This article explains why allowed-mac will work for layer 2 traffic, but fails for layer 3 traffic. This is an SRX limitation.

Topology

                                PC3(192.168.2.2)
				 |
                                 |
                             (ge-0/0/1)
PC1(192.168.1.2) --- (ge-0/0/5)SRX220(ge-0/0/7) --- PC2(192.168.1.3, 00:14:f6:ea:9d:06)
                          vlan.0 192.168.1.1

interfaces {
    ge-0/0/1 {
        unit 0 {
            family inet {
                address 192.168.2.1/30;
            }
        }
    }
    ge-0/0/5 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/7 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }                                   
    vlan {
        unit 0 {
            family inet {
                address 192.168.1.1/24;
            }
        }
    }
}
security {
    policies {
        default-policy {
            permit-all;
        }
    }
    zones {
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                vlan.0;
            }
        }
        security-zone untrust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                ge-0/0/1.0;
            }
        }                               
    }
}
ethernet-switching-options {
    secure-access-port {
        interface ge-0/0/7.0 {
            allowed-mac 5c:5e:ab:17:12:00;
        }
    }
}
vlans {
    vlan-trust {
        vlan-id 3;
        l3-interface vlan.0;
    }
}	

Symptoms

Customer finds that secure-access-port allowed-mac does not work.

1. 1. PC2 can not ping PC1. It is right.
2. 2. PC2 can ping vlan.0. It should be wrong because PC2's mac is 00:14:f6:ea:9d:06.
3. 3. PC2 can ping PC3. It should be wrong because PC2's mac is 00:14:f6:ea:9d:06.

In case 1 above, the traffic goes to the layer 2 flow process. In cases 2 and 3, traffic goes to the layer 3 flow process. Allowed-mac will not work on layer 3 (IRB) traffic. It is a SRX limitation.