SSR appears disconnected in the Mist UI, but SSR was connected previously.

• Wan Edge shows disconnected on the MIST UI, but had been working
• SSR was not recently replaced
• Unable to onboard device to mist, connection fails
• ssr down in mist
• ssr not connected to mist
• ssr connection down for a few minutes for many devices

• cli "show mist"  device-ID shows 00-00-00-00-00-00
  • Likely appears when SSR is not able to connect to mist properly

If many devices are impacted

Check if many devices across the organization are all showing disconnected from MIST.

If multiple devices all disconnected at the same time, this could be a MIST upgrade (devices should reconnect in a few minutes), an ISP issue or rare MIST infrastructure problem.   Contact JTAC to investigate

Investigating from SSR CLI

SSR CLI access is required to investigate further,  Use SSH if enabled (generally not enabled for MIST managed devices), or connect to SSR serial console (console cable)  as t128 or root user

Note:  Log your CLI session as you complete these steps for faster resolution if support team assistance is needed.

DNS resolution failure

Check Connectivity to MIST and Certificate.

From SSR CLI

Determine URL from Mist documentation for region https://www.juniper.net/documentation/us/en/software/mist/mist-management/topics/ref/firewall-ports-to-open.html  "SSR Series Routers"

Check connection using curl. (using the URL matching your MIST region)

curl -v  -k https://ep-terminator.mistsys.net

Note: This command can be checked for comparison from other linux and sometimes windows systems. 

This test confirms DNS and https connection is succeeding.

Connection is failing when TLS certificate is not seen, or certificate name does not match the requested MIST connection server, there may be TLS inspection or proxy in the path disrupting the connection.

Example Good test result (connection was made, but did not get a webpage back)

~]$ curl -v -k https://ep-terminator.mistsys.net
* About to connect() to ep-terminator.mistsys.net port 443 (#0)
*   Trying 54.215.66.166...
* Connected to ep-terminator.mistsys.net (54.215.66.166) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* skipping SSL peer certificate verification
* SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate:
*     subject: [email protected],CN=ep-terminator.mistsys.net,OU=Devops,O=Mist Systems Inc.,ST=California,C=US
*     start date: Oct 01 00:00:00 2015 GMT
*     expire date: May 27 18:52:31 2027 GMT
*     common name: ep-terminator.mistsys.net
*     issuer: [email protected],CN=Mist Systems Internal Endpoint production CA (2025),O=Mist Systems Inc.,L=Cupertino,ST=California,C=US
> GET / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: ep-terminator.mistsys.net
> Accept: */*
>
< HTTP/1.1 404 Not Found
< Content-Type: text/plain; charset=utf-8
< X-Content-Type-Options: nosniff
< Date: Thu, 27 Aug 2026 00:08:11 GMT
< Content-Length: 19
<
404 page not found
* Connection #0 to host ep-terminator.mistsys.net left intact

If this connection was successful, you see an output similar to above, specifically the server certificate, subject line should match.

SSR with dedicated mgmt-0 port

 Note: SSR will prefer  mgmt-0 port when connected.

Restart mist agent

If "show mist" from PCLI shows  UP, 

Check the status of the Mist agent

•  systemctl status 128T-mist-agent -l

Restart 128T-mist agent

• systemctl restart 128T-mist-agent

Restart 128T process

• systemctl restart 128T

Check Logs 

Check  128T-mist-agent journal logs from tech-support-info or SSR CLI