After replacing Routing Engine on SRX5k device, IDP is not inspecting any packets although the loaded configuration is the same as it was on the previous Routing Engine.

IDP is installed:

user@srx5k> show security idp security-package-version 
node0:
--------------------------------------------------------------------------

  Attack database version:3780(Thu Feb  6 14:06:07 2025 UTC)
  Detector version :12.6.140240709
  Policy template version :N/A

When checking for "idp status", no traffic is being processed and IDP Policy Name is set to none:

user@srx5k> show security idp status 
node0:
--------------------------------------------------------------------------
...

State of IDP: Default,  Up since: 2025-02-17 15:33:39 UTC (00:21:48 ago)

Packets/second: 0               Peak: 0 @ 2025-02-17 15:33:39 UTC
KBits/second  : 0               Peak: 0 @ 2025-02-17 15:33:39 UTC
Latency (microseconds): [min: 0] [max: 0] [avg: 0]

Packet Statistics:
 [ICMP: 0] [TCP: 0] [UDP: 0] [Other: 0]
...

  Policy Name : none

This issue can occur in the following situation:

• Configuration copied from old RE /config/juniper.conf.gz to the new RE /config/juniper.conf.gz.
• IDP is not installed, but the device is rebooted and loads the configuration at startup.
• The configuration will be accepted if it's loaded at system start to avoid ending up in Amnesiac mode (normally, commit would fail in such case). However, the configuration will skip IDP part.
• When IDP is installed, the "Policy Name : none" will remain present and the following syslog entry will be printed:

Feb 17 15:53:56.102 2025  srx5k idpd[18987]: IDP_SECURITY_INSTALL_RESULT: security package install result(Done;Attack DB update : successful - [UpdateNumber=3780,ExportDate=Thu Feb  6 14:06:07 2025 UTC,Detector=12.6.140240709]      Updating control-plane with new detector : successful      Updating data-plane with new attack or detector : not performed       due to no active policy configured.)

• Even though the configuration has IDP policies present and security policies are configured to use them, no traffic will be IDP-processed as IDP process could not read the IDP configuration.
• To resolve this problem, issue a "commit full" command from configuration mode (Note: this will flap ipsec tunnels if any are estabilshed):
  • user@srx5k> configure 
  • user@srx5k# commit full and-quit

• Check policy status (it can take ~1-2 min. to update, depending on configuration):

user@srx5k> show security idp status 
node0:
--------------------------------------------------------------------------
...

  Policy Name : idp-policy-unified
  Running Detector Version : 12.6.130240709

• At this state, traffic is processed by IDP.