Destination NAT supports port forwarding, allowing specific destination ports on a public IP to be translated to different internal IP addresses and ports.
Static NAT automatically creates a matching reverse translation, making it bi-directional - traffic can flow in both directions using the same mapping without additional configuration.

A policy allowing all traffic from the trust zone to the trust zone, permitting internal communication.
A policy allowing all traffic from the untrust zone to the trust zone, which is implicitly denied, does not exist by default - however, the second default policy allows all traffic within the same zone, such as intra-zone communication (trust-to-trust).

The proxy ID is used as a final check to verify the peer before IPsec tunnel establishment. The proxy ID is a combination of local and remote subnet and protocol, and it is used to match the traffic that is to be encrypted. If the proxy IDs match between the two IPsec peers, the IPsec tunnel is established, and the traffic is encrypted.

Security policies on SRX Firewalls can control both intra-zone traffic (traffic within the same zone) and inter-zone traffic (traffic between different zones).
Security policies are designed to control transit traffic, meaning traffic passing through the firewall, not traffic destined to the device itself.

Static NAT (Network Address Translation) is a type of NAT that maps a public IP address to a private IP address. With static NAT, a one-to-one mapping is created between a public IP address and a private IP address. This means that a single public IP address is mapped to a single private IP address, and all incoming traffic to the public IP address is forwarded to the private IP address.