Basic steps to check connectivity between SRX firewall and Mist portal

SRX firewall appears as disconnected in the Mist UI

Step 1:

There should be at least one revenue interface part of the untrust zone having a valid IP address.

Step 2:

There should be internet reachability from the firewall

user@host> ping 8.8.8.8

PING 8.8.8.8 (8.8.8.8): 56 data bytes

64 bytes from 8.8.8.8: icmp_seq=0 ttl=117 time=22.996 ms

64 bytes from 8.8.8.8: icmp_seq=1 ttl=117 time=24.747 ms

64 bytes from 8.8.8.8: icmp_seq=2 ttl=117 time=16.528 ms

Step 3:

Check if the firewall can resolve oc-term.mistsys.net

user@host> ping oc-term.mistsys.net

PING ab847c3d0fcd311e9b3ae02d80612151-659eb20beaaa3ea3.elb.us-west-1.amazonaws.com (13.56.90.212): 56 data bytes

if it is not resolving, then check the DNS servers configured on the switch:

user@host> show configuration | display set | grep name-server

set system name-server 8.8.8.8

set system name-server x.x.x.x**

Step 4:

Check if TCP port 2200 is allowed in your Firewall. This port is used to reach the Mist cloud environment.

If the firewall can reach Mist through TCP port 2200, you will see an output similar to this:

user@host> show system connections | grep 2200

tcp4 0 0 192.168.1.100.59055       10.10.90.212.2200       ESTABLISHED

If the communication is failing over port 2200, you will see something similar to this:

user@host> show system connections | grep 2200

tcp4 0 0 192.168.1.100.59055       10.10.90.212.2200       TIME_WAIT

Step 5:

In the configuration mode, check the outbound SSH configuration:

Note: Check if ‘device-id’ is in the format <org_id>.<mac_addr>

user@host# show system services outbound-ssh

traceoptions {

file outbound-ssh.log size 64k files 5;

flag all;

}

client mist {

device-id abcdef-abcd-12a2-ab12-2d9902f14a7e.aabbccddeeff;

secret "$9$L7i7-wgoJUDkg49Ap0IRrevW-VYgoDHqWLGDkqQzRhcreWLX-Vs2XxGDHkPfn/Cp0IcSeMLxn/LxNws5Qz6tuRhSv8Xrl87dVY2TzF/uOEcyKWLleUjikPfIEhSrvxNdbYgRhK8x7Vbk.mf5F9CuOBEtp0IcSMWoJZjmfFn/CA05TIEhSeK4aJUjqP5Q9tu4an/CtOB7-dboJZUjHmfaJn/ApREevW8X-YgoiqmxNb2gaUD69Cp1RSyKMLxCtORSrvM7-VboJDjqPTzNdmfzF/9vW8LdbY2aZGisY4ZDif5z3690BylKWX7KvZUHkTQlKvW-VJGDiqmGU/CtuEhKM87wYaJDkqfoaQFn6At1RhrM8xNd"; ## SECRET-DATA

keep-alive {

retry 3;

timeout 5;

}

services netconf;

oc-term.mistsys.net {

port 2200;

retry 1000;

timeout 60;

}

}

Step 6:

Check log messages and look for anything related to Mist, outbound SSH or the IP address resolved in step 3 (in this case 13.56.90.212).

In case of any error, please contact Juniper Technical Support.