system { host-name SRX320; time-zone EST; root-authentication { encrypted-password "XXX"; ## SECRET-DATA } name-server { 8.8.8.8; 8.8.4.4; } name-resolution { no-resolve-on-input; } login { user admin { uid 2000; class super-user; authentication { encrypted-password "XXX"; ## SECRET-DATA } } } services { ssh; xnm-clear-text; dhcp-local-server { group jweb-default-group { interface ge-0/0/2.0; } } web-management { https { system-generated-certificate; } session { idle-timeout 60; } } } syslog { archive size 100k files 3; user * { any emergency; } file messages { any notice; authorization info; } file interactive-commands { interactive-commands any; } } max-configurations-on-flash 5; max-configuration-rollbacks 5; license { autoupdate { url https://ae1.juniper.net/junos/key_retrieval; } } ntp { server us.ntp.pool.org; } } security { address-book { global { address server-group 192.168.168.0/24; } } screen { ids-option untrust-screen { icmp { ping-death; } ip { source-route-option; tear-drop; } tcp { syn-flood { alarm-threshold 1024; attack-threshold 200; source-threshold 1024; destination-threshold 2048; timeout 20; } land; } } } nat { source { rule-set nsw_srcnat { from zone trust; to zone Internet; rule nsw-src-interface { match { source-address 0.0.0.0/0; destination-address 0.0.0.0/0; } then { source-nat { interface; } } } } } static { rule-set rs1 { from interface ge-0/0/4.0; rule r1 { match { destination-address X.XX.XXX.0/24; } then { static-nat { prefix { 192.168.168.0/24; } } } } } } proxy-arp { interface ge-0/0/4.0 { address { X.XX.XXX.1/32 to X.XX.XXX.255/32; } } } } policies { from-zone Internet to-zone trust { policy All_Internet_trust { match { source-address any; destination-address any; application any; } then { permit; } } policy server-access { match { source-address any; destination-address server-group; application any; } then { permit; } } } from-zone trust to-zone Internet { policy All_Internet_trust { match { source-address any; destination-address any; application any; } then { permit; } } policy permit-all { match { source-address server-group; destination-address any; application any; } then { permit; } } } } zones { security-zone trust { interfaces { ge-0/0/2.0 { host-inbound-traffic { system-services { ping; dhcp; https; ssh; } } } } } security-zone Internet { interfaces { ge-0/0/4.0; } } } } interfaces { ge-0/0/2 { unit 0 { family inet { address 192.168.168.168/24; } } } ge-0/0/4 { unit 0; } } protocols { l2-learning { global-mode switching; } } access { address-assignment { pool jweb-default-pool { family inet { network 192.168.168.0/24; range jweb-default-range { low 192.168.168.1; high 192.168.168.254; } dhcp-attributes { router { 192.168.168.168; } } } } } }