Issue AAMW Phase Engine on SRX,

When downloading malware, the first download is successful.

SRX introduced the PHASE scan engine which performs inline scan.

When the SRX receives a traffic(file download) PHASE engine will do inline scan, it will check the PHASE cache for a matching signature, if there is no signature hit, file will be submitted to ATP cloud for scanning.

then ATP will return a verdict to SRX. While ATP is returning the verdict to SRX, it will update the PHASE cache as well.

Note: Even when the ATP returns a bad verdict to SRX, it will be too late to take the block action as the original session has been processed hence the first download will be successful incase if there is no matching signature in the cache