system {
    host-name srx100;
    time-zone GMT+1;
    root-authentication {
        encrypted-password "xxxxxxxxxx";
    }
    name-server {
        194.25.0.68;
        213.73.91.35;
        208.67.222.222;
        208.67.220.220;
    }
    name-resolution {
        no-resolve-on-input;
    }
    login {
        user xxxxxxxxxx {
            full-name xxxxxxxxxx;
            uid 2000;
            class super-user;
            authentication {
                encrypted-password "xxxxxxxxxx";
            }
        }
    }
    services {
		### Management Access Configuration
        web-management {
            https {
                system-generated-certificate;
                interface fe-0/0/2.0;
            }
            session {
                idle-timeout 60;
            }
        }
		### DHCP Pool for FON zone
        dhcp {
            pool 192.168.6.0/24 {
                address-range low 192.168.6.100 high 192.168.6.199;
                router {
                    192.168.6.1;
                }
            }
        }
    }
    syslog {
        archive size 100k files 3;
        user * {
            any emergency;
        }
        file messages {
            any critical;
            authorization info;
        }
        file interactive-commands {
            interactive-commands error;
        }
    }
    max-configurations-on-flash 5;
    max-configuration-rollbacks 5;
    license {
        autoupdate {
            url https://ae1.juniper.net/junos/key_retrieval;
        }
    }
    ntp {
        server ptbtime1.ptb.de;
		server ptbtime2.ptb.de;
    }
}
interfaces {
	### ISP1
    fe-0/0/0 {
        unit 0 {
            family inet {
                address xxx.xxx.xxx.102/29;
            }
        }
    }
	### ISP2
    fe-0/0/1 {
        unit 0 {
            family inet {
                address 192.168.10.10/24;
            }
        }
    }
	### INT
    fe-0/0/2 {
        unit 0 {
            family inet {
				filter {
					input routing_filter_INT;
				}
                address 192.168.0.1/24;
            }
        }
    }
	### WEB
    fe-0/0/3 {
        unit 0 {
            family inet {
				filter {
					input routing_filter_WEB;
				}
                address 192.168.5.1/24;
            }
        }
    }
	### FON
    fe-0/0/4 {
        unit 0 {
            family inet {
				filter {
					input routing_filter_FON;
				}
                address 192.168.6.1/24;
            }
        }
    }
	### DEV
    fe-0/0/5 {
        unit 0 {
            family inet {
				filter {
					input routing_filter_DEV;
				}
                address 192.168.7.1/24;
            }
        }
    }
}
routing-options {
	interface-routes {
		rib-group inet routing_import;
	}
    static {
		route 0.0.0.0/0 next-hop [ xxx.xxx.xxx.97 192.168.10.1 ];
    }
	rib-groups {
		routing_import {
			import-rib [ inet.0 routing-table-ISP1.inet.0 routing-table-ISP2.inet.0 ];
		}
	}
}
routing-instances {
	routing-table-ISP1 {
		instance-type forwarding;
		routing-options {
			static {
				route 0.0.0.0/0 {
					next-hop 1.1.1.1;
				}
			}
		}
	}
	routing-table-ISP2 {
		instance-type forwarding;
		routing-options {
			static {
				route 0.0.0.0/0 {
					next-hop 192.168.10.1;
				}
			}
		}
	}
}
protocols {
    stp;
}
firewall {
	filter routing_filter_INT {
		term mgmtallow {
			from {
				destination-address 192.168.0.0/24;
			}
			then {
				accept;
			}
		}
		term routing_term_INT {
			from {
				destination-address 89.238.65.180;
			}
			then {
				routing-instance routing-table-ISP1;
			}
		}
		term routing_term_default_INT {
			then {
				routing-instance routing-table-ISP2;
			}
		}
	}
	filter routing_filter_WEB {
		term routing_term_default_WEB {
			then {
				routing-instance routing-table-ISP1;
			}
		}
	}
	filter routing_filter_FON {
		term routing_term_default_FON {
			then {
				routing-instance routing-table-ISP2;
			}
		}
	}
	filter routing_filter_DEV {
		term routing_term_default_DEV {
			then {
				routing-instance routing-table-ISP2;
			}
		}
	}
}
security {
    screen {
        ids-option untrust-screen {
            icmp {
                ping-death;
            }
            ip {
                source-route-option;
                tear-drop;
            }
            tcp {
                syn-flood {
                    alarm-threshold 1024;
                    attack-threshold 200;
                    source-threshold 1024;
                    destination-threshold 2048;
                    timeout 20;
                }
                land;
            }
        }
    }
    nat {
        source {
            rule-set nsw_srcnat {
                from zone [ INT WEB FON DEV ];
                to zone [ ISP1 ISP2 ];
                rule nsw-src-interface {
                    match {
                        source-address 0.0.0.0/0;
                        destination-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            interface;
                        }
                    }
                }
            }
        }
        destination {
            pool 192_168_5_200_443 {
                address 192.168.5.200/32 port 443;
            }
            pool 192_168_5_200_80 {
                address 192.168.5.200/32 port 80;
            }
            pool 192_168_0_200_143 {
                address 192.168.0.200/32 port 143;
            }
            pool 192_168_0_200_25 {
                address 192.168.0.200/32 port 25;
            }
            rule-set nsw_destnat {
                from zone ISP1;
                rule 0_Web_Server--WEB_443 {
                    match {
                        source-address 0.0.0.0/0;
