ATP cloud connectivity shows that it is connected, but file submission is not functioning for the Advanced Anti-Malware (AAMW) service.

• The control channel is connected.
• Traffic initiated from the SRX device through FXP0 for ATP control channel connections can be monitored using the 'monitor traffic interface' command.
  • However, it is not possible to distinguish between control and data plane connection requests.
• The configuration may include a source IP or source interface associated with the AAMW service that is not part of the default INET0.
  • It is also possible for the configuration to have a source IP from either the FXP.
  • Moreover, we may only have internet connectivity through a revenue interface (for example, RETH or XE-0/0/0.0) configured within a routing instance.
• Please note that the data channel connection cannot be confirmed using the "show services advanced-anti-malware status" command.

> show services advanced-anti-malware status

node0:
--------------------------------------------------------------------------
Server connection status:
 Server hostname: srxapi.ap-northeast-1.sky.junipersecurity.net
 Server realm: APAC-TEST
 Server port: 443
 Proxy hostname: 
 Proxy port: 
Control Plane:
Connection time: 2025-03-12 23:42:07 AED
Connection status: Connected <<<<<<<<<<<<< Control channel is connected
Service Plane:
  node0.fpc0
Connection active number: 0
Connection retry statistics: 703829 <<<<<< Retry counter incrementing
  node1.fpc0
Connection active number: 0
Connection retry statistics: 704582

• For SRX to establish ATP cloud connectivity, both RE and PFE need internet connectivity via INET0 only. 
• Non-revenue interfaces (like fxp0) should not be used as source addresses to establish ATP cloud connectivity via PFE, and traffic to AWS subnets (https://ip-ranges.amazonaws.com/ip-ranges.json) should pass through a revenue interface via the default routing instance inet.0

2025-03-19 : Article Created

2026-06-09 : Removed lo0 interface and added Related info

KB: ATP Cloud Data Channel Connectivity Issue when connectivity is via a routing instance

Techpub: ATP cloud