[j-nsp] IPSec vs SRX packet flow

[Network Geek]

Hi,

My users are sitting in 10.100.0.0/16 which need need to access
applications at the other side of an SRX via route-based IPSec configured
on SRX with source proxy-ID 172.30.30.0/24.

So I need to NAT all 10.100.0.0/16 to 172.30.30.0/24.

I can not find reference confirming if source NAT (and security policy)
will be processed before the IPSec. Can anyone shed some light on this?

If IPSec comes first, and any advise on how to get my users initiate the
IPSec without involving another device?

Thanks