SCCP ALG

set interfaces ge-0/0/0 unit 0 family inet address 10.1.1.1/24  
set interfaces ge-0/0/1 unit 0 family inet address 172.16.1.1/24 
set security zones security-zone private interfaces ge-0/0/0.0  
set security zones security-zone public interfaces ge-0/0/1.0
set security address-book book1 address phone1 10.1.1.3/32  
set security address-book book1 address cm-tftp_server 10.1.1.4/32 
set security address-book book1 attach zone private  
set security address-book book2 address phone2 172.16.1.4/32 
set security address-book book2 attach zone public
set security nat source rule-set phones from zone private 
set security nat source rule-set phones to zone public  
set security nat source rule-set phones rule phone1 match source-address 10.1.1.3/32  
set security nat source rule-set phones rule phone1 then source-nat interface 
set security nat static rule-set to-proxy from zone public  
set security nat static rule-set to-proxy rule phone2 match destination-address 172.16.1.2/32  
set security nat static rule-set to-proxy rule phone2 then static-nat prefix 10.1.1.4/32 
set security nat proxy-arp interface ge-0/0/1.0 address 172.16.1.2/32
set security policies from-zone public to-zone private policy in-pol match source-address phone2  
set security policies from-zone public to-zone private policy in-pol match destination-address cm-tftp_server  
set security policies from-zone public to-zone private policy in-pol match destination-address phone1
set security policies from-zone public to-zone private policy in-pol match application junos-sccp 
set security policies from-zone public to-zone private policy in-pol then permit  
set security policies from-zone private to-zone public policy out-pol match source-address any  
set security policies from-zone private to-zone public policy out-pol match destination-address phone2 
set security policies from-zone private to-zone public policy out-pol match application junos-sccp 
set security policies from-zone private to-zone public policy out-pol then permit 
set security policies from-zone private to-zone private policy tftp-pol match source-address any
set security policies from-zone private to-zone private policy tftp-pol match destination-address any
set security policies from-zone private to-zone private policy tftp-pol match application junos-tftp
set security policies from-zone private to-zone private policy tftp-pol then permit

[edit]
user@host# show interfaces
    ge-0/0/0 {
        unit 0 {
            family inet {
                
                address 10.1.1.1/24;
            }
        }
    }
        ge-0/0/1 {
            unit 0 {
                family inet {
                    
                    address 172.16.1.1/24;
                }
            }
        }
[edit]
user@host# show security zones
security-zone private {
    interfaces {
        ge-0/0/0.0;
    }
}
    security-zone public {
        interfaces {
            ge-0/0/1.0;
        }
    }
[edit]
user@host# show security address-book
book1 {
    address phone1 10.1.1.3/32;
    address cm-tftp_server 10.1.1.4/32;
    attach {
        zone private;
    }
}
    book2 {
        address phone2 172.16.1.4/32;
        attach {
            zone public;
        }
    }
[edit]
user@host# show security nat
source {
    
    rule-set phones {
        from zone private;
        to zone public;
        rule phone1 {
            match {
                source-address 10.1.1.3/32;
            }
            then {
                source-nat {
                    interface;
                }
            }
        }
    }
}
    static {
        rule-set to-proxy {
            from zone public;
            rule phone2 {
                match {
                    destination-address 172.16.1.2/32;
                }
                then {
                    static-nat prefix 10.1.1.4/32;
                }
            }
        }
    }
    proxy-arp {
        
        interface ge-0/0/1.0 {
            address {
                172.16.1.2/32;
            }
        }
    }
[edit]
user@host# show security policies
from-zone public to-zone private {
    policy in-pol {
        match {
            source-address phone2;
            destination-address cm-tftp_server;
            destination-address phone1;
            application junos-sccp;
        }
        then {
            permit;
        }
    }
}
    from-zone private to-zone public {
        policy out-pol {
            match {
                source-address any;
                destination-address phone2;
                application junos-sccp;
            }
            then {
                permit;
            }
        }
    }
    from-zone private to-zone private {
        policy tftp-pol {
            match {
                source-address any;
                destination-address any;
                application junos-tftp;
            }
            then {
                permit;
            }
        }
    }

user@host> show security nat source rule all

Total rules: 1
Total referenced IPv4/IPv6 ip-prefixes: 3/0
source NAT rule: phone1               Rule-set: phones
  Rule-Id                    : 3
  Rule position              : 2
  From zone                  : private
  To zone                    : public
  Match
    Source addresses         : 10.1.1.3        - 10.1.1.3
    Destination port         : 0               - 0
  Action                        : interface
    Persistent NAT type         : N/A
    Persistent NAT mapping type : address-port-mapping
    Inactivity timeout          : 0
    Max session number          : 0
  Translation hits           : 0

user@host> show security nat static rule phone2

Static NAT rule: phone2               Rule-set: to-proxy
  Rule-Id                    : 1
  Rule position              : 1
  From zone                  : public
  Destination addresses      : 172.16.1.2
  Host addresses             : 10.1.1.4
  Netmask                    : 32
  Host routing-instance      : N/A
  Translation hits           : 0

user@host> show security alg status | match sccp

SCCP     : Enabled

user@host> show security policies

from-zone private to-zone public {
       policy out-pol {
        match {
            source-address any;
            destination-address phone2;
            application junos-sccp;
        }
        then {
            permit;
        }
    }
}
from-zone public to-zone private {
       policy in-pol {
        match {
            source-address phone2;
            destination-address [ cm-tftp_server phone1 ];
            application junos-sccp;
        }
        then {
            permit;
        }
    }
}
from-zone private to-zone private {
    policy tftp-pol {
        match {
            source-address any;
            destination-address any;
            application junos-tftp;
        }
        then {
            permit;
        }
    }
}