SkyATP will not connect as the incoming DNS response and port 443 connections from ATP cloud are dropped by the RE Protect firewall filter applied on the lo0 interface's INPUT direction.

AAMW connection stays disconnected with hostname lookup failed error:

root@SRX> show services advanced-anti-malware status

Server connection status:

 Server hostname: srxapi.ap-northeast-1.sky.junipersecurity.net

 Server port: 443

 Proxy hostname: None

 Proxy port: None

   Control Plane:

     Connection time: 2024-08-14 15:38:27 SGT

     Connection status: Server hostname lookup failed <<<

   Service Plane:

     master

       Connection active number: 17

       Connection retry statistics: 3362315

AAMW diagnostics fails with DNS error:

root@SRX> request services advanced-anti-malware diagnostics srxapi.eu-west-1.sky.junipersecurity.net detail

    [INFO]    Try to get IP address for hostname srxapi.eu-west-1.sky.junipersecurity.net

ping: cannot resolve srxapi.eu-west-1.sky.junipersecurity.net: Host name lookup failure

DNS check                                           : [Failure] <<<

Error: DNS lookup failure is detected, please check your DNS configuration

AAMW data connection test succeeds:

root@SRX> request services advanced-anti-malware data-connection test status

  master: Test OK. RTT = 112 ms. Test time: 2024-08-14 23:46:20 SGT.

Check route to the configured DNS Server IP and make sure its reachable. (show route <DNS Server IP>)
Check the flow session for name-server configured on SRX:

show security flow session destination-prefix 8.8.8.8

If the return wing bytes transfer is 0 (Zero) Bytes, take a flow trace for the name-server IP and make sure that the return packet is Permitted.

Flow trace will indicate that the return packet is Permitted or Blocked and whats the Policy causing it.

Check the policy and do required changes to allow DNS return traffic and SkyATP port requirements (Port : 443, 80 and 8080)

In the below example, the return packets were getting dropped by the RE Protect Filter applied on lo0 INPUT direction:

DNS Permit added:
set firewall family inet filter IPv4-PROTECT-RE term DNS from address 8.8.8.8/32
set firewall family inet filter IPv4-PROTECT-RE term DNS from address 8.8.4.4/32
set firewall family inet filter IPv4-PROTECT-RE term DNS from protocol udp
set firewall family inet filter IPv4-PROTECT-RE term DNS from source-port 53
set firewall family inet filter IPv4-PROTECT-RE term DNS then accept

ATP Permit added:
set firewall family inet filter IPv4-PROTECT-RE term ATP from source-port 443
set firewall family inet filter IPv4-PROTECT-RE term ATP from source-port 8080
set firewall family inet filter IPv4-PROTECT-RE term ATP from source-port 80
set firewall family inet filter IPv4-PROTECT-RE term ATP then accept

NOTE : Ensure that there is an explicit allow term defined on the Firewall filter else it could cause complete traffic drop on the interface. The above commands are added to the existing filter and hence not showing the explicit allow term.

Post the changes, AAMW connection was established successfully:

root@SRX> show services advanced-anti-malware status   
Server connection status:
Server hostname: srxapi.ap-northeast-1.sky.junipersecurity.net
Server realm: juniper-app
Server port: 443
Proxy hostname: None
 Proxy port: None
  Control Plane:
   Connection time: 2024-08-21 13:02:05 SGT
Connection status: Connected
Service Plane:
master
Connection active number: 1
Connection retry statistics: 3365692