set security nat destination pool lan-srv-deign address 10.42.23.210/32
set security nat destination rule-set wan-to-lan-dest-nat rule lan-srv-deign-ssh match destination-address 0.0.0.0/0
set security nat destination rule-set wan-to-lan-dest-nat rule lan-srv-deign-ssh match destination-port 2100
set security nat destination rule-set wan-to-lan-dest-nat rule lan-srv-deign-ssh then destination-nat pool lan-srv-deign
set security policies from-zone untrust to-zone trust policy lan-srv-deign-ssh match source-address any
set security policies from-zone untrust to-zone trust policy lan-srv-deign-ssh match destination-address lan-srv-deign
set security policies from-zone untrust to-zone trust policy lan-srv-deign-ssh match application TCPUDP-2100
set security policies from-zone untrust to-zone trust policy lan-srv-deign-ssh then permit