Currently, the SSR is designed to discard large / fragmented ICMP packets.

ICMP packets larger than 1500 fail to be received at the target system over SVR tunnels.

TCP/UDP traffic is being sent correctly but ICMP is not.

The smaller packets go through the tunnel from source to destination, but as soon as the MTU is increased by 1 byte to 1501, the SSR router along the path to destination router no longer sends a response. Nothing arrives at the target system and there is no response from there as well.

The system is behaving as designed. Sending jumbo ICMP packets is a security attack vector.

An ICMP flood typically occurs when ICMP echo request messages overload the victim, causing resources to stop responding to valid traffic. A fragmented SYN packet is anomalous, and as such, it is suspect. When a victim receives these packets, the results can range from processing packets incorrectly to crashing the entire system. For more information, see the following link: https://www.juniper.net/documentation/us/en/software/junos/denial-of-service/topics/topic-map/security-icmp-sync-fragment-attack.html

While there is a Feature Enhancement Request open for SSR to allow ICMP Jumbo frames, it is unlikely to be implemented due to security concerns.

There are other mechanisms and products (like Paragon) that can be used to validate the path for jumbo frames. Please reach out to your account team if you have additional questions or concerns.