srx-nat

Create a source NAT rule-set with from and to zone context, match the source and destination addresses, then apply either source-nat interface or a named pool. Verify with show security nat source rule all and inspect the translated tuple with show security flow session extensive.

Configure the translated port on the destination NAT pool using set security nat destination pool <name> address <ip> port <port>, then match the public port in the rule. Setting the port on the rule itself is a syntax error on current Junos releases.

Rule-set selection may pick a more specific context than expected, or a broader rule above yours matches first. Check rule-set specificity order (interface beats zone beats routing-instance) and confirm counters with show security nat source rule all.

Only if the pool prefix is routed to the SRX by the upstream device. If the pool address sits on the directly connected external subnet and the upstream sends ARP requests, you must configure security nat proxy-arp on the egress interface.

Hairpin requires three pieces: a destination NAT rule matching the inside zone, a source NAT rule so the server replies through the SRX, and a same-zone security policy. Missing the hairpin source NAT lets the server reply directly and break the session.

Confirm static NAT matches 64:ff9b::/96 with static-nat inet, and that the source NAT rule matches the translated IPv4 destination, not the IPv6 prefix. Check static and source rule counters plus the extensive flow session for both translated directions.