Managed SRX devices are unable to retrieve the IDP signature package through SD Cloud. When the device relies on a routing instance for outbound connectivity, the signature download initiated by SD Cloud fails. The SD Cloud UI reports a download failure, and device-side NETCONF trace options show errors during the curl execution of the sigpack download command.

• IDP signature download fails on SRX devices managed by SD Cloud, where SDC UI shows the below error:
  “Download and install of sigpack files from Storage Failed”
  
  
• NETCONF traceoptions on SRX show the SD Cloud–initiated curl command failing with:

Error snippet from SRX device netconf traceoption for the reference: 

May  2 04:51:48 [NETCONF] - [98853] Outgoing: <output>
May  2 04:51:48 [NETCONF] - [98853] Outgoing: ld-elf32.so.1: /usr/lib32/nss_vrf.so.1: Undefined symbol "rtslib_open"

• Note: Failure occurs specifically when devices must use a routing-instance for internet access

SD Cloud currently does not support the use of routing-instances when delivering IPS/IDP signature packages to managed devices.
Because the SDC-initiated file download is not VRF-aware, the device cannot complete the signature retrieval when a routing-instance is required for external connectivity. Support for routing-instances in SD Cloud signature delivery is targeted for SDC 25.3 (Q4 release Tentively  ).

Until routing-instance support is available natively, use the following workaround:

Workaround: Configure signature updates directly on each SRX

For each affected SRX device that uses a routing-instance for internet access:

1. Configure the routing instance under the IDP security package:
   set security idp security-package routing-instance <routing-instance-name>
   
   
2. Apply this either:
   • Globally, via Devices → Configuration Template, or
   • Individually, via Devices → Device Configuration
     
     
3. Enable Auto Update on the SRX, allowing the device to fetch signatures directly from:
   • signatures.juniper.net

This ensures the SRX keeps its signature database updated automatically, bypassing the need for SD Cloud to install signatures manually.

If you face any further issues, please contact JUNIPER JTAC Support for assistance.