chassis {
    cluster {
        reth-count 1;
        redundancy-group 0 {
            node 0 priority 100;
            node 1 priority 1;
        }
        redundancy-group 1 {
            node 0 priority 100;
            node 1 priority 1;
            interface-monitor {
                ge-0/0/3 weight 255;
                ge-5/0/3 weight 255;
            }
        }
    }
}
interfaces {
    ge-0/0/3 {
        gigether-options {
            redundant-parent reth0;
        }
    }
    ge-0/0/5 {
        unit 0;
    }
    ge-0/0/6 {
        unit 0;
    }
    ge-0/0/7 {
        unit 0;
    }
    ge-0/0/8 {
        unit 0;
    }
    ge-0/0/9 {
        unit 0;
    }
    ge-0/0/10 {
        unit 0;
    }
    ge-0/0/11 {
        unit 0;
    }
    ge-0/0/12 {
        unit 0;
    }
    ge-0/0/13 {
        unit 0;
    }
    ge-0/0/14 {
        unit 0;
    }
    ge-0/0/15 {
        unit 0;
    }
    ge-5/0/3 {
        gigether-options {
            redundant-parent reth0;
        }
    }
    fab0 {
        fabric-options {
            member-interfaces {
                ge-0/0/2;
            }
        }
    }
    fab1 {
        fabric-options {
            member-interfaces {
                ge-5/0/2;
            }
        }
    }
    reth0 {
        vlan-tagging;
        redundant-ether-options {
            redundancy-group 1;
        }
        unit 0 {
            vlan-id 7;
            family inet {
                address WAN_IP;
            }
        }
        unit 8 {
            vlan-id 8;
            family inet {
                address LAN1_IP;
            }
        }
        unit 9 {
            vlan-id 9;
            family inet {
                address A.A.A.202/29;
            }
        }
    }
    
}

protocols {
    stp;
}
security {
    ike {
        proposal ike-proposal-AtoB {
            authentication-method pre-shared-keys;
            dh-group group2;
            authentication-algorithm md5;
            encryption-algorithm 3des-cbc;
            lifetime-seconds 28800;
        }
        policy ike-policy-AtoB {
            mode main;
            proposals ike-proposal-AtoB;
            pre-shared-key ascii-text "$9$yxYeK82gJiqf7-ZjHkTQevWLxdwYoUi.Lxjq.Pn6"; ## SECRET-DATA
        }
        gateway ike-gate-AtoB {
            ike-policy ike-policy-AtoB;
            address SiteB-WAN;
            external-interface reth0.0;
        }
    }
    ipsec {
        proposal ipsec-proposal-AtoB {
            protocol esp;
            authentication-algorithm hmac-md5-96;
            encryption-algorithm 3des-cbc;
            lifetime-seconds 3600;
        }
        policy ipsec-policy-AtoB {
            proposals ipsec-proposal-AtoB;
        }
        vpn ipsec-vpn-AtoB {
            ike {
                gateway ike-gate-AtoB;
                ipsec-policy ipsec-policy-AtoB;
            }
            establish-tunnels immediately;
        }
    }
    screen {
        ids-option untrust-screen {
            icmp {
                ping-death;
            }
            ip {
                source-route-option;
                tear-drop;
            }
            tcp {
                syn-flood {
                    alarm-threshold 1024;
                    attack-threshold 200;
                    source-threshold 1024;
                    destination-threshold 2048;
                    timeout 20;
                }
                land;
            }
        }
    }
    nat {
        source {
            rule-set trust-to-untrust {
                from zone trust;
                to zone untrust;
                rule AtoBNoNat {
                    match {
                        source-address  A.A.A.200/29 ;
                        destination-address B.B.B.0/24 ;
                    }
                    then {
                        source-nat {
                            off;
                        }
                    }
                }
            }
        }
    }
    policies {
        from-zone trust to-zone untrust {
            policy vpnpolicy-trust-untrust-AtoB {
                match {
                    source-address SiteA ;
                    destination-address SiteB;
                    application any;
                }
                then {
                    permit {
                        tunnel {
                            ipsec-vpn ipsec-vpn-AtoB;
                            pair-policy vpnpolicy-untrust-trust-AtoB;
                        }
                    }
                    log {
                        session-init;
                        session-close;
                    }
                    count;
                }
            }
            policy trust-to-untrust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone untrust to-zone trust {
            policy vpnpolicy-untrust-trust-AtoB {
                match {
                    source-address SiteB;
                    destination-address [ SiteA  ];
                    application any;
                }
                then {
                    permit {
                        tunnel {
                            ipsec-vpn ipsec-vpn-AtoB;
                            pair-policy vpnpolicy-trust-untrust-AtoB;
                        }
                    }
                    log {
                        session-init;
                        session-close;
                    }
                    count;
                }
            }
        }
    }
    zones {
        security-zone trust {
            address-book {
                address SiteA A.A.A.200/29;
            }
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                reth0.8;
                reth0.9;
            }
        }
        security-zone untrust {
            address-book {
                address SiteB B.B.B.0/24;
            }
            screen untrust-screen;
            host-inbound-traffic {
                system-services {
                    ping;
                    ike;
                }
            }
            interfaces {
                reth0.0;
            }
        }
    }
}