Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there an way to permit ping packets larger than 1472 through a Juniper SSG520M firewall?

"Ping of Death" and "Large Size ICMP Packet" protection has already been disabled under the 'Screening' options.

I need to be able to ping from the Trust side to the Untrust side (and perhaps vice versa) with packets larger than 1500 (i.e. ping -l 4096) so I can force fragmentation.

share|improve this question
Are you running JUNOS or ScreenOS on your SSG? I'd assume ScreenOS – David Pashley Jun 19 '09 at 21:15
Correct - ScreenOS v.6.2 – Peter Jun 19 '09 at 23:58

Note that linux ping by default these days seems to set the don't fragment bit. Check the man page for your implementation (as there are several depending on distribution sigh).

For the "iputils" version you want the "-M dont" option.

share|improve this answer
This was done from an XP machine. The don't fragment bit, should cause the (in this case) firewall to reply back to my machine with a smaller MTU size so my machine can fragment the traffic. This is either not happening or the firewall is simply blocking the traffic because it violates some security setting. – Peter Jun 20 '09 at 12:37
What about logging on the Juniper? All drops should be traceable. – nik Jun 20 '09 at 19:58
One more thing to check. Is the Juniper configured to block ICMP responses? That would stop the error response. – nik Jun 20 '09 at 20:05

If you login to the cli, you should be able to see why the ping is being dropped with ffilter Something along the lines of set ffilter dst-ip <whatever> src-ip <whatever>

Should tell you what rule is actually dropping the ping, so you can turn it off.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.