This article describes the behavior of ping to a proxy ARP address not working when running Junos release 11.2R1 and later.

 Pinging the proxy ARP address on a SRX device running release 11.2R1 or later, fails.

Configuration:

interfaces {
    ge-0/0/2 {
        unit 0 {
            family inet {
                address 1.1.1.3/24;
            }
        }
    }
}
security {
    nat {
        proxy-arp {
            interface ge-0/0/2.0 {
                address {
                    1.1.1.4/32;
                                       
                }
            }
        }
    }
    zones {
        security-zone untrust {
            interfaces {
                ge-0/0/2.0 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                        protocols {
                            all;
                        }
                    }
                }
            }
        }
    }
}

20:23:56.267545 In arp who-has 1.1.1.4 tell 1.1.1.1
20:23:56.267687 Out arp reply 1.1.1.4 is-at 00:26:88:fa:ab:41

The software change, which was introduced from Junos release 11.2R2 and onward, ensures that the SRX device does not respond to a ping; as it is a security risk.

If only the proxy ARP is configured with the no security nat configuration, then ICMP will not work; as there is no valid host for the NAT.  However, if there are valid security NAT configurations, then ICMP can work given that the translated NAT host reverts with an ICMP reply