Do the policy logs for internet access show hits during the incident?
- Nope. I'll follow the suggestion to run a debug/snoop, but for that I'll have to re-route the default route to the local link and provoke the issue, I'm waiting for a proper moment to run that. Can you do an internet site traceroute during the incident to verify routing is out the expected path. - I could, but never had to, public IP verification shows the remote site public IP and also the Juniper points which route is active.
If the traffic does not show up in the policy logs during the incident, I suspect there is a routing issue of some kind.
Please do the traceroute from an affected workstation to an internet site that does not work during the incident to verify the actual path taken during the problem.
Also get the same for comparison after service is working again.
When you run the debug use the same workstation ip address and internet site as your filter for the session.