## Last commit: 2016-08-26 00:56:14 UTC by root version 10.1S4.1; system { host-name oc-srx; root-authentication { encrypted-password "abcdedgh"; ## SECRET-DATA } name-server { 8.8.8.8; } services { ssh; xnm-clear-text; web-management { http { interface [ ge-0/0/0.0 ge-0/0/1.0 ]; } https { system-generated-certificate; interface [ ge-0/0/0.0 ge-0/0/1.0 ]; } } } syslog { archive size 100k files 3; user * { any emergency; } file messages { any critical; authorization info; } file interactive-commands { interactive-commands error; } } max-configurations-on-flash 5; max-configuration-rollbacks 5; license { autoupdate { url https://ae1.juniper.net/junos/key_retrieval; } } } interfaces { ge-0/0/0 { unit 0 { family inet { address x.x.x.x/26; } } } ge-0/0/1 { unit 0 { family inet { address 192.168.200.254/24; } } } lo0 { unit 0 { family inet { address 127.0.0.1/32; } } } st0 { unit 0 { family inet { address 10.11.11.10/24; } } } st1 { unit 0 { family inet { address 11.11.11.10/24; } } } } routing-options { static { route 192.168.100.0/24 next-hop st0.0; route 192.168.0.0/24 next-hop st0.0; route 0.0.0.0/0 next-hop x.x.x.x.193; route 192.168.2.0/24 next-hop st1.0; } } security { ike { traceoptions { file size 1m; flag policy-manager; flag ike; flag routing-socket; } policy ike-us-corp { mode main; proposal-set standard; pre-shared-key ascii-text "abcdexthadf"; ## SECRET-DATA } policy ike-india-corp { mode main; proposal-set standard; pre-shared-key ascii-text "bacdughaxex"; ## SECRET-DATA } gateway ike-us-corp-gw { ike-policy ike-us-corp; address x.x.x.x; external-interface ge-0/0/0; } gateway ike-india-corp-gw { ike-policy ike-india-corp; address x.x.x.x; external-interface ge-0/0/0; } } ipsec { policy vpn-policy-us-corp { proposal-set standard; } policy vpn-policy-india-corp { proposal-set standard; } vpn ike-us-corp-vpn { bind-interface st0.0; ike { gateway ike-us-corp-gw; ipsec-policy vpn-policy-us-corp; } } vpn ike-india-corp-vpn { bind-interface st1.0; ike { gateway ike-india-corp-gw; ipsec-policy vpn-policy-india-corp; } } } nat { source { rule-set trust-to-untrust { from zone trust; to zone untrust; rule source-nat-rule { match { source-address 0.0.0.0/0; } then { source-nat { interface; } } } } } } screen { ids-option untrust-screen { icmp { ping-death; } ip { source-route-option; tear-drop; } tcp { syn-flood { alarm-threshold 1024; attack-threshold 200; source-threshold 1024; destination-threshold 2048; timeout 20; } land; } } } zones { security-zone trust { address-book { address net-cfgr_192-168-200-0--24 192.168.200.0/24; } host-inbound-traffic { system-services { all; } protocols { all; } } interfaces { ge-0/0/1.0; } } security-zone untrust { screen untrust-screen; host-inbound-traffic { system-services { https; ssh; ping; ike; } } interfaces { ge-0/0/0.0; } } security-zone vpn { address-book { address net-cfgr_192-168-100-0--24 192.168.100.0/24; address net-cfgr_192-168-0-0--24 192.168.0.0/24; } host-inbound-traffic { system-services { ping; } } interfaces { st0.0; } } security-zone vpn.hyd { address-book { address net-cfgr_192-168-2-0--24 192.168.2.0/24; } host-inbound-traffic { system-services { ping; } } interfaces { st1.0; } } } policies { from-zone trust to-zone untrust { policy trust-to-untrust { match { source-address any; destination-address any; application any; } then { permit; } } } from-zone trust to-zone vpn { policy trust-vpn-cfgr { match { source-address net-cfgr_192-168-200-0--24; destination-address [ net-cfgr_192-168-100-0--24 net-cfgr_192-168-0-0--24 ]; application any; } then { permit; } } } from-zone vpn to-zone trust { policy vpn-trust-cfgr { match { source-address [ net-cfgr_192-168-100-0--24 net-cfgr_192-168-0-0--24 ]; destination-address net-cfgr_192-168-200-0--24; application any; } then { permit; } } } from-zone trust to-zone vpn.hyd { policy trust-vpn-hyd-cfgr { match { source-address net-cfgr_192-168-200-0--24; destination-address net-cfgr_192-168-2-0--24; application any; } then { permit; } } } from-zone vpn.hyd to-zone trust { policy vpn-hyd-trust-cfgr { match { source-address net-cfgr_192-168-2-0--24; destination-address net-cfgr_192-168-200-0--24; application any; } then { permit; } } } } flow { tcp-mss { ipsec-vpn { mss 1350; } } } } poe { interface all; } wlan;