When configuring a WAN-to-LAN security policy through MIST, the required Static NAT, LAN network, and corresponding application must be configured correctly before the policy can be pushed to the SRX. The network containing the Static NAT must specifically be named internet. If the network is created with a different name, MIST will not push the WAN-to-LAN application policy.

This article describes the required configuration to enable the WAN-to-LAN policy to be successfully pushed through MIST.

The WAN-to-LAN security policy is not pushed to the SRX through MIST.

The WAN-to-LAN application policy is not generated or applied as expected.

1. Create an Underlay Static NAT.
2. Create the LAN network, if it does not already exist.
   • Configure the required Static NAT under the LAN network.
3. Create an Application for the external IP address used by the Static NAT.
   • Navigate to:
     Organizations → WAN → Applications
4. Ensure that the network containing the Static NAT is created with the exact name:
   internet
   Important: The network name must be exactly internet. If any other network name is used, MIST will not push the WAN-to-LAN application policy.
5. Once the Static NAT and corresponding Application are configured, the WAN-to-LAN security policy can be pushed through MIST.

The internet network naming requirement is mandatory for the WAN-to-LAN application policy to be pushed through MIST.

Before troubleshooting a WAN-to-LAN policy push failure, verify:

• Underlay Static NAT is configured.
• LAN network exists.
• Required Static NAT is configured under the LAN network.
• Application is created for the external IP address used by the Static NAT.
• The network containing the Static NAT is named exactly internet.

Reference

https://supportportal.juniper.net/s/article/SRX-MIST-How-to-configure-static-NAT-using-MIST-UI