## Last changed: 2014-03-17 16:44:34 CET
version 11.4R10.3;
system {
    host-name SRX210;
    domain-name somedomain.tld;
    time-zone Test/Zone;
    root-authentication {
        encrypted-password "ugly-string-here"; ## SECRET-DATA
    }
    name-server {
        8.8.8.8;
        8.8.4.4;
    }
    login {
        user superuser {
            uid 2000;
            class superuser;
            authentication {
                encrypted-password "ugly-string-here"; ## SECRET-DATA
            }
        }
    }
    services {
        ssh;
        telnet;
        xnm-clear-text;
        web-management {
            http {
                interface [ fe-0/0/2.0 ge-0/0/1.0 ];
            }
            https {
                system-generated-certificate;
                interface [ vlan.0 fe-0/0/2.0 ge-0/0/1.0 ];
            }
        }
        dhcp {
            router {
                192.168.1.1;
            }
            pool 192.168.1.0/24 {
                address-range low 192.168.1.2 high 192.168.1.254;
                default-lease-time 3600;
            }
            propagate-settings ge-0/0/0.0;
        }
    }
    syslog {
        archive size 100k files 3;
        user * {
            any emergency;
        }
        file messages {
            any info;
            authorization info;
        }
        file interactive-commands {
            interactive-commands error;
        }
        file ids {
            any any;
            match RT_IDS;
            archive world-readable;
            structured-data;
        }
    }
    max-configurations-on-flash 5;
    max-configuration-rollbacks 5;
    license {
        autoupdate {
            url https://ae1.juniper.net/junos/key_retrieval;
        }
    }
    ntp {
        boot-server 2.3.4.5;
        server 2.3.4.5;
    }
}
interfaces {
    ge-0/0/0 {
        gigether-options {
            auto-negotiation;
        }
        unit 0 {
            description "WAN INTERFACE";
            family inet {
                address 1.1.1.1/29;
                address 1.1.1.2/29;
            }
        }
    }
    ge-0/0/1 {
        description LAN;
        speed 1g;
        link-mode full-duplex;
        unit 0 {
            family inet {
                address 172.31.1.250/16;
            }
        }
    }
    fe-0/0/2 {
        description MANAGEMENT;
        speed 100m;
        link-mode full-duplex;
        unit 0 {
            family inet {
                address 192.168.1.1/24;
            }
        }
    }
    fe-0/0/3 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    fe-0/0/4 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    fe-0/0/5 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    fe-0/0/6 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    fe-0/0/7 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    st0 {
        unit 1 {
            description "VPN SECURE TUNNEL WITHOUT ISSUES";
            family inet;
        }
        unit 2 {
            multipoint;
            family inet {
                next-hop-tunnel 192.168.251.11 ipsec-vpn IPSEC_Location-With-Issues_VPN_VPC1;
                next-hop-tunnel 192.168.251.12 ipsec-vpn IPSEC_Location-With-Issues_VPN_VPC2;
                next-hop-tunnel 192.168.251.101 ipsec-vpn IPSEC_Location-With-Issues_VPN_Range1;
                next-hop-tunnel 192.168.251.102 ipsec-vpn IPSEC_Location-With-Issues_VPN_Range2;
                next-hop-tunnel 192.168.251.103 ipsec-vpn IPSEC_Location-With-Issues_VPN_Range3;
                address 192.168.251.1/24;
            }
        }
    }
    vlan {
        unit 0 {
            family inet {
                address 192.168.1.1/24;
            }
        }
    }
}
forwarding-options {
    packet-capture {
        file filename packetcap;
        maximum-capture-size 1500;
    }
}
snmp {
    name SOMENAME;
    location NOT_RELEVANT;
}
routing-options {
    static {
        route 80.81.82.83/28 next-hop st0.1;
        route 192.168.5.0/24 next-hop 172.31.4.1;
        route 0.0.0.0/0 next-hop 201.202.203.249;
        route 10.248.0.0/21 next-hop 192.168.251.11;
        route 10.150.0.0/16 next-hop 192.168.251.12;
        route 50.51.174.0/24 next-hop 192.168.251.101;
        route 50.51.178.0/23 next-hop 192.168.251.102;
        route 50.51.210.0/24 next-hop 192.168.251.103;
    }
}
protocols {
    stp;
}
security {
    log {
        mode event;
    }
    ike {
        traceoptions {
            flag all;
        }
        proposal IKE-PROPOSAL {
            authentication-method pre-shared-keys;
            dh-group group5;
            authentication-algorithm sha1;
            encryption-algorithm 3des-cbc;
            lifetime-seconds 28800;
        }
        proposal Location-With-Issues-IKE-Proposal {
            authentication-method pre-shared-keys;
            dh-group group2;
            authentication-algorithm sha1;
            encryption-algorithm aes-256-cbc;
            lifetime-seconds 28800;
        }
        policy IKE-POLICY {
            mode main;
            proposals IKE-PROPOSAL;
            pre-shared-key ascii-text "very-ugly-string-here"; ## SECRET-DATA
        }
        policy Location-With-Issues-IKE-Policy {
            mode main;
            proposals Location-With-Issues-IKE-Proposal;
            pre-shared-key ascii-text "very-ugly-string-here"; ## SECRET-DATA
        }
        gateway VPN-NO-ISSUES-GATEWAY {
            ike-policy IKE-POLICY;
            address 20.21.22.23;
            dead-peer-detection {
                interval 10;
                threshold 1;
            }
            nat-keepalive 10;
            external-interface ge-0/0/0.0;
