Troubleshooting Policy Enforcer and SRX Series device Enrolment Issues
To resolve Policy Enforcer and SRX Series device enrolment issues, you must do the following:
Check if Policy Enforcer and Security Director are on the same version.
Use supported SRX Series or EX Series devices.
SRX Series or EX Series device must be running supported Junos OS Release. For more information, see Supported Devices.
Check for SRX Series supported feature against the Model Cloud feed, SkyATP and so on.
Check for SRX Series premium, basic, or free license and supported features.
For SRX550M, SRX340, or SRX345 models, use set security forwarding-process enhanced-services-mode command.
Above command requires device reboot, therefore plan the downtime.
Junos Space should have matching schema as per device Junos version.
Check that the device is not enrolled directly via SLAX script. If enrolled, then disenroll the device.
To check if the device is directly enrolled to SkyATP or enrolled via Policy Enforcer.
root@jtac> show configuration services -intelligence |match "url "
If you get the output as https://IPADDRESS:443/api/v1/manifest.xml; then the device is enrolled via Policy Enforcer. If you get https://cloudfeeds.argon.junipersecurity.net/api/manifest.xml, then the device is directly enrolled to SkyATP.
When you start enrolling the device to realm <RPC> job is triggered in Security Director and this is visible only for SkyATP and SkyATP with SDSN mode Policy Enforcer deployment.
For SDSN to work, make sure that the topologies should be as per Supported Topologies. End host connection should be Access Port and other interconnecting ports should be Trunk Port.