Supported Topology

In order for this use case to work, all internet-bound traffic must pass through the SRX firewall, so that the ATP Cloud service can learn the internal IP addresses of the infected hosts. The exact placement and deployment of the SRX is secondary to a properly configured SRX with properly routed traffic.

The following is an example topology, where the SRX hangs off of the border leaf in a non-HA configuration.