SSH login attempts observed despite having a filter to block SSH in loopback.

set firewall family inet filter PROTECT-RE term ssh from destination-port ssh

set firewall family inet filter PROTECT-RE term ssh then discard

set firewall family inet filter PROTECT-RE term else then accept

>show log messages | match sshd

sshd: SSHD_LOGIN_FAILED: Login failed for user 'root' from host '1.1.1.1'

In the filter destination-port ssh is blocking port 22.

The suggestion is to check if netconf is configured, this configuration will allow ssh through port 830.

set system services netconf ssh port 830

You can set syslog in the term you suspect this traffic is being allowed.

set system syslog file fw-logs firewall any

set system syslog file fw-logs archive size 10m

set system syslog file fw-logs archive files 5

set firewall family inet filter PROTECT-RE term else then syslog.

You will see the destination port as highlighted below:

root@test> show log fw-logs

May 5 09:10:30 b3-dc-cs01 fpc0 PFE_FW_SYSLOG_ETH_IP: FW: ge-0/0/0.0  A aa:bb:cc:dd:ee:ff -> 11:22:33:44:55:66 tcp 1.1.1.1 7.7.7.7 59048  830 (1 packets)

Add the destination port 830 to the filter.

set firewall family inet filter PROTECT-RE term ssh from destination-port 830