• We will see that the 37 addresses are downloaded in the SRX from the Policy enforcer. Here is the sample output:

From PE:
 
[root@policy-enforcer ~]# curl -k -X GET http://localhost/api/v1/manifest.xml | grep -i office
 % Total  % Received % Xferd Average Speed  Time  Time   Time Current
                 Dload Upload  Total  Spent  Left Speed
100 7880 100 7880  0   0 88633   0 --:--:-- --:--:-- --:--:-- 89545
  <feed data_ts="1680042716" name="ipfilter_office365" objects="37" options="" types="ip_addr ip_range ip_subnet" version="20230302.1">
    <url>/api/v1/jsurf/IPFilter/ipfilter_office365/736e3d756e646566696e65640a646d3d756e646566696e6564fe640a</url>
[root@policy-enforcer ~]#
 
 
[root@policy-enforcer ~]# find /var/lib/feeder/feed_data -name "ipfilter_office365*" | xargs cat | grep 20230302.1
 

{"filter":null,"version":"20230302.1","schema_version":"189a3f546a","previous_version":null}
#del
#add
{"2":[225117848,1]}
{"2":[225117867,0]}
{"2":[225117888,0]}
{"2":[225118656,0]}
{"2":[225120778,1]}
{"2":[225120783,0]}
{"2":[225132544,16383]}
{"2":[225148928,1023]}
{"2":[225150976,1023]}
{"2":[225152006,0]}
{"2":[336863232,8191]}
{"2":[348028928,16383]}
{"2":[350715904,8191]}
{"2":[392667136,4095]}
{"2":[677117952,131071]}
{"2":[677380096,524287]}
{"2":[677904384,131071]}
{"2":[678100992,65535]}
{"2":[678199296,32767]}
{"2":[679346176,16383]}
{"2":[878706688,262143]}
{"2":[878968832,262143]}
{"2":[879230976,262143]}
{"2":[879493120,262143]}
{"2":[879755264,262143]}
{"2":[880410624,131071]}
{"2":[888032856,0]}
{"2":[888043405,0]}
{"2":[888415656,0]}
{"2":[888447183,0]}
{"2":[1747910656,32767]}
{"2":[1754431488,32767]}
{"2":[2214404567,0]}
{"2":[2230648832,65535]}
{"2":[2527797248,1023]}
{"2":[2527799296,1023]}
{"2":[3427780055,0]}
#end
 
From SRX:
 
cat manifest.xml | grep -i office
  <feed data_ts="1680042716" name="ipfilter_office365" objects="37" options="" types="ip_addr ip_range ip_subnet" version="20230302.1">
    <url>/api/v1/jsurf/IPFilter/ipfilter_office365/736e3d444a303431394152303032310a646d3d737278343130302687c9</url>
 
 
# show services security-intelligence category summary
 
Feed name       :ipfilter_office365
    Version       :20230302.1
    Objects number:37
    Create time   :2023-03-29 01:31:56 EEST
    Update time   :2023-05-08 01:32:06 EEST
    Update status :Expired
    Expired       :Yes
    Status        :Active
    Options       :N/A
 
 
root@:/var/db/secinteld/download # cat IPFilter_ipfilter_office365
{"filter":{},"version":"20230302.1","schema_version":"189a3f546a","previous_version":null}
#del
#add
{"2":[225117848,1]}
{"2":[225117867,0]}
{"2":[225117888,0]}
{"2":[225118656,0]}
{"2":[225120778,1]}
{"2":[225120783,0]}
{"2":[225132544,16383]}
{"2":[225148928,1023]}
{"2":[225150976,1023]}
{"2":[225152006,0]}
{"2":[336863232,8191]}
{"2":[348028928,16383]}
{"2":[350715904,8191]}
{"2":[392667136,4095]}
{"2":[677117952,131071]}
{"2":[677380096,524287]}
{"2":[677904384,131071]}
{"2":[678100992,65535]}
{"2":[678199296,32767]}
{"2":[679346176,16383]}
{"2":[878706688,262143]}
{"2":[878968832,262143]}
{"2":[879230976,262143]}
{"2":[879493120,262143]}
{"2":[879755264,262143]}
{"2":[880410624,131071]}
{"2":[888032856,0]}
{"2":[888043405,0]}
{"2":[888415656,0]}
{"2":[888447183,0]}
{"2":[1747910656,32767]}
{"2":[1754431488,32767]}
{"2":[2214404567,0]}
{"2":[2230648832,65535]}
{"2":[2527797248,1023]}
{"2":[2527799296,1023]}
{"2":[3427780055,0]}
#end
74fd9b18b794aa14e93dfae386a65a4a
root@LV-Firewall:/var/db/secinteld/download #

• As per the above output, the feeds are getting downloaded in SRX from PE. However, the version 20230302.1 has expired as per SRX. 
• The latest version as per the lab is 20230330.1 which shows the addresses (As per the JTAC Lab, this will change often)
• Hence, check if the version is showing old in the database as well using the below command:

# mysql -uroot -pmariadb -A feeder -e "select version from feed_files where cfg_name='ipfilter_office365'"
# mysql -uroot -pmariadb -A feeder -e "select version from feed_files_latest where cfg_name='ipfilter_office365'"

To fix the issue, please follow the below steps to delete the old feed data:

# mysql -uroot -pmariadb -A feeder -e "delete from dag where name='ipfilter_office365'"

# mysql -uroot -pmariadb -A feeder -e "delete from feed_files where cfg_name='ipfilter_office365'"

# mysql -uroot -pmariadb -A feeder -e "delete from feed_files_latest where cfg_name='ipfilter_office365'"

# service controller restart

# service feed_collector restart

# service feed_provider restart

Please wait for 1 hour and check if the issue has been fixed.

7th March 2024: Edited and published the article in a proper way