Description

This KB article provides guidance on how to verify Sky Advanced Threat Prevention (SkyATP) connectivity through a configured proxy on Legacy Policy Enforcer (PE) or Security Director Insight (SDI) when acting as a Policy Enforcer.

It outlines common failure symptoms observed during SkyATP enrollment, including proxy connectivity issues and certificate enrollment errors, and explains how to validate communication between the Policy Enforcer and SkyATP cloud services.

The document also includes troubleshooting steps using tools such as curl and nc, required URL allowlisting, and verification of Security Intelligence feed downloads on SRX devices. Additionally, it highlights a known limitation in SDI as Policy Enforcer where the certificate enrollment utility is not proxy-aware, along with a temporary workaround.

Symptoms

Policy enforcer skyATP enrolment will fail with below error 

  • On Legacy Policy Enforcer or on SDI as PE
mysql -uroot -pmariadb -A feeder -e "select * from feedSource\G;"

*************************** 1. row ***************************
 id: 93359eb9-02b3-48a6-90b7-47a05479d46e
 name: [email protected]
 domain: abc-SkyATP-Realm
 feedSourceType: skyatp
 authMode: token
 token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxLCJlbWFpbCI6ImRsLnNucy5zZWN1cml0eS5ydW5Ad2VzdHBhYy5jb20uYXUiLCxxxxJ0b2tlbl9pZCI6IjFiNWRiNDQzLsdfsdgWYzZTktNDg4OC04YjBkLTJmOTE0MjI3OTYyOCIsInRva2VuX25hbWUiOiJXQkMtQVBBQy1Ta3lBVFAtUmVhbG0tc2QtOTAxNjUzNSIsImFjY2Vzc19ncm91cHMiOlsiU2VjdXJpdxxxxxxxxZWN0b3IiXSwiZXhwIjoxNzQwNxxxxxTUyNTM2LCJnZW5pZCI6IlBhQjdiUG1MdUluOXlLYWtnT0NpL1RzVkZabS9ucXhZYzNCZTMrdXVzWXg2VmdZbFNSVERFa0k2SkpWTlhNeDJWMUtVbUsza1E0NWYyUWdGbllrVU4vZE5HQmtnMGlzVC9xdXAvTUZ5TzQ0PSJ9.4pfspEemKsCcou02689l0NWjWI1pNjoXwl5XC1cfmPw
 region: apac
 feedSourceUrl: https://apac.sky.junipersecurity.net/
 createTs: 1709016537
 updateTs: 1709087724
 enrollStatus: FAILURE
 statusReason: CalledProcessError Command '['/srv/feeder/scep/getClientCert.sh', '-s', '/srv/feeder/scep', '-p', 'ProxyIP:Port', '/tmp/93359eb9-02b3-48a6-90b7-47a05479d46e.1709016538.6', u'oa2ljm2py14g5xue:PolicyEnforcer:UN7E58065EAD', 'ucm7cxg0l1s9x5bl', u'http://ca.junipersecurity.net:8080/ejbca/publicweb/apply/scep/SRX/pkiclient.exe', 'skyatp']' returned non-zero exit status 95
 ipv6Enabled: 0

 

Below errors observed in logs:

  • Legacy PE:
    /srv/feeder/log/controller.log

  • SDI as PE:
    /opt/policy-enforcer/srv/feeder/log/controller.log
  • Sample Error:
controller: [02/28/2024 03:44:12] [ERROR] [enroll] [7f4ac73f0700] - Could not execute command Command '['/srv/feeder/scep/getClientCert.sh', '-s', '/srv/feeder/scep', '-p', '10.x.x.x:xxxx', '/tmp/89161785-0d8f-4922-bec3-7d5c628d01eb.1709091831.1', u'5hbk7cjtz8xe7cpq:PolicyEnforcer:UND433B64AD6', 'ortqaiwltzyw5izz', u'http://ca.junipersecurity.net:8080/ejbca/publicweb/apply/scep/SRX/pkiclient.exe', 'skyatp']' returned non-zero exit status 95
controller: [02/28/2024 03:44:12] [ERROR] [enroll] [7f4ac73f0700] - CalledProcessError Command '['/srv/feeder/scep/getClientCert.sh', '-s', '/srv/feeder/scep', '-p', '10.x.x.x:xxxx', '/tmp/89161785-0d8f-4922-bec3-7d5c628d01eb.1709091831.1', u'5hbk7cjtz8xe7cpq:PolicyEnforcer:UND433B64AD6', 'ortqaiwltzyw5izz', u'http://ca.junipersecurity.net:8080/ejbca/publicweb/apply/scep/SRX/pkiclient.exe', 'skyatp']' returned non-zero exit status 95
controller: [02/28/2024 03:44:12] [ERROR] [enroll] [7f4ac73f0700] - Traceback (most recent call last):
 File "/usr/local/lib/python2.7/site-packages/tr_controller/enroll.py", line 735, in enrollToATP
  self._scep_enroll(feedSource, file_storage, dbFeedSource.FEED_SOURCE_TYPE_SKYATP)
 File "/usr/local/lib/python2.7/site-packages/tr_controller/enroll.py", line 487, in _scep_enroll
  result = subprocess.check_output(command_line, shell=False)
 File "/usr/local/lib/python2.7/subprocess.py", line 574, in check_output
  raise CalledProcessError(retcode, cmd, output=output)

