When trying to restrict SNMP access to the loopback interface (lo0.0) on a QFX5200 switch to enhance security, all external SNMP polling requests break immediately.

Limiting SNMP to only accept traffic destined to the lo0 by using the below command:

"set interface lo0.0"

It immediately fails for any SNMP polling.

NOTE: By default, SNMP requests are accepted on all interfaces, which may not be secure. Limiting SNMP to specific interfaces reduces risks.

When an SNMP packet arrives at the QFX Packet Forwarding Engine (PFE) via a physical interface (such as et-0/0/1.0), the switch keeps track of that ingress interface. When the traffic is send up to the Routing Engine, Junos checks the snmp interface configuration list.

On Junos OS and QFX5200 architectures specifically, the set snmp interface configuration statement acts as an explicit physical layer ingress filter for the SNMP process (snmpd), rather than an IP-layer destination check.

[ NMS Poller ]

     │

     ▼ (Destination IP: lo0.0)

[ Ingress Port: et-0/0/1.0 ] ──► [ Packet Forwarding Engine (PFE) ] ──► [ Junos Kernel Checking snmpd rules ]

                                                                            │

                                                                            ▼

                                                          Dropped: et-0/0/1.0 not in Allowed SNMP list

To resolve this on the QFX5200 while maintaining a strong security posture, you can use one of the following two approaches:

Method 1: Include the Physical Ingress Interface (Direct Configuration Fix)

Add the explicit physical interface or AE interface where the SNMP requests physically enter the switch chassis.

set snmp interface lo0.0

set snmp interface et-0/0/1.0

Method 2: Use an RE-Protection Firewall Filter (Recommended Best Practice)

The standard  best practice for securing SNMP access is to handle security via a firewall filter on lo0.0.

This relies on IP addresses instead of physical ports, protecting the switch regardless of topology changes.

1. Create a prefix-list for your management nodes:

set policy-options prefix-list MGMT-STATIONS 192.168.10.50/32

set policy-options prefix-list MGMT-STATIONS 10.0.5.0/24

2. Configure the Loopback Firewall Filter:

set firewall family inet filter PROTECT-RE term ALLOW-SNMP from source-prefix-list MGMT-STATIONS

set firewall family inet filter PROTECT-RE term ALLOW-SNMP from protocol udp

set firewall family inet filter PROTECT-RE term ALLOW-SNMP from destination-port snmp

set firewall family inet filter PROTECT-RE term ALLOW-SNMP then accept

set firewall family inet filter PROTECT-RE term BLOCK-OTHER-SNMP from protocol udp

set firewall family inet filter PROTECT-RE term BLOCK-OTHER-SNMP from destination-port snmp

set firewall family inet filter PROTECT-RE term BLOCK-OTHER-SNMP then discard

set firewall family inet filter PROTECT-RE term ALLOW-ALL-ELSE then accept

3. Apply the filter to the Loopback:

set interfaces lo0 unit 0 family inet filter input PROTECT-RE