Description

In Juniper environments, pinging a self-hosted IP address (an IP configured on a local interface or logical interface of the device) may fail unless the IP is explicitly permitted under the lo0 filter (loopback filter). This behavior occurs due to the control-plane traffic handling rules that govern packets destined to the device itself. Without a proper filter allowing ICMP (or relevant protocols) to the routing engine, the device will drop the traffic before it can be processed.

Symptoms

  • Ping to a self-hosted IP fails from an external host or directly from the device.
  • No response is received even though the interface is operational and reachable for other traffic types.
  • ICMP traffic is not seen reaching the routing engine when monitored.
user@sw> ping 192.168.1.1
PING 192.168.1.1 (192.168.1.1): 56 data bytes

--- 192.168.1.1 ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss

Solution

Ensure that the loopback filter (lo0 filter) is configured to allow ICMP (or other required protocols) destined to the device. This enables the routing engine to process and respond to the traffic.

 

  • Define a firewall filter permitting ICMP traffic to the routing engine:
set firewall family inet filter lo0-in term allow-icmp from protocol icmp
set firewall family inet filter lo0-in term allow-icmp then accept
set firewall family inet filter lo0-in term default then discard

Note: this is an example configuration, further design and requirements will need to take in consideration for this config
  • Test connectivity again:
ping 192.168.1.1

Expected result:

user@sw> ping 192.168.1.1
PING 192.168.1.1 (192.168.1.1): 56 data bytes
64 bytes from 192.168.1.1: icmp_seq=0 ttl=64 time=1.234 ms



64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=1.234 ms


Modification History
07/29/2026-rchacon-KB creation