User wants to configure SRX loopback (lo0) interface for management purposes over Mist Console
No MIST Cloud configuration directly governs the SRX loopback interface. The lo0 configuration was applied independently via the Additional CLI Configuration field.
The following configuration permits ICMP traffic from zone "LAN" to zone "Loopback." Functionality was validated via ping from host 10.20.30.2 to SRX loopback interface 20.20.20.1.
set groups top interfaces lo0 unit 0 family inet address 20.20.20.1/32
set security zones security-zone Loopback interfaces lo0.0 host-inbound-traffic system-services ping <--- Configure here the service allowed on loopback interface
set security policies from-zone LAN to-zone Loopback policy lo0-Ping match source-address any
set security policies from-zone LAN to-zone Loopback policy lo0-Ping match destination-address any
set security policies from-zone LAN to-zone Loopback policy lo0-Ping match application junos-icmp-ping <--- Configure here the service allowed on loopback interface
set security policies from-zone LAN to-zone Loopback policy lo0-Ping then permit
set routing-instances apbr_Internet-Access-Steering routing-options static route 20.20.20.1/32 discard
Config breakdown:
The following configuration creates a reliable local probe target for APBR traffic steering.
Step 1 — Create a Loopback Address
This creates a loopback address directly on the SRX itself. Unlike a regular interface, a loopback address never goes down if the device is powered on. This makes it the ideal probe target for APBR, it will always respond, regardless of whether the internet connection is up or down.
Step 2 — Assign the Loopback to a Security Zone
set security zones security-zone Loopback interfaces lo0.0 host-inbound-traffic system-services ping
The SRX requires every interface to belong to a security zone before it can process traffic. This step creates a dedicated zone for the loopback interface and explicitly allows ping (ICMP) traffic to reach it. Without this, the device would have no zone to reference and probe packets would never be processed.
Step 3 — Create a Security Policy to Allow Probe Traffic
set security policies from-zone LAN to-zone Loopback policy lo0-Ping match application junos-icmp-ping
This policy permits ICMP ping traffic to flow from the LAN zone to the Loopback zone. The SRX firewall engine inspects all inter-zone traffic, without this policy in place, probe packets would be silently dropped by the security engine before ever reaching the loopback address.
Step 4 — Add a Discard Route in the APBR Routing Instance
This step ensures the loopback address is known within the APBR routing instance but is not used for actual traffic forwarding. The discard route tells the routing engine to acknowledge the address exists without advertising it or routing real traffic to it, keeping it strictly as a local probe destination.
Verification:
root@SRX> show interfaces terse | match lo0
lo0 up up
lo0.0 up up inet 20.20.20.1 --> 0/0
root@SRX> show route 20.20.20.1
inet.0: 7 destinations, 8 routes (7 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
20.20.20.1/32 *[Direct/0] 00:34:13
> via lo0.0
apbr_Internet-Access-Steering.inet.0: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)
20.20.20.1/32 *[Static/5] 00:17:22
Discard
root@SRX> show security policies hit-count
Logical system: root-logical-system
Index From zone To zone Name Policy count Action
1 LAN Loopback lo0-Ping 798 Permit
root@SRX> show security flow session protocol icmp
Session ID: 436066, Policy name: lo0-Ping/8, Timeout: 2, Session State: Valid
In: 10.20.30.2/1 --> 20.20.20.1/1279;icmp, Conn Tag: 0x0, If: mge-0/0/0.0, Pkts: 1, Bytes: 60,
Out: 20.20.20.1/1279 --> 10.20.30.2/1;icmp, Conn Tag: 0x0, If: .local..0, Pkts: 1, Bytes: 60,
Host 10.20.30.2 pcap:
05/21/2026 - Article Created