We have to block the mode 6 queries of NTP on Juniper equipment for mitigating the vulnerability of NTP.

The reason we want to block this is to prevent known vulnerabilities and exploits on NTP traffic.

To block NTP mode 6 queries from both trusted and untrusted servers, you can use the ntp restrict command in Junos OS. Here is how you can configure it:

1. Enter configuration mode: 
2. configure
3. Set the restriction for NTP mode 6 queries: 
4. set system ntp restrict <source_address> mask <mask_addr> noquery

• Replace <source_address> with the IP address you want to restrict.
• Replace <mask_addr> with the appropriate subnet mask.

Example Configuration: To block all hosts in the subnet 192.168.0.0/24 from sending NTP mode 6 queries: 

set system ntp restrict 192.168.0.0 mask 255.255.255.0 noquery
commit

The localhost 127.0.0.1 is needed because the SRX uses the localhost address to query its own NTP daemon when you run commands like show ntp status or show ntp associations. Once you configure restrict default, the device blocks all NTP control queries unless explicitly permitted

set system ntp restrict 127.0.0.1 mask 255.255.255.255
set system ntp restrict default noquery nopeer nomodify notrap

Note: - The noquery option is a hidden command in all releases prior to Junos OS 20.1R1. Ensure that it is written to the NTP configuration file to persist across reboots.

Reference: https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/ntp-edit-system.html