root@SRX300# show ## Last changed: 2021-12-25 10:38:25 EST version 21.1R1.11; system { host-name SRX300; root-authentication { encrypted-password "$6$/JxG.IYp$I7KIfWFoaHvKLsJ2kFG0E0RcN/XDJDWVRNTxI3wbMwNO7ZrCFyh2s1aWpSUP6xM78mrTqwpe1cxsRrHjkNZUA."; ## SECRET-DATA } login { user abcd { uid 2000; class super-user; authentication { encrypted-password "$6$11/ozsmX$T3EmnVmBoywosokw4BGyuX/uooS./THTtSgAnUKH3GW41V.fBVHsfNBDL6.fqfVVHKt8eWoWWAPmGcCOevyNP."; ## SECRET-DATA } } } services { ssh { root-login allow; } netconf { ssh; } dhcp-local-server { group jdhcp-group { interface irb.0; } } web-management { https { system-generated-certificate; } } } time-zone America/Toronto; name-server { 8.8.8.8; 8.8.4.4; } name-resolution { no-resolve-on-input; } syslog { archive size 100k files 3; user * { any emergency; } file messages { any notice; authorization info; } file interactive-commands { interactive-commands any; } } max-configurations-on-flash 5; max-configuration-rollbacks 5; license { autoupdate { url https://ae1.juniper.net/junos/key_retrieval; } } ntp { server north-america.pool.ntp.org version 4 prefer; } } security { address-book { global { address RDP13 10.10.10.13/32; } } screen { ids-option untrust-screen { icmp { ping-death; } ip { source-route-option; tear-drop; } tcp { syn-flood { alarm-threshold 1024; attack-threshold 200; source-threshold 1024; destination-threshold 2048; timeout 20; } land; } } } nat { source { rule-set trust-to-untrust { from zone trust; to zone untrust; rule source-nat-rule { match { source-address 0.0.0.0/0; } then { source-nat { interface; } } } } } destination { pool POOL-RDP13-TCP { address 10.10.10.13/32; } rule-set RS1 { from zone untrust; rule R1-3389-TCP { match { destination-address X.X.X.X/32; destination-port { 3389; } protocol tcp; } then { destination-nat { pool { POOL-RDP13-TCP; } } } } } } } policies { from-zone trust to-zone trust { policy trust-to-trust { match { source-address any; destination-address any; application any; } then { permit; } } } from-zone trust to-zone untrust { policy trust-to-untrust { match { source-address any; destination-address any; application any; } then { permit; log { session-init; session-close; } } } } from-zone untrust to-zone trust { policy RDP { match { source-address any; destination-address RDP13; application RDP13-3389-TCP; } then { permit; } } } pre-id-default-policy { then { log { session-close; } } } } zones { functional-zone management { interfaces { ge-0/0/1.0 { host-inbound-traffic { system-services { https; ssh; } } } } } security-zone trust { host-inbound-traffic { system-services { all; } protocols { all; } } interfaces { irb.0; } } security-zone untrust { screen untrust-screen; interfaces { ge-0/0/0.0 { host-inbound-traffic { system-services { dhcp; tftp; https; } } } ge-0/0/7.0 { host-inbound-traffic { system-services { dhcp; tftp; } } } } } } } interfaces { ge-0/0/0 { unit 0 { family inet { dhcp { update-server; } } } } ge-0/0/1 { unit 0 { family inet { address 192.168.1.1/24; } } } ge-0/0/2 { unit 0 { family ethernet-switching { vlan { members vlan-trust; } } } } ge-0/0/3 { unit 0 { family ethernet-switching { vlan { members vlan-trust; } } } } ge-0/0/4 { unit 0 { family ethernet-switching { vlan { members vlan-trust; } } } } ge-0/0/5 { unit 0 { family ethernet-switching { vlan { members vlan-trust; } } } } ge-0/0/6 { unit 0 { family ethernet-switching { vlan { members vlan-trust; } } } } ge-0/0/7 { unit 0 { family inet { dhcp { update-server; } } } } irb { unit 0 { family inet { address 10.10.10.1/24; } } } } access { address-assignment { pool junosDHCPPool { family inet { network 10.10.10.0/24; range junosDHCPPool_range { low 10.10.10.2; high 10.10.10.254; } dhcp-attributes { router { 10.10.10.1; } propagate-settings ge-0/0/0.0; } } } } } applications { application RDP13-3389-TCP { term 1 protocol tcp destination-port 3389; } } vlans { vlan-trust { vlan-id 3; l3-interface irb.0; } } protocols { l2-learning { global-mode switching; } rstp { interface all; } } [edit] root@SRX300#