This article talks about a situation that occurs when an SRX is adopted under the MIST cloud while its configuration is administered by MIST and the device does not forward traffic despite the security policies being correctly configured.

The device will start to drop traffic due to the default policy, except for self-traffic from the device. This can be verified with either of the following:

• Security flow trace-options packet filter
• executing "monitor security packet-drop" specifying the source that is failing.

Please confirm in the MIST UI profile of the device, that the APPTRACK license is enabled.

This situation happens due to a combination of the standard security policies and its dynamic-application knob found in the match rules.

Most if not all devices that are MIST capable are capable of getting the APPtrack license enabled in them.

The APPtrack license can be enabled to use the site's settings (not recommended) or by selecting the "device HAS APPtrack license" (recommended)

After enabling said license, it would take approx. 15 minutes for the device to enable the license and resume forwarding of traffic.