root@SRX1> show configuration |no-more ## Last commit: 2018-07-12 10:38:37 UTC by root version 15.1X49-D140.2; system { host-name SRX1; root-authentication { encrypted-password ""; ## SECRET-DATA } services { ssh; web-management { http { interface [ fxp0.0 ge-0/0/0.0 ]; } } } syslog { user * { any emergency; } file messages { any any; authorization info; } file interactive-commands { interactive-commands any; } } max-configurations-on-flash 49; ## ## Warning: statement ignored: unsupported platform (vsrx) ## max-configuration-rollbacks 49; archival { configuration { transfer-on-commit; archive-sites { "ftp://junconf:96wd420@172.16.0.34/"; } } } license { autoupdate { url https://ae1.juniper.net/junos/key_retrieval; } } } services { rpm { probe DG_1_254 { test PING_1_DG { target address 192.168.1.254; probe-count 10; probe-interval 5; test-interval 5; thresholds { successive-loss 5; } } } } ip-monitoring { policy GW_failover { match { rpm-probe DG_1_254; } then { preferred-route { route 0.0.0.0/0 { next-hop 192.168.2.254; } } } } } } security { log { mode stream; report; } ike { policy ike_pol_STS_to_SRX2 { mode aggressive; proposal-set compatible; pre-shared-key ascii-text "$9$oXGHmQF/O1h/CtOBIleVwYgoGkqfzn/kq"; ## SECRET-DATA } gateway gw_STS_to_SRX2 { ike-policy ike_pol_STS_to_SRX2; address 192.168.10.1; external-interface ge-0/0/1.0; } } ipsec { policy ipsec_pol_STS_to_SRX2 { perfect-forward-secrecy { keys group2; } proposal-set compatible; } vpn STS_to_SRX2 { bind-interface st0.1; ike { gateway gw_STS_to_SRX2; ipsec-policy ipsec_pol_STS_to_SRX2; } establish-tunnels immediately; } } screen { ids-option untrust-screen { icmp { ping-death; } ip { source-route-option; tear-drop; } tcp { syn-flood { alarm-threshold 1024; attack-threshold 200; source-threshold 1024; destination-threshold 2048; queue-size 2000; ## Warning: 'queue-size' is deprecated timeout 20; } land; } } } policies { from-zone trust to-zone trust { policy default-permit { match { source-address any; destination-address any; application any; } then { permit; } } } from-zone trust to-zone untrust { policy default-permit { match { source-address any; destination-address any; application any; } then { permit; } } } from-zone untrust to-zone trust { policy default-deny { match { source-address any; destination-address any; application any; } then { deny; } } } from-zone trust to-zone STS_Zone { policy policy_out_STS_to_SRX2 { match { source-address addr_10_254_1_0_24; destination-address addr_10_254_2_0_24; application any; } then { permit; } } } from-zone STS_Zone to-zone trust { policy policy_in_STS_to_SRX2 { match { source-address addr_10_254_2_0_24; destination-address addr_10_254_1_0_24; application any; } then { permit; } } } } zones { security-zone trust { tcp-rst; address-book { address addr_10_254_1_0_24 10.254.1.0/24; } host-inbound-traffic { system-services { all; } protocols { all; } } interfaces { ge-0/0/0.0; ge-0/0/2.0; } } security-zone untrust { screen untrust-screen; host-inbound-traffic { system-services { ping; ssh; ike; } } interfaces { ge-0/0/1.0; } } security-zone STS_Zone { address-book { address addr_10_254_2_0_24 10.254.2.0/24; } interfaces { st0.1; } } } } interfaces { ge-0/0/0 { unit 0 { family inet { address 172.16.3.252/16; } } } ge-0/0/1 { unit 0 { family inet { address 192.168.1.1/24 { preferred; } address 192.168.2.1/24; } } } ge-0/0/2 { unit 0 { family inet { address 10.254.1.1/24; } } } fxp0 { unit 0; } st0 { unit 1 { description "IPsec to SRX2"; family inet { address 10.10.0.1/24; } } } } routing-options { static { route 0.0.0.0/0 next-hop 192.168.1.254; route 10.254.2.0/24 next-hop st0.1; } } root@SRX1>