Knowledge Search


[Sky ATP] Download manifest failed

  [KB34453] Show Article Properties


When SRX is connected to Junos Space for Security Intelligence Threat Feeds, the user may encounter a download failure which represents itself when executing:

> show services security-intelligence update status
Download manifest failed<http return error code 400>

Per RFC 7231, section 6.5.1, an HTTP 400 Error is described as a 'Bad Request':

   The 400 (Bad Request) status code indicates that the server cannot or
   will not process the request due to something that is perceived to be
   a client error (e.g., malformed request syntax, invalid request
   message framing, or deceptive request routing).

Since this issue is a response from the Web Server (in this context Policy Enforcer is Web Server) from HTTP GET by SRX, the requirement to troubleshoot Policy Enforcer will need to be completed to resolve SRX Sky ATP Security Intelligence Error.

Per the Policy Enforcer Troubleshooting Guide:

  • You create a threat policy but don’t see the appropriate profiles to select from.

    Select Administration > PE Settings and make sure the correct mode has been selected. You can only change the mode in the following order: Cloud Feed Only to SKY ATP to SKY ATP with PE.

  • Assigning a threat policy to a policy enforcement group in the Sky ATP with PE mode.

    Threat policies are enforced and pushed to devices that support the given profile. If a device is not supported by a profile, it will be listed in the analysis results and in the Junos Space job details

If these do not address the issue, that may indicate that there is a file system issue with Policy Enforcer. Please contact Juniper Technical Support and open a case with the Space JTAC Team for further troubleshooting.

Related Links: