Check out the packet flow chart in this kb article.
https://kb.juniper.net/InfoCenter/index?page=content&id=KB16110
As Smiker notes, your security policy for destination nat must be written to the post NAT address and not the pre-NAT address. This does take some getting used to.