Even though 'set system default-address-selection' is configured, the loopback interface IP is not used as the source IP to establish connectivity to the EWF or Websense server rp.cloud.threatseeker.com.  Instead, it uses the exit interface IP from the dataplane. Return traffic will fail if the exit interface does not have any public IP or if there is no other source NAT for the EWF traffic to translate the existing interface private IP into public IP.

In deployments where:

• ​Loopback interface is used as the source address for all locally generated IP packets,
• ​​Loopback interface has a public IP to avoid any NAT issue communicating to the public cloud and
• Exit interface doesn't have a public IP, the EWF server status shows DOWN.

Ping or telnet (to port 80) to the EWF severs looks fine. However, the status shows DOWN:

The 'show security flow session destination-prefix <server's IP address> ' command shows " Pkts" in one direction only, and not bidirectional. It will also show the Source IP details of the exit interface.

Loopback interface is considered as part of the RE and 'default-address-selection' is only supported on the RE and not on the PFE. However, the EWF traffic to the EWF/Websense server is initiated from the PFE in Junos OS version 15.1X49 and higher.

Therefore, when we initiate the PING/telnet manually, it's considered RE traffic, uses the public IP, and returns traffic works accordingly.
But for the actual device to EWF server communication, it uses the exit interface IP and return traffic fails as the exit interface has a private IP without any NAT activity.

Source NAT can be configured from the junos-host zone to the exit interface zone to source NAT any traffic specific to the EWF/Websense servers rp.cloud.threatseeker.com.

2019-09-19: Minor, non-technical edits.
2020-09-06:  Updated server from cluster-k.cloud.threatseeker.com to rp.cloud.threatseeker.com due to recent issues with cluster-k server and being currently unsupported.