Junos-host zone can be used to add an additional check for traffic
destined to SRX. If you don't configure any security policy to-zone
junos-host, the traffic/packet will be validated based on
host-inbound-traffic configured under security zones. If you
configure security policy to-zone junos-host, that policy check will
be done additionaly to host-inbound-traffic/services specified under
For example, if you allow SSH/Telnet/OSPF under interface
ge-0/0/0.0, but configure a security policy to-zone junos-host
allowing SSH, then Telnet/OSPF wont work. Only SSH will work.
More to read:
Inbound packet will pass in this order:
- Input interface filter, if set
- Zone-to-Zone policy
If traffic passed on 1 step, it can be still denied on 2 or 3.
- No interface filter applied
host-inbound-traffic set to
- Policy from zone zone1 to-zone junos-host allows only ICMP ping
As result, not ICMP ping, not SSH will be allowed. ICMP ping will be dropped on step 2; SSH will be dropped on step 3.