrollment through the Sky ATP Security Portal, see Enrolling an SRX Series Device With Juniper Sky Advanced Threat Prevention .
Ensure that the SRX device is connected to Policy Enforcer or is connected directly to Sky ATP by using the following options as appropriate:
To verify that SRX and Sky ATP are connected through Policy Enforcer, see Policy Enforcer Threat Prevention .
To ensure that the device is directly connected to Sky ATP Cloud Security Intelligence and Advanced Anti-Malware (ensure that Services Plane and Control Plane are connected), use:
show services advanced-anti-malware status
To verify that the configuration on the SRX device is correct for Advance Anti-Malware and Security Intelligence, use:
show configuration services advanced-anti-malware connection url https://srxapi.us-west-2.sky.junipersecurity.net; authentication { tls-profile aamw-ssl;
show configuration services security-intelligence url url https://cloudfeeds.sky.junipersecurity.net/api/manifest.xml;