On SRX Series devices, the fxp0 interface is reserved for out-of-band (OOB) management. It does not participate in packet forwarding between data-plane interfaces.

When a host that uses the SRX as its default gateway tries to reach the SRX’s fxp0 IP, the traffic fails even if correct static routes exist upstream. This behavior is often mistaken for a misconfiguration, but it is actually by design.

The possible symptoms below,

• A jump server using the SRX reth as its default gateway..
• A static route exists pointing to the management subnet via the upstream firewall .
• Routing appears correct both on SRX and on the upstream firewall.
• However, attempts to SSH or ping the fxp0 address from the jump server time out.

Since this behavior is by design, the following alternatives are supported:

Use a Loopback Interface for In-Band Management

• Configure a loopback interface (lo0) in the main routing instance.
• Assign a management IP to lo0.
• This IP will be reachable through reth interfaces, and you can enable SSH/management access on it.

Continue Using Data Interfaces (reth) for Management

• Enable SSH on a trusted reth interface.
• Apply firewall filters or security policies to restrict access to authorized management sources only.

Reserve fxp0 for True Out-of-Band Access

• If possible, connect fxp0 to a dedicated OOB management network.
• Access SRX only via fxp0 in cases where production interfaces are unreachable.