When attempting to install the IDP security package you may see the following error:
root@jtac-SRX340> request security idp security-package install
error: Security Package installation disabled temporarily due to invalid license.
You may also see it on one or both nodes in cluster:
{primary:node0}
root@SRX-4600> request security idp security-package install
node0:
--------------------------------------------------------------------------
node1:
Will be processed in async mode. Check the status using the status checking CLI
root@SRX-4600>
First, you must check the status of the licenses on the SRX devices
root@SRX-4600> show system license
License usage:
Licenses Licenses Licenses
Feature Feature Feature
Feature name used installed needed Expiry
remote-access-ipsec-vpn-client 0 2 0 permanent
remote-access-juniper-std 0 2 0 permanent
Licenses installed: none
If there is no current IDP license, this is required in order to do an IDP security package install. Please contact your Juniper sales representative if you do not have a license.
Valid license example:
{secondary:node1}
idp-sig 1 1 0 2025-06-25 21:00:00 -03
Licenses installed:
License identifier: DemolabJUNOS627692123
License version: 4
Valid for device: JN126B8AXXXX
Customer ID: Juniper Internal
Features:
idp-sig - IDP Signature
date-based, 2024-06-24 21:00:00 -03 - 2025-06-25 21:00:00 -03
If you do have a valid license but still see the error, we need to make sure there are not a lot of expired licenses listed
If there are expired IDP licenses, we will need to remove them
License identifier: DemolabJUNOS943544309
date-based, 2024-05-24 21:00:00 -03 - 2024-06-25 21:00:00 -03
License identifier: DemolabJUNOS337692125
date-based, 2024-04-24 21:00:00 -03 - 2024-05-25 21:00:00 -03
License identifier: DemolabJUNOS677692729
date-based, 2024-03-24 21:00:00 -03 - 2024-04-25 21:00:00 -03
License identifier: DemolabJUNOS827592143
date-based, 2024-02-24 21:00:00 -03 - 2024-03-25 21:00:00 -03
We can delete the expired licenses with the following command:
root@SRX-4600> request system license delete DemolabJUNOS827592143 Delete license DemolabJUNOS827592143 ? [yes,no] (no) yes
Continue removing the expired licenses one by one until only current licenses remain, we can then retry the install.
root@srx340> request security idp security-package install status Done;Attack DB update : successful - [UpdateNumber=3758,ExportDate=Thu Nov 14 14:19:00 2024 UTC,Detector=12.6.160240409] Updating control-plane with new detector : successful Updating data-plane with new attack or detector : successful
If there is a current valid license and there are no additional expired licenses, the IDP database is likely corrupted.
Please see KB72736 [juniper.net]. The title specifies srx340, but it applies to all SRX.
2024-11-19 : Article Created