skills.rest
fastrevmd-lab
fastrevmd-labCOMMUNITY
Explore all skills by this author →
GitHub

srx-license-signature-maintenance

Audit and maintain Juniper SRX AppID and IDP licensing and offline signature content.

9|Updated Mar 7, 2026
Search Tags:#junos#appid#license audit#juniper srx#idp signatures#chassis cluster#offline update
One-click install
npx skills add https://github.com/fastrevmd-lab/fwskillsshare --skill srx-license-signature-maintenance-fastrevmd-lab
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: srx-license-signature-maintenance
Source: https://github.com/fastrevmd-lab/fwskillsshare/tree/main/skills/srx-license-signature-maintenance
Command: npx skills add https://github.com/fastrevmd-lab/fwskillsshare --skill srx-license-signature-maintenance-fastrevmd-lab

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Managing AppID and IDP/IPS entitlements and offline signature updates across SRX fleets is error-prone: licenses must be installed per cluster node, signature installs require condition-based polling, and license material must never leak into logs or reports. This Skill carries one operation from read-only inventory through licensing, signature installation, verification, and cleanup without losing context. ## Core Features & Use Cases - Entitlement auditing: Independently checks AppID and IDP/IPS license state, expiry, and installed/needed counts per device and per cluster node, returning only sanitized fields. - Gated license installation: Installs licenses from a validated external file under a separate approval gate, with strict secret handling, SFTP probing with legacy scp fallback, and verified cleanup. - Offline signature rollout: Updates IDP attack databases and AppID packages via pilot-then-batch rollout with condition-based polling to terminal states and per-node cluster verification. - Use Case: An operator needs to license a mixed fleet of standalone SRXs and a vSRX chassis cluster, then push the latest offline IDP/AppID bundle. The Skill audits entitlements, licenses each node under Gate A, then updates signatures under Gate B and reports per-node before/after versions. ## Quick Start Use the srx-license-signature-maintenance skill to audit AppID and IDP licensing and signature versions across my SRX cluster and report any expired entitlements.

Frequently Asked Questions about srx-license-signature-maintenance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I update IDP signatures offline on a Juniper SRX?▼

Copy the validated offline bundle to the device, run request security idp security-package offline-download, poll its status to a terminal success state, then run security-package install and poll again. Verify the attack database version equals the target before fanning out to other devices.

How do I check SRX license status for AppID and IDP?▼

Run show system license and read the IDP-SIG and APPID Signature features independently, recording installed count, needed count, and expiry for each. On a chassis cluster, log into each routing engine separately since the command has no per-node form.

Does SRX licensing work differently on a chassis cluster?▼

Yes, each cluster node is licensed independently, so the transfer, license add, and verification must happen per node. A valid primary-node license tells you nothing about the secondary, and cluster-level responses must be treated as unverified until each node answers.

Why does scp fail with subsystem request failed on channel 0 to Junos?▼

Modern OpenSSH scp uses SFTP by default, and some Junos accounts reject the SFTP subsystem. Probe with a harmless transfer first, and only on a proven subsystem failure retry that node with legacy mode using scp -O.

What does it mean when IDP install succeeds but no policy is active?▼

Junos may skip the data-plane update when no active IDP policy exists; classify the package install as successful with an operational warning. The signatures are present but nothing inspects traffic until a policy activates IDP, so do not claim enforcement is active.

When should I not use this SRX maintenance skill?▼

Do not use it for Junos software upgrades, IDP policy design or rule authoring, or general security-policy changes. Route policy questions to srx-policy and full-config extraction to parsing-srx-configs instead.

Related Skills

Explore More Software Engineering Skills→
dgethingsdgethings

pyats-junos-system

Automate JunOS system health checks and hardware inventory with pyATS.

Community
Advanced
lwokeraylwokeray

it-asset-license-management

Reconciles IT hardware, software, SaaS, and license inventories across procurement, assignment, renewal, and disposal lifecycles.

Community
Advanced
psaabpsaab
8

security-matrix

Validate firewall policy enforcement and dataplane throughput with real traffic capture.

Community
Advanced
automateyournetworkautomateyournetwork
627

junos-network

Automate Juniper JunOS device operations via PyEZ and NETCONF.

Community
Advanced