Re: Filter ICMP Packets

Hi, 

You could as well allow selected icmp-types in the firewall filter if the objective is to filter icmp traffic to that interface.

For instance, allow icmp-type echo-reply which will allow all return icmp echo-reply packets.

set firewall family inet filter [filter_bla_bla] term 2_1 from protocol icmp
set firewall family inet filter [filter_bla_bla] term 2_1 from icmp-type echo-reply
set firewall family inet filter [filter_bla_bla] term 2_1 then accept

However, firewall filters are stateless filtering while the SRX security policies are stateful.

With security policies you would not have to worry about explicitly allowing return traffic.

Cheers,

Ashvin