The SRX series replaced interface-based ACLs with a zone-based security model. Traffic is only evaluated when a policy exists between the source and destination zones.

Zones Come First

set security zones security-zone TRUST interfaces ge-0/0/0.0 host-inbound-traffic system-services ping
set security zones security-zone UNTRUST interfaces ge-0/0/1.0 host-inbound-traffic system-services ike
set security zones security-zone DMZ interfaces ge-0/0/2.0

Without a policy between, say, TRUST and UNTRUST, all inter-zone traffic is implicitly denied. Within TRUST itself (intra-zone), all traffic is implicitly allowed. This is the most common source of confusion when first learning SRX.

A Clean Three-Policy Policy Set

set security policies from-zone TRUST to-zone UNTRUST policy OUTBOUND match source-address any
set security policies from-zone TRUST to-zone UNTRUST policy OUTBOUND match destination-address any
set security policies from-zone TRUST to-zone UNTRUST policy OUTBOUND match application any
set security policies from-zone TRUST to-zone UNTRUST policy OUTBOUND then permit
set security policies from-zone TRUST to-zone UNTRUST policy OUTBOUND then log session-init
Junos evaluates policies top-down and stops at the first match. Keep your specific rules above any catch-all and always enable then log session-init — without it you cannot see what was permitted or denied.

Address Books and Application Sets

set security zones security-zone TRUST address-book address MAIL-SERVER 192.168.10.50/32
set security zones security-zone TRUST address-book address-set SERVER-FARM address MAIL-SERVER
set security policies from-zone UNTRUST to-zone TRUST policy INBOUND-MAIL match source-address any destination-address MAIL-SERVER application junos-smtp
set security policies from-zone UNTRUST to-zone TRUST policy INBOUND-MAIL then permit

Screen Options — Your Free IPS

set security screen ids-option SCREEN-BASIC icmp flood
set security screen ids-option SCREEN-BASIC tcp syn-flood
set security screen ids-option SCREEN-BASIC tcp port-scan
set security zones security-zone UNTRUST screen SCREEN-BASIC

Watch counters with show security screen statistics zone UNTRUST.

Destination NAT for a Published Server

set security nat destination pool WEB-SRV address 192.168.10.50/32
set security nat destination rule-set UNTRUST from zone UNTRUST
set security nat destination rule-set UNTRUST rule WEB rule-match destination-address 203.0.113.10/32
set security nat destination rule-set UNTRUST rule WEB then destination-nat pool WEB-SRV
Always follow destination NAT with a security policy that allows the flow. NAT alone does not create a hole in your firewall.

Source NAT for Outbound Traffic

set security nat source rule-set TRUST-TO-INTERNET from zone TRUST
set security nat source rule-set TRUST-TO-INTERNET to zone UNTRUST
set security nat source rule-set TRUST-TO-INTERNET rule SNAT match source-address 192.168.0.0/16
set security nat source rule-set TRUST-TO-INTERNET rule SNAT then source-nat interface

Closing

Two final tips: always enable then log session-init while you are learning the model — the log is your only way to debug policy decisions. Pair this guide with our SRX IPSec hub-and-spoke guide to publish private services across cloud sites. For OSPF on the underlay, see OSPF on MX.