Port forwarding with new static nat feature

Starting with junos 11.4R5 (If I remember correctly), you can also forward ports by static nat  configuration. We were able to do this only by destination nat feature but it was a bit clunky in comparison to this feature. Configuration is pretty straight forward.  You redirect the port number
“80” in destination-port statement to the port 8080 in “mapped-port” statement.  If your security policies are in place and if needed proxy-arps are configured, this config should be sufficient for port forwarding.

root@srx# show security nat
static {
    rule-set rs1 {
        from interface reth0.0;
        rule rl1 {
            match {
                destination-address 144.122.211.3/32;
                destination-port 80;
            }
            then {
                static-nat {
                    prefix {
                        172.17.11.5/32;
                        mapped-port 8080;
                    }
                }
            }
        }
    }
}

When you are dealing with NAT in SRX, always keep in mind the order of NAT operations i.e 1) STATIC -> 2)  DESTINATION -> 3) SOURCE
Static is the first in the chain. You can for example change the destination IP address of a packet and just after that modify the source address of the very same packet.

If you want to have the SET commands of this configuration simply go to [edit security nat] config level of your device and then paste it as instructed below and press CRTL^D to load it. Once you type “show |display set” you will get the SET commands.

[edit security nat]
root@branchC# load merge relative terminal 
[Type ^D at a new line to end input]
static {
    rule-set rs1 {
        from interface reth0.0;
        rule rl1 {
            match {
                destination-address 144.122.211.3/32;
                destination-port 80;
            }
            then {
                static-nat {
                    prefix {
                        172.17.11.5/32;
                        mapped-port 8080;
                    }
                }
            }
        }
    }
}
load complete

[edit security nat]
root@branchC# show | display set 
set security nat static rule-set rs1 from interface reth0.0
set security nat static rule-set rs1 rule rl1 match destination-address 144.122.211.3/32
set security nat static rule-set rs1 rule rl1 match destination-port 80
set security nat static rule-set rs1 rule rl1 then static-nat prefix 172.17.11.5/32
set security nat static rule-set rs1 rule rl1 then static-nat prefix mapped-port 8080

Happy port forwarding:)