Customer was unable to reach the internet from the fxp0 interface of the vSRX which is directly connected to the wan interface of SSR.

A tenant named vsrx_mgmt was configured for the IP-Addresses of the fxp0 master, primary and secondary IP-Addresses. The tenant was added to the firewall service which was used for accessing the internet. Upon checking the sessions in the non-working SSR, it was seen that there was a session established from 169.254.x.x towards 8.8.8.8 but there was no NAT happening for the source IP-Address even though the ingress-source-nat-pool was configured

The same when checked in the working SSR, the source IP-Address 169.254.x.x was getting translated to 10.x.x.x which would then reach out to 8.8.8.8 (internet) and the return traffic would come back on 10.x.x.x and the destination IP-Address would then get translated to 169.254.90.x and then reach the vSRX.

The session shows the forward traffic going from the link-local ip 169.254.x.x towards the destination (8.8.8.8) but there was no NAT happening for the source-ip-address

This is a known issue reported in 6.1.4 version of SSR and the details of the known issue are as below.

Release Notes link : https://www.juniper.net/documentation/us/en/software/session-smart-router/docs/release_notes_128t_6.1/

I95-59537, I95-59551 Apply ingress-source-nat-pool to local breakout sessions: Resolved an issue where ingress-source-nat-pool was only applied to SVR sessions. The ingress-source-nat-pool has been updated with the applies-to-local-breakout flag.

In order to fix the problem, you can upgrade one of the non-working SSRs to 6.1.12 and then use the "applies-to-local-breakout" flag under ingress-source-nat-pool to allow SSR to use the source nat pools for non-SVR traffic.