How Do I Configure the Firewall to retrieve my Subscription entitlement? How does the Firewall download the Subscription keys?
Prior to retrieving the subscription, ensure the device is registered and the subscription activated. For assistance, consult KB9917 - I received my Juniper product. How do I register, activate a contract, and generate a license key or subscription?
After registering the device and activating the subscription, configure the Firewall for Internet connectivity. Then, configure a Domain Name System (DNS) server for name resolution and ensure the date and time are correct by synchronizing the clock, preferably using Network Time Protocol (NTP).
Next, configure your Firewall to receive subscription entitlement using either the WebUI or the Command Line Interface (CLI).
When either of these two commands are invoked, the Juniper Firewall contacts the entitlement server. The entitlement server looks at the serial number, and checks the contracts associated with this device. A new subscription key is generated based on the contract for that device. This new generated key is then pushed onto the Juniper Firewall device.
Last, reboot of the box to activate the subscription keys on the device.
To configure the Firewall to receive subscription entitlement via the WebUI, perform the following steps:
Open the WebUI. For an example of how to access the WebUI, consult: KB4060 - Accessing Your NetScreen, SSG, or ISG Firewall Using the WebUI
From the ScreenOS options menu, click Configuration, select Update, and then click ScreenOS/Keys.

Click to select License Key Update (Features).

Click Retrieve Subscriptions Now.
Once you have retrieved the subscription, you can configure the device for pattern/signature updates.
To configure the Firewall to receive subscription entitlement via the CLI, perform the following steps:
Open the CLI. For more information on how to open the CLI, go to Accessing the Command Line Interface Using Telnet.
Enter the following command:
exec license update
NOTE: Ensure the Firewall has the DNS Server IP, the correct time, and date set on the device.