JN0-106 User Interfaces Practice Question
A network administrator is trying to configure a firewall filter on a Juniper device. They enter configuration mode and type 'set firewall family inet filter BLOCK-ICMP term 1 from protocol icmp'. They then type 'set firewall family inet filter BLOCK-ICMP term 1 then reject'. After committing, they notice that ICMP traffic is not being blocked. They run 'show configuration firewall' and see the filter is present. They run 'show firewall filter BLOCK-ICMP' to see the counters and notice the packet count is zero. What is the most likely reason?
⚠ Common exam trap
Many exam-takers assume configuring a firewall filter under the 'edit firewall' hierarchy automatically activates it, similar to Cisco IOS where ACLs are applied globally or to interfaces with separate commands, but Junos requires explicit interface application for the filter to process traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The filter is not applied to any interface.
A firewall filter in Junos must be applied to an interface to take effect. Simply configuring the filter under the 'edit firewall' hierarchy does not activate it; the filter must be referenced with a 'family inet' statement under the interface configuration (e.g., 'set interfaces ge-0/0/0 unit 0 family inet filter input BLOCK-ICMP'). Without this application, the filter exists in the configuration but never processes traffic, resulting in zero packet counts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The protocol icmp is not correct; it should be 'icmp6'.
Why it's wrong here
The protocol match in a firewall filter uses the protocol field of the IP header, and for IPv4 ICMP the correct value is "icmp"; "icmp6" is used exclusively for ICMPv6 traffic over IPv6. Changing the protocol to "icmp6" would make the filter fail to match the intended IPv4 ICMP packets, so this option is not the cause of the problem and is incorrect.
- ✓
The filter is not applied to any interface.
Why this is correct
In Junos, a firewall filter takes effect only when it is applied to an interface, typically under the "family" hierarchy using an "apply-filter" statement. Without such a binding, the filter remains defined in the configuration but is never evaluated, so all traffic—including ICMP echo requests—continues to pass. The filter must be attached to the appropriate interface and address family to actually block traffic.
- ✗
The term 'then reject' should be 'then discard'.
Why it's wrong here
Both "reject" and "discard" actions cause the packet to be dropped, but "reject" additionally sends an ICMP error message (such as administratively prohibited) back to the source, while "discard" drops the packet silently. The filter as written with "then reject" still blocks the traffic effectively, so this is not a functional failure. Even if the administrator preferred silent dropping, the filter's inability to block traffic is due to the missing interface application, not the action keyword.
- ✗
The filter must be applied under the 'edit firewall' hierarchy.
Why it's wrong here
Junos firewall filters are defined under the "edit firewall" hierarchy but are not activated there; they must be referenced from an interface configuration. The location of the filter definition is correct, and there is no requirement to apply the filter within the "edit firewall" hierarchy itself. This option incorrectly suggests a configuration placement issue when the actual issue is the absent interface attachment.
Visual reference
Go deeper
Related to this question
About these practice questions
This JN0-106 question is part of Courseiva's 156-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This JN0-106 practice question is part of Courseiva's free Juniper Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the JN0-106 exam.