This article addresses the issue where an SRX device fails to connect to SKY ATP after applying a firewall filter. 

• The SRX device was unable to establish connectivity with SKY ATP after a firewall filter was applied.
• The firewall filter was configured using a static IP address that had been obtained by resolving the SKY ATP URL:

srxapi.ap-northeast-1.sky.junipersecurity.net

• SKY ATP uses dynamically changing cloud IP addresses, so relying on a static IP address in the firewall filter can cause connectivity failures when the IP address changes.

Modify the firewall filter to permit SKY ATP traffic based on TCP port 443 rather than specific destination IP addresses.

• If the firewall filter is applied as an input filter, configure a term to allow traffic with source-port 443.
• If both input and output filters are configured on the interface, add an additional term to allow traffic with destination-port 443.

This ensures that the SRX device can establish and maintain communication with the SKY ATP cloud service regardless of changes to the service's IP addresses.

Result

After updating the firewall filter to permit HTTPS traffic (TCP port 443) instead of relying on static SKY ATP IP addresses, the SRX successfully re-established connectivity with SKY ATP.