This article explains how to SSH to an SRX device using a custom port or any port other than port 22, which is the designated port for Secure Shell Protocol (SSH). 

When attempting to SSH to an SRX device by using any port other than port 22 (the designated port for SSH), the connection either times out or you will be unable to establish a connection. 

By default, SSH utilizes port 22 for connections; hence, SRX expects an SSH connection on port 22. However, if you wish to establish SSH connectivity via a custom port, you must configure the any-services to allow traffic for establishing the connection.

To SSH to SRX using a custom port, please execute the following command:

set security zones security-zone <zone name> interfaces <interface> host-inbound-traffic system-services any-services

In case you prefer not to configure any-services for the specified zone and interface, you need to set up a policy that permits traffic from your zone to the Junos host. Below is a sample configuration:

set security policies from-zone <> to-zone junos-host policy <> match source-address <>
set security policies from-zone <> to-zone junos-host policy <> match destination-address <>
set security policies from-zone <> to-zone junos-host policy <> match application <custom application>
set security policies from-zone <> to-zone junos-host policy <> then

If this doesn't work, you can try changing the default port with command: 

set system services ssh port xxx 

This change will make 22 stop working and enable the new port to be used. 

Note: Before configuring any-service, ensure that all is removed from the system-services configuration.

[edit]
user# show security zones security-zone <zone name> host-inbound-traffic 
system-services {
    ##
    ## Warning: If `any` is set other services are disallowed
    ##
    all;
    any-service;
}

2024-01-09 : Article Created

2026-01-13: Minor, non-technical modifications made