Description

This article describes how you can send large ICMP packets through SRX. 

Symptoms

  • You will not be able to initiate a ping to SRX or any device after SRX with ping size greater than 1024.
  • You can see the below in a traceoptions

Aug 13 03:49:27 03:49:27.139655:CID-1:RT:~~~FLOW <172.X.X.X/1->172.172.X.X.X/16743;1,0x0> matched filter pf1(0) in root-logical-system for iif reth1.1185 of root-logical-system:
Aug 13 03:49:27 03:49:27.139666:CID-1:RT:  packet [1025] ipid = 15570, @0x5ebf04ac
Aug 13 03:49:27 03:49:27.139666:CID-1:RT:---- flow_process_pkt: (thd 13): flow_ctxt type 15, common flag 0x0, mbuf 0x5ebf0280, rtbl_idx = 0
Aug 13 03:49:27 03:49:27.139666:CID-1:RT: flow process pak fast ifl 91 in_ifp reth1.1185
Aug 13 03:49:27 03:49:27.139666:CID-1:RT: screen detection drop packet.

Solution

Attack detection and prevention detects and defend the network against attacks. Using Screen options, Junos security platforms can protect against different internal and external attacks.

ICMP large IDS option is used to detect and drop any ICMP frame with an IP length greater than 1024 bytes is To pass large ICMP packets, you will have to delete the ICMP large screen option. 


user@host# delete security screen ids-option screen-config icmp large

Modification History

2024-08-28 : Article Created

Related Information

https://www.juniper.net/documentation/us/en/software/junos/denial-of-service/topics/topic-map/security-introduction-to-adp.html