CalledProcessError: Command '['/srv/feeder/scep/getClientCert.sh', '-s', '/srv/feeder/scep', '-p', '10.x.x.x:xxxx', '/tmp/89161785-0d8f-4922-bec3-7d5c628d01eb.1709091831.1', u'5hbk7cjtz8xe7cpq:PolicyEnforcer:UND433B64AD6', 'ortqaiwltzyw5izz', u'http://ca.junipersecurity.net:8080/ejbca/publicweb/apply/scep/SRX/pkiclient.exe', 'skyatp']' returned non-zero exit status 95
Proxy connectivity test fails with below error:
[root@PE]# curl -v http://ca.junipersecurity.net:8080 --proxy ProxyIP:Port
* About to connect() to proxy ProxyIP:Port port x.x.x.x (#0)
*   Trying ProxyIP... connected
* Connected to ProxyIP (x.x.x.x) port x.x.x.x (#0)
> GET http://ca.junipersecurity.net:8080/ HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.21 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: ca.junipersecurity.net:8080
> Accept: */*
> Proxy-Connection: Keep-Alive
> 
* HTTP 1.0, assume close after body
< HTTP/1.0 503 Service Unavailable
< Connection: close
< 
qWKNsMAj0H/m+J/iI7hm9xX4t2WGwfubvVxVQV2D4ExPfVvcLecPddQaC9AGpJRER/6OaQUDMJxzf5K/e+98lrsMgJjtayXn7LJY5tIDu2zdM5JYHshmP2ZxHxGlU8Sn6fwew8Phop+J6D08RSMrMWOOMByKMrUEIIFAUA0BMg6bzGirX2ljz2Yn1tQ+ngSSiuxo8v4zlsEUZkdllYYGEBBWCzgr5QP2oxl7YY+Vk++MKDc41EoSuJvQ4XR+VT+vW+lhsNCcIK+iiEYxgPGHRzQy9cYzmcOKtvxHYgjMJZgENoorxTUcBUrJJ8ZqOtH7+P/BBgAH5CtgNDV3NsAAAAASUVORK5CYII=" /></center>
</div>
</div>
<div id="textbody">
<table border="0" cellpadding="30"><tr><td>
<center><p style="font-size:18px"><b>
A connection could not be established.
</b></p></center>
<br>
Host: <i>ca.junipersecurity.net:8080</i><br><br>
The proxy could not connect to the site you've requested. The site is either down or the network connection cannot be made. Please check your spelling and try again if you feel you've encountered this message in error.
<br>
<p>Click <b>Go Back</b> or use the browser's Back button to return to the previous page.<br><input type="button" value="      Go Back      " onclick="javascript:history.back()"></p>
</td></tr></table>
</div>
</body>
</html>

 

  • Required SkyATP URLs are not allowed through the proxy
  • Proxy is unable to establish connectivity to SkyATP services/URLs
  • In SDI as PE, the sscep utility (used by getClientCert.sh) is not proxy-aware and attempts direct connections to SkyATP URLs
  • On SRX device: SkyATP enrolment through PE will fail with below error
user@srx_device> request services security-intelligence download status       
Security intelligence feed download status:
Start time:Mon Mar 18 05:30:35 2024
Start downloading the latest manifest.
Download manifest failed<http return error code 301> [0][301]

Solution

A) Ensure the following URLs are reachable via the proxy (APAC region):

For Asia Pacific Region

•    https://apac.sky.junipersecurity.net
•    https://cloudfeeds-tokyo.sky.junipersecurity.net
•    https://cloudfeeds.sky.junipersecurity.net
•    http://va.junipersecurity.net
•    http://ca.junipersecurity.net:8080


Note: Depending on the configured region(North America, European, Canada or Asia Pacific) traffic needs to be allowed for SkyATP URLs. Refer Policy Enforcer Ports user guide for more details.

