When a server detects SRX interface address via ICMP PINGs, we noticed random ICMP type3 (Destination unreachable) Code13 Communication administratively filtered) errors.

When a server detects SRX interface address via ICMP PINGs, we noticed random ICMP type3 (Destination unreachable) Code13 Communication administratively filtered) errors.

The ICMP Type 3 (Destination Unreachable), Code 13 (Communication administratively filtered) usually indicates the connection is administratively prohibited. In other words, the traffic is blocked by security rules/ACL.

Here are the possible causes for such ICMP errors from SRX: 
+ Host inbound traffic not allowed to the interface under the corresponding zone 
+ A security policy with deny action for the target traffic in the corresponding zone 
+ A firewall filter to block the traffic 
+ IDS/IDP/SCREEN feature to prevent possible DDOS attacks
+ The arrived packets exceeds the device default rate limit (use the command show system statistics icmp to verify the dropped packets)

In customer's case, the error was random. There was only a firewall filter applied on lo0 which blocks certain packets based on destination-port, everything else was permitted. 
firewall {
 family inet {
  filter test {
   term a {
    from {
     destination-port [ x ]; <<<---------------------
    }
    then {
     reject; <<<-------------------
         }
   term default {
    then {
     accept; 

Since the host-inbound ICMP traffic was not specially permitted based on protocol ICMP, the packets would still be inspected by the above applied firewall filters based on destination-port. However, unlike TCP/UDP traffic, ICMP packets do not have source/destination port numbers that could be used to maintain a session state in firewalls. Therefore, SRX uses the Checksum value of the ICMP packet as its destination port number for filter term match. We translated the Checksum value of the failed ICMP request to DEX value, which matched the rejected destination port. The issue was resolved after adding a permit term based on protocol ICMP for the target traffic: 
firewall {
 family inet {
  filter test {
   term permit-icmp {
    from {
     protocol icmp; <<<---------------------
    }
    then {
     permit;
         }  
   term a {
    from {
     destination-port [ x ]; 
    }
    then {
     reject; 
         }
   term default {
    then {
     accept;