We currently have 30 SRX110's in our production network which have been deployed at different times. All are currently running 2 or 3 VLANs (1 for Managment on newer ones, 1 for Users, 1 for VOIP) and we've recently noticed that some network addresses are responding to ICMP while others are not. From everything I've looked at our configs are the same across the different devices so I'm not exactly sure why we're not seeing the same behavior among all of the devices. Is there a setting that would cause a network address to respond to ICMP ? To my limited knowledge network addresses by default do not respond to ICMP the same way a gateway or loopback would.
As Steve pointed out, the security zone has to be configured to accept icmp messages (host-inbound-traffic). But also make sure that no firewall filter applied to either the physical interface or the loopback interface is blocking your icmp traffic, and that you have proper policies in place:
Didn't realize there were replies until i logged into my account today so my apologies. I understand that zone security requirements, but the issue I'm having is not the interface's address pinging back but the network address. So for example if I'm trying to ping 192.168.1.15/24 this pings back but so does 192.168.1.0/24 which should be the net address and to my understanding not able to ping back.
Thanks for the clarification, I'm not able to duplicate that behavior in my lab and your understanding is correct. The SRX should only reply to ping of configured interface addresses directly not the network address itself.
Are there other devices in that subnet that might be replying?
Steve Puluka BSEET - Juniper Ambassador IP Architect - DQE Communications Pittsburgh, PA (Metro Ethernet & ISP) http://puluka.com/home