When configuring Enhanced Web Filtering (EWF) in a non-root virtual router (VR), an SRX device can ping the EWF Server successfully but the EWF Server is always down.

An example with unified threat management (UTM) running in the virtual router, VR_test, is as follows:

routing-instances {
    VR_test {
        instance-type virtual-router;
        interface ge-0/0/7.0;
        routing-options {
            static {
                route 0.0.0.0/0 next-hop 10.85.48.1;
            }
        }
    }
}

web-filtering {
    type juniper-enhanced;
    juniper-enhanced {
        server {
            host rp.cloud.threatseeker.com;
        }
        routing-instance {
            VR_test;
        }
        profile wf-nreca-default {
            category {
                Enhanced_Adult_Content {
                    action block;
                }
                Enhanced_Adult_Material {
                    action block;
                }
                Enhanced_Sex {
                    action block;
                }
            }
            default log-and-permit;
            fallback-settings {
                default log-and-permit;
                server-connectivity log-and-permit;
                timeout log-and-permit;
                too-many-requests log-and-permit;
            }
        }
    }
}

root@SRX-1> show interfaces terse routing-instance VR_test
Interface        Admin Link Proto  Local                Instance
ge-0/0/7.0       up    up   inet   10.85.48.130/24     VR_test

As seen here, the SRX device can ping rp.cloud.threatseeker.com with the resolved address 208.87.233.140.

root@SRX-1# run ping rp.cloud.threatseeker.com routing-instance VR_test
PING rp.cloud.threatseeker.com (208.87.233.140): 56 data bytes
64 bytes from 208.87.233.140: icmp_seq=0 ttl=44 time=9.203 ms
64 bytes from 208.87.233.140: icmp_seq=1 ttl=44 time=9.200 ms
64 bytes from 208.87.233.140: icmp_seq=2 ttl=44 time=9.231 ms
64 bytes from 208.87.233.140: icmp_seq=3 ttl=44 time=9.267 ms
^C
--- rp.cloud.threatseeker.com ping statistics ---
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max/stddev = 9.200/9.225/9.267/0.027 ms

But the Websense server is down.

root@SRX-1> show security utm web-filtering status
 UTM web-filtering status: 
    Server status: Juniper Enhanced using Websense server DOWN

And the following error is shown for the EWF Server in /var/log/messages .

Dec 20 15:32:48 utmd_ewf_server_resolve: gethostbyname_async failed rp.cloud.threatseeker.com retrying in 1 secs
Dec 20 15:32:48 utmd_ewf_server_resolve: gethostbyname_async failed rp.cloud.threatseeker.com retrying in 1 secs

This happens when the SRX device is unable to resolve the DNS of the Websense server in UTM.

To resolve this issue, add the virtual router for DNS resolution in the UTM configuration:

root@SRX-1# set security utm dns routing-instance VR_test
root@SRX-1# commit

root@SRX-1> show security utm web-filtering status
 UTM web-filtering status: 
    Server status: Juniper Enhanced using Websense server UP

Alternately, if the EWF Server is configured with the 208.87.233.140 IP address as below, the EWF Server is up.

root@SRX-1# set security utm feature-profile web-filtering juniper-enhanced server host 208.87.233.140

root@SRX-1> show security utm web-filtering status
 UTM web-filtering status:    
       Server status: Juniper Enhanced using Websense server UP