• If you are using addresses in the same subnet for ATP Appliance management and
SRX Series management, you must use a virtual router instance to separate the
management and revenue interfaces. If the addresses of ATP Appliance management
and SRX Series management congured through FXP0 are in dierent subnets, you
do not need to congure an addional virtual router instance. Note that trac must
be routed through the revenue interface congured for ATP Appliance management.
• If you are registering ATP Appliance through a VPN tunnel, it must be a named
tunnel. ATP Appliance expects an IP address on the interface. Therefore you must
congure an IP address on the VPN tunnel interface before running the OP URL
script to enroll the SRX Series Firewall. Otherwise, the registraon will fail.
• SRX Series Integraon with ATP Appliance requires api keys to generate the
enrollment script (op url). The ATP Appliance UI only allows generang API keys for
local users. Therefore, if users authencate using radius and aempt to generate an
enrollment script to register an SRX Series Firewall, it will fail because the remote
user will not have an API key. As a workaround, you can log into the ATP Appliance
UI using local credenals (hps://<ATP Appliance IP>/cyadmin/?local_login) and
connue with the instrucons below. If your network policy doesn’t allow local
users, there is no workaround for this issue.
To enroll a SRX Series Firewall with ATP Appliance, do the following:
1. From the ATP Appliance web UI, you must enable the API Key for the admin user. This is used for
enrolling the SRX Series Firewall. From the Cong tab, navigate to System Prole > Users. Select the
admin user for ATP Appliance and enable the Generate New API Key checkbox. Click Update User.
2. From the Cong tab, navigate to > System Prole > SRX sengs and click the Enrollment URL buon
in top right side of the page. A screen with the enrollment command appears.
3. Copy the enre enrollment command to your clipboard and click OK.
4. Paste the command into the Junos OS CLI of the SRX Series Firewall you want to enroll with ATP
Appliance and press Enter.
NOTE: (Oponal) Use the show services advanced-anti-malware status CLI command to verify that
a connecon is made to ATP Appliance from the SRX Series Firewall.
Once congured, the SRX Series Firewall communicates with ATP Appliance through mulple
persistent connecons established over a secure channel (TLS 1.2) and the SRX Series Firewall is
authencated using SSL client cercates.
11