ICMP packets sourced from 192.168.1.100 are not seen returning from a host at 172.16.1.100 while traversing through the firewall, causing a communication breakdown.

E..g

root@SRX> show security flow session 

Session ID: 189257, Policy name: default-permit/6, Timeout: 42, Session State: Valid
 In: 192.168.1.100/14 --> 172.16.1.100/229;icmp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 1, Bytes: 84, 
 Out: 172.16.1.100/229 --> 192.168.1.100/14;icmp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 0, Bytes: 0, <<< No return packet

• ICMP packets are getting blocked sending from host A to host B across the firewall
• A "monitor security packet-drop" was ran and it was found that IDP was responsible for dropping packets.

E.g.

root@SRX> monitor security packet-drop 

Starting packet drop:
13:21:13.646416:LSYS-ID-00 192.168.1.100/14-->172.16.1.100/345;icmp,ipid-0,ge-0/0/0.0,Dropped by IDP:IDP Rule Action Drop Packet ICMP:INFO:ECHO-REQUEST

• Evaluating into an idp policy configuration, there was a policy found in which ICMP was being dropped:

E.g.

set security idp idp-policy ICMP-TEST rulebase-ips rule 1 match from-zone any
set security idp idp-policy ICMP-TEST rulebase-ips rule 1 match source-address any
set security idp idp-policy ICMP-TEST rulebase-ips rule 1 match to-zone any
set security idp idp-policy ICMP-TEST rulebase-ips rule 1 match destination-address any
set security idp idp-policy ICMP-TEST rulebase-ips rule 1 match application default
set security idp idp-policy ICMP-TEST rulebase-ips rule 1 match attacks predefined-attacks ICMP:INFO:ECHO-REPLY
set security idp idp-policy ICMP-TEST rulebase-ips rule 1 match attacks predefined-attacks ICMP:INFO:ECHO-REQUEST
set security idp idp-policy ICMP-TEST rulebase-ips rule 1 then action drop-packet

set security policies from-zone trust to-zone untrust policy allow-Google match source-address any
set security policies from-zone trust to-zone untrust policy allow-Google match destination-address Test1
set security policies from-zone trust to-zone untrust policy allow-Google match application any
set security policies from-zone trust to-zone untrust policy allow-Google then permit application-services idp-policy ICMP-TEST

• Upon removal of this policy from the SRX's security policy helped to get pings working again.

Session ID: 189049, Policy name: default-permit/6, Timeout: 2, Session State: Valid

 In: 192.168.1.100/14 --> 172.16.1.100/21;icmp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 1, Bytes: 84, 
 Out: 172.16.1.100/21 --> 192.168.1.100/14;icmp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 1, Bytes: 84,

2026-06-26: Adjusted article contents to provide more context.

2023-10-10: Article created

Information concerning the use of "monitor security packet-drop":

https://www.juniper.net/documentation/us/en/software/junos/flow-packet-processing/topics/ref/command/monitor-security-packet-drop.html