SRX

ScreenOS made it quite easy for a small site that only had a dhcp assigned public ip for port mapping and/or destination-nat translations.

We've got a srx210 and are simply trying to find out how to convert this from ScreenOS to JunOS.

Any thoughts?

set interface ethernet4 vip interface-ip 50000 "securitycam1" 10.1.1.40

Ethernet4 is the untrust public interface on a 5GT with ISP issued dhcp address.

We are trying to make this work on ge-0/0/0 untrust zone interface of srx210, which also is assigned public dhcp address from ISP.

Got this working. Not sure what I was missing before, but it's sorted now.

Pasting here in case helps someone else...

    nat {

        destination {
            pool securitycam {
                address 10.1.1.40/32 port 50000;
            }
            rule-set untrust-to-trust {
                from zone untrust;
                rule securitycam-inbound-nat {
                    match {
                        destination-address 0.0.0.0/0;
                        destination-port 50000;
                    }
                    then {
                        destination-nat pool securitycam;
                    }
                }
            }
        }
    }
    policies {

        from-zone untrust to-zone trust {
            policy securitycam {
                match {
                    source-address any;
                    destination-address securitycam;
                    application securitycam;
                }
                then {
                    permit {
                        }
                    }
                }
            }
        }
    }
    zones {
        security-zone trust {
            address-book {
                address securitycam 10.1.1.40/32;
            }

}
applications {
    application securitycam {
        protocol tcp;
        destination-port 50000;
    }
}