ben@ndc-sec1# show | compare rollback 3    
[edit security policies]
     from-zone dc-infrastructure-trust to-zone dc-infrastructure-trust { ... }
+    from-zone routing to-zone dc-infrastructure-untrust {
+        policy default-permit {
+            match {
+                source-address any;
+                destination-address any;
+                application any;
+            }
+            then {
+                permit;
+            }
+        }
+    }
+    from-zone dc-infrastructure-untrust to-zone routing {
+        policy default-permit {
+            match {
+                source-address any;
+                destination-address any;
+                application any;
+            }
+            then {
+                permit;
+            }
+        }
+    }
[edit security zones security-zone dc-infrastructure-untrust]
+     host-inbound-traffic {
+         system-services {
+             ping;
+             traceroute;
+         }
+     }