While connected to Juniper Secure connect, users are unable to ssh to the SRX, or connect via JWeb.

The following source nat rule-set is configured: 
 

  nat {

    source {

      rule-set JSC-ruleset {

        description "Client VPN";

        from zone VPN;

        to zone trust;

        rule JSC-rule {

          match {

            source-address 0.0.0.0/0;

          }

          then {

            source-nat {

              interface;

The PC connects over Juniper Secure Connect and gets an IP address assigned from the JSC pool.

After this, it tries to reach a destination IP that resides on an interface in the trust zone.

Since the nat rule translates the source IP to the interface IP, the source and destination IPs become the same address, creating a loop and interrupting the traffic flow. 

The issue can be resolved by removing the source nat rule-set, or by configuring a source-nat off rule at the top of the same rule-set for the destination of the SRX IP address.

2023-11-03: Article created.

2023-11-09: Added category.

2023-12-07: Title modified to be more specific with the KB content.

2025-04-07: Corrected categories.

2025-07-23: Edit the KB to include steps when internet access via JSC is needed

2025-09-22: Minor edit.