Juniper junos configuration example

[dams]

Dear all,

I share in the forum my config for the firewall under Junos (juniper SRX)
I have a range IP public, this config example selects one IP for dedicated use of the SIP server.
The config have to be adapted to your own environment (IPs, security zone, ...)
I hope it will help furture users.

# be sure that the ALG SIP is off
set security alg sip disable

# NAT the internal IP to the external IP
# External IP: 123.123.123.123
# Internal IP: 10.10.10.5
set security nat source pool WAN3CXPHONE address 123.123.123.123/32
set security nat source rule-set NAT-SERVEUR-TO-WAN from zone SERVEUR
set security nat source rule-set NAT-SERVEUR-TO-WAN to zone WAN
set security nat source rule-set NAT-SERVEUR-TO-WAN rule 3CXPHONE match source-address 10.10.10.5/32
set security nat source rule-set NAT-SERVEUR-TO-WAN rule 3CXPHONE then source-nat pool WAN3CXPHONE

# NAT the external IP to the internal IP
set security nat destination pool 3CXPHONE address 10.10.10.5/32
set security nat destination rule-set NAT-FROM-WAN from zone WAN
set security nat destination rule-set NAT-FROM-WAN rule NAT-3CXPHONE match destination-address 123.123.123.123/32
set security nat destination rule-set NAT-FROM-WAN rule NAT-3CXPHONE then destination-nat pool 3CXPHONE

# declare the server IP in the security zone
set security zones security-zone SERVEUR address-book address 3CXPHONE 10.10.10.5/32

# Let's the server going outside without limitation
set security policies from-zone SERVEUR to-zone WAN policy SERVEUR-3CXPHONE-TO-WAN match source-address 3CXPHONE
set security policies from-zone SERVEUR to-zone WAN policy SERVEUR-3CXPHONE-TO-WAN match destination-address any
set security policies from-zone SERVEUR to-zone WAN policy SERVEUR-3CXPHONE-TO-WAN match application any
set security policies from-zone SERVEUR to-zone WAN policy SERVEUR-3CXPHONE-TO-WAN then permit

# Only allows some ports/protocol from the WAN
set security policies from-zone WAN to-zone SERVEUR policy WAN-TO-SERVEUR-3CXPHONE match source-address any
set security policies from-zone WAN to-zone SERVEUR policy WAN-TO-SERVEUR-3CXPHONE match destination-address 3CXPHONE
set security policies from-zone WAN to-zone SERVEUR policy WAN-TO-SERVEUR-3CXPHONE match application junos-ping
set security policies from-zone WAN to-zone SERVEUR policy WAN-TO-SERVEUR-3CXPHONE match application junos-https
set security policies from-zone WAN to-zone SERVEUR policy WAN-TO-SERVEUR-3CXPHONE match application junos-sip
set security policies from-zone WAN to-zone SERVEUR policy WAN-TO-SERVEUR-3CXPHONE match application 3cxports
set security policies from-zone WAN to-zone SERVEUR policy WAN-TO-SERVEUR-3CXPHONE then permit

# create custom app for 3cx server
set applications application 3cxports term t1 protocol udp
set applications application 3cxports term t1 destination-port 5090
set applications application 3cxports term t2 protocol tcp
set applications application 3cxports term t2 destination-port 5090
set applications application 3cxports term t3 protocol udp
set applications application 3cxports term t3 destination-port 9000-10999
set applications application 3cxports term t4 protocol tcp
set applications application 3cxports term t4 destination-port 5001
set applications application 3cxports term t5 protocol tcp
set applications application 3cxports term t5 destination-port 5061