        }
        gateway VPN-Location-With-Issues-GATEWAY {
            ike-policy Location-With-Issues-IKE-Policy;
            address 50.51.21.124;
            external-interface ge-0/0/0;
        }
    }
    ipsec {
        proposal IPSEC-NO-ISSUES-PROPOSAL {
            protocol esp;
            authentication-algorithm hmac-sha1-96;
            encryption-algorithm 3des-cbc;
            lifetime-seconds 86400;
        }
        proposal IPSEC-Location-With-Issues-PROPOSAL {
            protocol esp;
            authentication-algorithm hmac-sha1-96;
            encryption-algorithm aes-256-cbc;
            lifetime-seconds 3600;
            lifetime-kilobytes 4608000;
        }
        policy IPSEC-NO-ISSUES-POLICY {
            perfect-forward-secrecy {
                keys group5;
            }
            proposals IPSEC-NO-ISSUES-PROPOSAL;
        }
        policy IPSEC-Location-With-Issues-POLICY {
            perfect-forward-secrecy {
                keys group2;
            }
            proposals IPSEC-Location-With-Issues-PROPOSAL;
        }
        vpn IPSEC-NO-ISSUES-VPN {
            bind-interface st0.1;
            ike {
                gateway VPN-NO-ISSUES-GATEWAY;
                proxy-identity {
                    local 172.31.0.0/16;
                    remote 80.81.82.83/28;
                    service any;
                }
                ipsec-policy IPSEC-NO-ISSUES-POLICY;
            }
            establish-tunnels immediately;
        }
        vpn IPSEC_Location-With-Issues_VPN_VPC1 {
            bind-interface st0.2;
            ike {
                gateway VPN-Location-With-Issues-GATEWAY;
                proxy-identity {
                    local 172.31.0.0/16;
                    remote 10.248.0.0/21;
                    service any;
                }
                ipsec-policy IPSEC-Location-With-Issues-POLICY;
            }
            establish-tunnels immediately;
        }
        vpn IPSEC_Location-With-Issues_VPN_VPC2 {
            bind-interface st0.2;
            ike {
                gateway VPN-Location-With-Issues-GATEWAY;
                proxy-identity {
                    local 172.31.0.0/16;
                    remote 10.150.0.0/16;
                }
                ipsec-policy IPSEC-Location-With-Issues-POLICY;
            }
            establish-tunnels immediately;
        }
        vpn IPSEC_Location-With-Issues_VPN_Range1 {
            bind-interface st0.2;
            ike {
                gateway VPN-Location-With-Issues-GATEWAY;
                proxy-identity {
                    local 172.31.0.0/16;
                    remote 50.51.174.0/24;
                }
                ipsec-policy IPSEC-Location-With-Issues-POLICY;
            }
            establish-tunnels immediately;
        }
        vpn IPSEC_Location-With-Issues_VPN_Range2 {
            bind-interface st0.2;
            ike {
                gateway VPN-Location-With-Issues-GATEWAY;
                proxy-identity {
                    local 172.31.0.0/16;
                    remote 50.51.178.0/23;
                }
                ipsec-policy IPSEC-Location-With-Issues-POLICY;
            }
            establish-tunnels immediately;
        }
        vpn IPSEC_Location-With-Issues_VPN_Range3 {
            bind-interface st0.2;
            ike {
                gateway VPN-Location-With-Issues-GATEWAY;
                proxy-identity {
                    local 172.31.0.0/16;
                    remote 50.51.210.0/24;
                }
                ipsec-policy IPSEC-Location-With-Issues-POLICY;
            }
            establish-tunnels immediately;
        }
    }
    flow {
        tcp-mss {
            ipsec-vpn {
                mss 1350;
            }
        }
    }
    screen {
        ids-option untrust-screen {
            icmp {
                ping-death;
            }
            ip {
                source-route-option;
                tear-drop;
            }
            tcp {
                syn-flood {
                    alarm-threshold 1024;
                    attack-threshold 200;
                    source-threshold 1024;
                    destination-threshold 2048;
                    timeout 20;
                }
                land;
            }
        }
    }
    nat {
        source {
            rule-set trust-to-untrust {
                from zone trust;
                to zone untrust;
                rule source-nat-rule {
                    match {
                        source-address 0.0.0.0/0;
                        destination-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            interface;
                        }
                    }
                }
            }
        }
        destination {
            pool PRTG {
                address 172.31.1.12/32 port 23560;
            }
            pool BuildServer1 {
                address 172.31.60.41/32 port 9191;
            }
            pool BuildServer2 {
                address 172.31.60.42/32 port 9192;
            }
            pool MS-VPN {
                routing-instance {
                    default;
                }
                address 172.31.1.254/32 port 1723;
            }
            rule-set Public251 {
                from zone untrust;
                rule PRTG {
                    match {
                        destination-address 101.102.103.104/32;
                        destination-port 23560;
                    }
                    then {
                        destination-nat pool PRTG;
                    }
                }
                rule TFS_Build_1 {
