SRX

Have some problem allowing access to the trust side - I have.

Created the policy rule:

set security policies from-zone untrust to-zone trust policy NAS_8080 match source-address any
set security policies from-zone untrust to-zone trust policy NAS_8080 match destination-address NAS_serv
set security policies from-zone untrust to-zone trust policy NAS_8080 match application NAS_port_8080
set security policies from-zone untrust to-zone trust policy NAS_8080 then permit
set security policies from-zone untrust to-zone trust policy NAS_8080 then log session-init
set security policies from-zone untrust to-zone trust policy NAS_8080 then log session-close

I have created the application:

set applications application NAS_port_8080 protocol tcp
set applications application NAS_port_8080 source-port 1-65535
set applications application NAS_port_8080 destination-port 8080

I have created address book entry:

set security zones security-zone trust address-book address NAS_serv description NAS-server
set security zones security-zone trust address-book address NAS_serv 192.168.1.105/32

Here is my complete configuration:

http://pastebin.com/7Fyir5jU

What am i missing. Cant reach the server on the trusted zone from the untrusted.

Thank you for helping.

While the policies look right the SRX doesn't have destination NAT configured.  That'll instruct it how to forward TCP8080 traffic to the NAS.  This configuration may help you (assuming that the VDSL is your WAN).

set security nat destination pool NAS_serv address 192.168.1.105/32
set security nat destination rule-set untrust-to-trust from interface pt-1/0/0.0
set security nat destination rule-set untrust-to-trust rule NAS_Serv match destination-address 0.0.0.0/0
set security nat destination rule-set untrust-to-trust rule NAS_Serv match destination-port 8080
set security nat destination rule-set untrust-to-trust rule NAS_Serv then destination-nat pool NAS_serv

Please keep in mind that your current configuration allows management traffic to the SRX and traffic to the NAS from anywhere in the world.  My suggestion would be to limit the scope of services available and the networks that can access those services.

Thanks!

Just what i needed.

Thank you so much - its working now after applying the NAT rules.

Regarding the management traffic:

If I apply a default deny policy at the bottom of my policy/terms. I would be fine - right? like this:

    set security policy from-zone untrust to-zone trust policy untrust-trusty-denyall match source-address any

    set security policy from-zone untrust to-zone trust policy untrust-trusty-denyall match destination-address any

    set security policy from-zone untrust to-zone trust policy untrust-trusty-denyall match application any

    set security policy from-zone untrust to-zone trust policy untrust-trusty-denyall match then deny

    set security policy from-zone untrust to-zone trust policy untrust-trusty-denyall match then log session-init

I'm glad to hear that the NAT configuration worked!

And in regards to your second question, by default Junos denies all traffic that doesn't match a policy.  The advantage of creating a policy to do this is that you can log what traffic is blocked.  It certainly doesn't hurt anything!

My suggestion would be to remove the ability to manage the SRX from your untrust zone.  For example, this would involve delete the following lines from your configuration:

set security zones security-zone untrust interfaces fe-0/0/0.0 host-inbound-traffic system-services tftp
set security zones security-zone untrust interfaces pt-1/0/0.0 host inbound-traffic system-services tftp
set security zones security-zone untrust interfaces pt-1/0/0.0 host inbound-traffic system-services ssh
set security zones security-zone untrust interfaces pt-1/0/0.0 host inbound-traffic system-services traceroute
set security zones security-zone untrust interfaces pt-1/0/0.10 host-inbound-traffic system-services traceroute

 If you need to gain management access consider implementing Dynamic VPN.

Okay, I see. You were referring to 'system-services'. I will delete some of those entries.

Thanks you for your help. Much appreciated.