As of Junos 18.4 SRX series devices use an ARP policer on revenue interfaces called ' __default_arp_policer__' to help protect the RE processing.

Use the following to view the default policer and if packets are being dropped due to policer enforcement:

root@jtac> show policer
Policers:
Name                               Bytes            Packets
__default_arp_policer__            762048152        12693755     
--snip--

Since 18.4R1, SRX includes a default ARP policer '__default_arp_policer__' in order to protect RE from ARP based broadcast storms or attacks.

Packets above the rate of the policer (~300pps) will be discarded and reported as dropped packets on the policer. 

By applying policer on ARP protocol traffic, you may control how much ARP traffic can reach RE and protect RE from the impact of ARP broadcast storm.

By default, a policer named '__default_arp_policer_' is defined and shared ^* by all Ethernet interfaces with family inet configured. Its parameters are as below:

• bandwidth-limit: 150000bps
• burst-size: 15000 bytes
•  action: discard

^* NOTE:   For SRX_HE devices policers are applied per PFE.

This default policer will limit all ARP packets to RE. If a more specific policing of ARP packets is desired, a custom ARP policer may configured and applied at the interface level. 

• [edit firewall]
  policer custom_arp_limit {
      if-exceeding {
          bandwidth-limit 300k;
          burst-size-limit 15k;
      }
      then discard;
  }
  
  [edit interfaces]
  ge-0/0/0 {
      unit 0 {
          family inet {
              policer {
                  arp custom_arp_limit;
              }
          }
  - If the device is managed or monitored by the Mist Cloud, you may observe the following log messages in the designated section:
  

If you do not know which interface or sub-interface is the source of the ARP, you can apply the policer to all interfaces using a group.

set groups arp-policer interfaces <*> unit <*> family inet policer arp custom_arp_limit
set apply-groups arp-policer

The result is each interface will have an individual counter, and one interface will not trigger the policer for all interfaces.  From here, you can then adjust the policer, use more than one policer with different setting, etc, based on the site needs.

root@srx1600> show policer 
Policers:
Name                                                                            Bytes              Packets
__default_arp_policer__                                                             0                    0
custom_arp_limit-ge-0/0/1.0-inet-arp                                                0                    0
custom_arp_limit-ge-0/0/2.0-inet-arp                                                0                    0
custom_arp_limit-ge-0/0/14.0-inet-arp                                               0                    0
custom_arp_limit-ge-0/0/15.0-inet-arp                                               0                    0
custom_arp_limit-ae0.0-inet-arp                                                     0                    0
custom_arp_limit-lo0.0-inet-arp                                                     0                    0
custom_arp_limit-fxp0.0-inet-arp                                                    0                    0

2024-06-06 : Added Mist log messages

2025-09-16 : Added instructions for creating a group to cover all interfaces.