root@SRX2> show configuration | no-more ## Last commit: 2018-06-27 12:13:55 UTC by root version 15.1X49-D140.2; system { host-name SRX2; root-authentication { encrypted-password ""; ## SECRET-DATA } services { ssh; web-management { http { interface ge-0/0/0.0; } } } syslog { user * { any emergency; } file messages { any any; authorization info; } file interactive-commands { interactive-commands any; } } archival { configuration { transfer-on-commit; archive-sites { "ftp://junconf:96wd420@172.16.0.34/"; } } } license { autoupdate { url https://ae1.juniper.net/junos/key_retrieval; } } } security { ike { traceoptions { file ike_trace.log size 1m files 5 world-readable; flag all; } policy ike_pol_STS_to_SRX1 { mode aggressive; proposal-set compatible; pre-shared-key ascii-text "$9$vseL-w4aUmfzUjHmP5/9hSrevLdVYoZUdV"; ## SECRET-DATA } gateway gw_STS_to_SRX1 { ike-policy ike_pol_STS_to_SRX1; address [ 192.168.1.1 192.168.2.1 ]; dead-peer-detection { always-send; interval 10; } external-interface ge-0/0/1.0; } } ipsec { policy ipsec_pol_STS_to_SRX1 { perfect-forward-secrecy { keys group2; } proposal-set compatible; } vpn STS_to_SRX1 { bind-interface st0.1; ike { gateway gw_STS_to_SRX1; ipsec-policy ipsec_pol_STS_to_SRX1; } establish-tunnels immediately; } } screen { ids-option untrust-screen { icmp { ping-death; } ip { source-route-option; tear-drop; } tcp { syn-flood { alarm-threshold 1024; attack-threshold 200; source-threshold 1024; destination-threshold 2048; queue-size 2000; ## Warning: 'queue-size' is deprecated timeout 20; } land; } } } policies { from-zone trust to-zone trust { policy default-permit { match { source-address any; destination-address any; application any; } then { permit; } } } from-zone trust to-zone untrust { policy default-permit { match { source-address any; destination-address any; application any; } then { permit; } } } from-zone untrust to-zone trust { policy default-deny { match { source-address any; destination-address any; application any; } then { deny; } } } from-zone trust to-zone STS_Zone { policy policy_out_STS_to_SRX1 { match { source-address addr_10_254_2_0_24; destination-address addr_10_254_1_0_24; application any; } then { permit; } } } from-zone STS_Zone to-zone trust { policy policy_in_STS_to_SRX2 { match { source-address addr_10_254_1_0_24; destination-address addr_10_254_2_0_24; application any; } then { permit; } } } } zones { security-zone trust { tcp-rst; address-book { address addr_10_254_2_0_24 10.254.2.0/24; } host-inbound-traffic { system-services { all; } protocols { all; } } interfaces { ge-0/0/0.0; ge-0/0/2.0; } } security-zone untrust { screen untrust-screen; host-inbound-traffic { system-services { ping; ssh; ike; } } interfaces { ge-0/0/1.0; } } security-zone STS_Zone { address-book { address addr_10_254_1_0_24 10.254.1.0/24; } interfaces { st0.1; } } } } interfaces { ge-0/0/0 { unit 0 { family inet { address 172.16.3.253/16; } } } ge-0/0/1 { unit 0 { family inet { address 192.168.10.1/24; } } } ge-0/0/2 { unit 0 { family inet { address 10.254.2.1/24; } } } ge-0/0/3 { unit 0 { family inet { dhcp; } } } st0 { unit 1 { description "IPsec to SRX1"; family inet { address 10.10.0.2/24; } } } } routing-options { static { route 0.0.0.0/0 next-hop 192.168.10.254; route 10.254.1.0/24 next-hop st0.1; } } root@SRX2>