 

B) Proxy connection can be verified through the below utilities:

1) Through Curl utility

Example:
# curl -v -x http://ProxyIP:Port https://apac.sky.junipersecurity.net 
# curl -v -x http://ProxyIP:Port https://cloudfeeds-tokyo.sky.junipersecurity.net
# curl -v -x http://ProxyIP:Port https://cloudfeeds.sky.junipersecurity.net
# curl -v -x http://ProxyIP:Port http://va.junipersecurity.net
# curl -v -x http://ProxyIP:Port http://ca.junipersecurity.net:8080

2) Through NC utility

Example:
# nc -vv -z --proxy  ProxyIP:Port apac.sky.junipersecurity.net 443
# nc -vv -z --proxy  ProxyIP:Port  http://ca.junipersecurity.net:8080
# nc -vv -z --proxy  ProxyIP:Port  http://va.junipersecurity.net
# nc -vv -z --proxy  ProxyIP:Port  ca.junipersecurity.net 8080
# nc -vv -z --proxy  ProxyIP:Port cloudfeeds-tokyo.sky.junipersecurity.net 443
# nc -vv -z --proxy  ProxyIP:Port cloudfeeds.sky.junipersecurity.net 443
# nc -vv -z --proxy  ProxyIP:Port va.junipersecurity.net 80

 

Note: Successful connectivity indicates proxy is correctly configured.


C) To remove unwanted whitelisted Proxy entries in SkyATP portal Navigate to Sky ATP Portal -> Configure -> Misc Configuration -> Proxy server -> Remove any unused or incorrect proxy IP entries.


D) To verify if Sec-Intel feeds download is successful on SRX devices:
 

EXAMPLE 1: To verify security-intelligence feed download status, run the below command:

user@router> request services security-intelligence download status       
Security intelligence feed download status:
Start time: Mon Mar 18 05:28:35 2024
Security intelligence url is not configured.
End time:Mon Mar 18 05:28:35 2024

We need to make sure the below security-intelligence config is present on the device. 

1) Sample output if feeds are managed through legacy PE

user@router> show configuration services security-intelligence | display set     
set services security-intelligence url https://PE-IP:443/api/v1/manifest.xml
set services security-intelligence authentication auth-token <token>

2) Sample output if feeds are managed through SDI as PE

user@router> show configuration services security-intelligence | display set     
set services security-intelligence url https://PE-IP:444/api/v1/manifest.xml
set services security-intelligence authentication auth-token <token>

Note: If using SDI as Policy Enforcer, ensure that traffic on port 444 is permitted between the SRX device and the SDI Policy Enforcer.

 

Note: If above config is missing then need to re-add the device under secure fabric by following below action. Once Enforcements points is re-added then SD will trigger Execute RPC job to push required security-intelligence configuration on the selected SRX device.

SD UI -> Devices - > Secure Fabric -> Sites -> Add or Remove Enforcement points.

Execute RPC jobs can be verified from below page and Execute RPC job also helps you to understand SRX device enrolment via PE is successful or not, for more details click on view results:
 

Network Management Platform -> Jobs -> Job management -> Job Type : Execute RPC

 

EXAMPLE 2: If you face the below error then need to re-trigger download on SRX device

user@router> request services security-intelligence download status       
Security intelligence feed download status:
Start time:Mon Mar 18 05:30:35 2024
Start downloading the latest manifest.
Download manifest failed<http return error code 301> [0][301]. 
user@router> request services security-intelligence download

user@router> request services security-intelligence download status    
Security intelligence feed download status:
Start time:Mon Mar 18 05:32:35 2024
Start downloading the latest manifest.
Start parsing manifest file.
Parse manifest succeeded, version:c8771a458d0a658bc13f2991aea9767a.
Start handling new category: CC.
Start downloading schema of category CC.
Start parsing schema of category CC.
Parse schema of category CC version 5198fff97c succeeded.
Start handling new feed cc_domain_threatfox of category CC.
Checking feed cc_domain_threatfox (20240317.1) of category CC.
Downloading feed cc_domain_threatfox (20240317.1) in category CC.
Download feed cc_domain_threatfox (20240317.1) in category CC succeeded
Validate feed cc_domain_threatfox (size:2510).
Validate feed file cc_domain_threatfox succeeded.
.
End time:Mon Mar 18 05:33:39 2024
 

E) Workaround for SDI as Policy Enforcer
Known Bug (PR: 1947147) on Security Director Insight where getClientCert.sh uses sscep, which does not support proxy by default. 

Workaround: 

Manually configure proxy in the script:

  1. Navigate to:
    # cd /opt/policy-enforcer/srv/feeder/scep

    

    

    

    

    

    

    

  2. 

    Edit getClientCert.sh and add under line 50:
    

    

    

    

    

    

    

    

    

    proxyServer="ProxyIP:Port"

    

    

    

    

    

    

    

    

    

  3. Restart controller service using below command
    #systemctl restart controller

  4. 

    Retry SkyATP enrollment from SD UI:
    

    

    

    

    

    

    

    

    

    

    

    

    

    Threat Prevention → Feed Source → Add/Retry
    

    

    

    

    

    

    

    

    

    

    

    

    



Please Note: This is a temporary workaround for SDI as PE, Permanent fix is available on 26.1R1 SDI. 

If you face any issues, please contact JUNIPER JTAC Support for assistance.


 
Modification History
2024-03-19 : Article Published
2024-08-08: Minor edits and made Public