SNMP traffic coming from unwanted IPs was not being discarded although there is a firewall filter applied in lo0 blocking traffic
The below configuration was applied in lo0.0 to block snmp traffic
set firewall family inet filter JTAC-Test term denied-SNMP from source-address 173.19.0.0/22 except
set firewall family inet filter JTAC-Test term denied-SNMP from protocol udp
set firewall family inet filter JTAC-Test term denied-SNMP from destination-port snmp
set firewall family inet filter JTAC-Test term denied-SNMP then discard
set firewall family inet filter JTAC-Test term default then accept
The traffic from unwanted IPs was blocked until we modified the filter as follows:
set firewall family inet filter JTAC-Test term 1-denied-SNMP-TEST from source-address 173.19.0.0/22
set firewall family inet filter JTAC-Test term 1-denied-SNMP-TEST from protocol udp
set firewall family inet filter JTAC-Test term 1-denied-SNMP-TEST from destination-port snmp
set firewall family inet filter JTAC-Test term 1-denied-SNMP-TEST then accept
set firewall family inet filter JTAC-Test term 2-denied-SNMP-TEST from protocol udp
set firewall family inet filter JTAC-Test term 2-denied-SNMP-TEST from destination-port 161
set firewall family inet filter JTAC-Test term 2-denied-SNMP-TEST then discard
set firewall family inet filter JTAC-Test term 3-denied-SNMP-TEST then accept
It looks like a bogus behavior with the option “from source-address 173.19.0.0/22 except” in the firewall filter.