Protect Junos Devices form Unauthorized Management Access

Hello,

As a best practice should I apply the firewall filter on the fxp0 or lo0 interface?

Does the traffic destine to fxp0 go to lo0 if I am doing SSH?

thanks in advance.