                    match {
                        destination-address 101.102.103.104/32;
                        destination-port 9191;
                    }
                    then {
                        destination-nat pool BuildServer1;
                    }
                }
                rule TFS_Build_2 {
                    match {
                        destination-address 101.102.103.104/32;
                        destination-port 9192;
                    }
                    then {
                        destination-nat pool BuildServer2;
                    }
                }
            }
        }
    }
    policies {
        from-zone trust to-zone untrust {
            policy trust-to-untrust {
                match {
                    source-address [ LAN WLAN ];
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                    log {
                        session-close;
                    }
                }
            }
        }
        from-zone untrust to-zone trust {
            policy PRTG {
                match {
                    source-address any;
                    destination-address PRTGServer;
                    application PRTG_Port23560;
                }
                then {
                    permit;
                    log {
                        session-close;
                    }
                    count;
                }
            }
            policy TFS_Build {
                match {
                    source-address any;
                    destination-address [ DBLD01 DBLD02 ];
                    application TFS_Build_In;
                }
                then {
                    permit;
                    log {
                        session-close;
                    }
                    count;
                }
            }
            policy DENY_ALL {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    deny;
                    log {
                        session-init;
                    }
                    count;
                }
            }
        }
        from-zone trust to-zone VPN-NO-ISSUES {
            policy TRUST_VPNNO-ISSUES {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone VPN-NO-ISSUES to-zone trust {
            policy VPNNO-ISSUES_TRUST {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone trust {
            policy trust-to-trust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone VPN-Location-With-Issues {
            policy Trust_Location-With-Issues-VPC {
                match {
                    source-address LAN;
                    destination-address [ Location-With-Issues-VPC1 Location-With-Issues-VPC2 Location-With-Issues-Range1 Location-With-Issues-Range2 Location-With-Issues-Range3 ];
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone VPN-Location-With-Issues to-zone trust {
            policy Location-With-Issues_PRTG_Monitoring {
                match {
                    source-address [ Location-With-Issues-VPC1 Location-With-Issues-VPC2 Location-With-Issues-Range1 Location-With-Issues-Range2 Location-With-Issues-Range3 ];
                    destination-address PRTGServer;
                    application PRTG_Port23560;
                }
                then {
                    permit;
                }
            }
        }
    }
    zones {
        security-zone trust {
            address-book {
                address LAN 172.31.0.0/16;
                address PRTGServer 172.31.1.12/32;
                address DBLD01 172.31.60.41/32;
                address DBLD02 172.31.60.42/32;
                address WLAN 192.168.5.0/24;
            }
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                fe-0/0/2.0;
                ge-0/0/1.0;
            }
        }
        security-zone untrust {
            address-book {
                address 201.202.203.250 201.202.203.250/32;
                address 101.102.103.104 101.102.103.104/32;
                address 201.202.203.252 201.202.203.252/32;
                address 201.202.203.253 201.202.203.253/32;
                address 201.202.203.254 201.202.203.254/32;
            }
            screen untrust-screen;
            host-inbound-traffic {
                system-services {
                    https;
                    ike;
                }
            }
            interfaces {
                ge-0/0/0.0;
            }
        }
        security-zone VPN-NO-ISSUES {
            interfaces {
                st0.1;
            }
        }
        security-zone VPN-Location-With-Issues {
            address-book {
                address Location-With-Issues-VPC1 10.248.0.0/21;
                address Location-With-Issues-Range1 50.51.174.0/24;
                address Location-With-Issues-Range2 50.51.178.0/23;
                address Location-With-Issues-Range3 50.51.210.0/24;
                address Location-With-Issues-VPC2 10.150.0.0/16;
            }
            interfaces {
                st0.2;
            }
        }
    }
}
firewall {
    filter PCAP {
        term 1 {
            from {
                interface st0.2;
            }
            then {
                sample;
                accept;
            }
        }
        term allow-all-else {
            then accept;
        }
    }
}
applications {
    application PRTG_Port23560 {
        protocol tcp;
        destination-port 23560;
    }
    application TFS_Build_In {
        protocol tcp;
        destination-port 9191-9292;
        inactivity-timeout 30;
    }
}
vlans {
    vlan-trust {
        vlan-id 3;
        l3-interface vlan.0;
    }
}