                        destination-address 80.149.64.98/32;
                        destination-port 443;
                    }
                    then {
                        destination-nat pool 192_168_5_200_443;
                    }
                }
                rule 0_Web_Server--WEB_80 {
                    match {
                        source-address 0.0.0.0/0;
                        destination-address 80.149.64.98/32;
                        destination-port 80;
                    }
                    then {
                        destination-nat pool 192_168_5_200_80;
                    }
                }
                rule 0_Mail_Server--INT_143 {
                    match {
                        source-address 0.0.0.0/0;
                        destination-address 80.149.64.98/32;
                        destination-port 143;
                    }
                    then {
                        destination-nat pool 192_168_0_200_143;
                    }
                }
                rule 0_Mail_Server--INT_25 {
                    match {
                        source-address 0.0.0.0/0;
                        destination-address 80.149.64.98/32;
                        destination-port 25;
                    }
                    then {
                        destination-nat pool 192_168_0_200_25;
                    }
                }
            }
        }
        proxy-arp {
            interface fe-0/0/0.0 {
                address {
                    xxx.xxx.xxx.98/32 to xxx.xxx.xxx.101/32;
                }
            }
        }
    }
    policies {
        from-zone ISP1 to-zone INT {
            policy ISP1_INT {
                match {
                    source-address any;
                    destination-address any;
                    application [ junos-http junos-https ];
                }
                then {
                    permit;
                }
            }
        }
        from-zone ISP1 to-zone WEB {
            policy ISP1_WEB {
                match {
                    source-address any;
                    destination-address any;
                    application [ junos-smtp junos-imap ];
                }
                then {
                    permit;
                }
            }
        }
		from-zone ISP1 to-zone FON {
            policy ISP1_FON {
                match {
                    source-address any;
                    destination-address any;
                    application [ junos-smtp junos-imap ];
                }
                then {
                    permit;
                }
            }
        }
		from-zone ISP1 to-zone DEV {
            policy ISP1_DEV {
                match {
                    source-address any;
                    destination-address any;
                    application [ junos-smtp junos-imap ];
                }
                then {
                    permit;
                }
            }
        }
        from-zone INT to-zone ISP1 {
            policy INT_ISP1 {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
		from-zone INT to-zone ISP2 {
            policy INT_ISP2 {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
		from-zone INT to-zone WEB {
            policy INT_WEB {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
		from-zone INT to-zone FON {
            policy INT_WEB {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone INT to-zone DEV {
            policy INT_WEB {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
		from-zone WEB to-zone ISP1 {
            policy WEB_ISP1 {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
		from-zone FON to-zone ISP1 {
            policy FON_ISP1 {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
		from-zone FON to-zone ISP2 {
            policy FON_ISP2 {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
		from-zone DEV to-zone ISP1 {
            policy DEV_ISP1 {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
		from-zone DEV to-zone ISP2 {
            policy DEV_ISP2 {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
    zones {
        security-zone ISP1 {
			screen untrust-screen;
            interfaces {
                fe-0/0/0.0 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                        }
                    }
                }
            }
        }
        security-zone ISP2 {
			screen untrust-screen;
            interfaces {
                fe-0/0/1.0 {
                    host-inbound-traffic {
                        system-services {
							ping;
                        }
                    }
                }
            }
        }
        security-zone INT {
            interfaces {
                fe-0/0/2.0 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                            https;
							dns;
                        }
                    }
                }
            }
        }
        security-zone WEB {
            interfaces {
                fe-0/0/3.0 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                        }
                    }
                }
            }
        }
        security-zone FON {
            interfaces {
                fe-0/0/4.0 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                            dhcp;
                        }
                    }
                }
            }
        }
        security-zone DEV {
            interfaces {
                fe-0/0/5.0 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                        }
                    }
                }
            }
        }
    }
}