juniper srx做好基于目的地址池的映射后外网可以telnet a.a.a.a 22(a.a.a.a为公网IP)，但是内网不能telnet a.a.a.a 22。具体解决方法：

/*/源地址转换的配置
主要用于当数据包的目标地址为192.168.1.251的时候，trust区域会先做一个NAT转换成接口地址，然后服务器会把数据包返回给防火墙的trust，而不会走向untrust的接口

set security nat source rule-set src-nat from zone trust
set security nat source rule-set src-nat to zone trust
set security nat source rule-set src-nat rule src match source-address 192.168.100.140/32
set security nat source rule-set src-nat rule src match destination-address 192.168.1.151/32
set security nat source rule-set src-nat rule src then source-nat interface

如果是静态一对一的映射，需加如下语句：

set security nat static rule-set static-nat from zone trust