What is the router connected to the SSG and does it have ping response enabled for its interfaces?
The default route will make sure your SSG can reach the 192.2.3.1 network.
But is there a return route on that router to reach the 100.100.2.1/24 behind the SSG?
Also have you enable to allow ping on the SSG interfaces for testing inbound.
When you ping source interface eth0/0 can you get the response from the directly connected interface
Then move on to the 192.2.3.1 interface.
Debug flow basic on the SSG can help us see what is happening with packet processing
https://kb.juniper.net/InfoCenter/index?page=content&id=KB12208