ICMP packets are not seen returning while traversing through the firewall.
E..g
root@SRX> show security flow session
Session ID: 189257, Policy name: default-permit/6, Timeout: 42, Session State: Valid
In: 10.10.10.100/14 --> 20.20.20.100/229;icmp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 1, Bytes: 84,
Out: 20.20.20.100/229 --> 10.10.10.100/14;icmp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 0, Bytes: 0, <<< No return packet
+ ICMP packets are getting blocked sending from host A to host B across the firewall
+ A "monitor security packet-drop" was ran and it was found that idp was responsible for dropping packets.
E.g.
root@SRX> monitor security packet-drop
Starting packet drop:
13:21:13.646416:LSYS-ID-00 10.10.10.100/14-->20.20.20.100/345;icmp,ipid-0,ge-0/0/0.0,Dropped by IDP:IDP Rule Action Drop Packet ICMP:INFO:ECHO-REQUEST
+ Evaluating into an idp policy configuration, there was a policy found in which ICMP was being dropped:
set security idp idp-policy ICMP-TEST rulebase-ips rule 1 match from-zone any
set security idp idp-policy ICMP-TEST rulebase-ips rule 1 match source-address any
set security idp idp-policy ICMP-TEST rulebase-ips rule 1 match to-zone any
set security idp idp-policy ICMP-TEST rulebase-ips rule 1 match destination-address any
set security idp idp-policy ICMP-TEST rulebase-ips rule 1 match application default
set security idp idp-policy ICMP-TEST rulebase-ips rule 1 match attacks predefined-attacks ICMP:INFO:ECHO-REPLY
set security idp idp-policy ICMP-TEST rulebase-ips rule 1 match attacks predefined-attacks ICMP:INFO:ECHO-REQUEST
set security idp idp-policy ICMP-TEST rulebase-ips rule 1 then action drop-packet
set security policies from-zone trust to-zone untrust policy allow-Google match source-address any
set security policies from-zone trust to-zone untrust policy allow-Google match destination-address Test1
set security policies from-zone trust to-zone untrust policy allow-Google match application any
set security policies from-zone trust to-zone untrust policy allow-Google then permit application-services idp-policy ICMP-TEST
+ Upon removal of this policy from the SRX's security policy helped to get pings working again.
Session ID: 189049, Policy name: default-permit/6, Timeout: 2, Session State: Valid
In: 10.10.10.100/14 --> 20.20.20.100/21;icmp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 1, Bytes: 84,
Out: 20.20.20.100/21 --> 10.10.10.100/14;icmp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 1, Bytes: 84,
Information concerning the use of "monitor security packet-drop":
https://www.juniper.net/documentation/us/en/software/junos/flow-packet-processing/topics/ref/command/monitor-security-packet-drop.html