show configuration
## Last commit: 2019-09-16 14:37:29 CDT by <User>
version 15.1X49-D170.4;
system {
    host-name <Firewall Hostname>;
    time-zone America/Chicago;
    root-authentication {
        encrypted-password ## SECRET-DATA
    }
    name-server {
        8.8.8.8;
        8.8.4.4;
        71.12.136.18;
    }
    login {
        message "Authorized users ONLY!!!";
        user <User> {
            uid 2001;
            class operator;
            authentication {
                encrypted-password ## SECRET-DATA
            }
        }
        user <User> {
            uid 2000;
            class super-user;
            authentication {
                encrypted-password ## SECRET-DATA
            }
        }
    }
    services {
        ssh;
        xnm-clear-text;
        netconf {
            ssh;
        }
        dhcp-local-server {
            group jdhcp-group {
                interface fxp0.0;
                interface irb.0;
            }
        }
        web-management {
            https {
                system-generated-certificate;
            }
        }
    }
    syslog {
        archive size 100k files 3;
        user * {
            any emergency;
        }
        file messages {
            any notice;
            authorization info;
        }
        file interactive-commands {
            interactive-commands any;
        }
        file policy_session {
            user info;
            match RT_FLOW;
            archive size 1000k world-readable;
            structured-data;
        }
    }
    max-configurations-on-flash 5;
    max-configuration-rollbacks 5;
    license {
        autoupdate {
            url https://ae1.juniper.net/junos/key_retrieval;
        }
    }
    processes {
        general-authentication-service {
            traceoptions {
                file AUTH;
                flag all;
            }
        }
    }
    ntp {
        server 198.50.238.163;
    }
}
security {
    ike {
        traceoptions {
            file IKE-TRACE;
            flag all;
        }
        policy ike-dyn-vpn-policy {
            mode aggressive;
            proposal-set standard;
            pre-shared-key ascii-text "$9$yXiex-sY4jkm4ai.fQ3ntu01yeNdsJZUevZUDH5Tn69CtOBIhv8Xyrs2aJHkmfTQ6Au01ESruOeWx-sYDik.TzpuBIcy9CX7NVY2JZUHmTn/Ctu1Atv8LXVbq.P5Q3p0B1RSAt1hSeXxg4aUqP"; ## SECRET-DATA
        }
        gateway dyn-vpn-local-gw {
            ike-policy ike-dyn-vpn-policy;
            dynamic {
                hostname dynvpn;
                connections-limit 60;
                ike-user-type group-ike-id;
            }
            external-interface ge-0/0/0.0;
            aaa {
                access-profile dyn-vpn-access-profile;
            }
        }
    }
    ipsec {
        policy ipsec-dyn-vpn-policy {
            proposal-set standard;
        }
        vpn dyn-vpn {
            ike {
                gateway dyn-vpn-local-gw;
                ipsec-policy ipsec-dyn-vpn-policy;
            }
        }
    }
    dynamic-vpn {
        access-profile dyn-vpn-access-profile;
        clients {
            all {
                remote-protected-resources {
                    192.0.0.0/8;
                }
                remote-exceptions {
                    0.0.0.0/0;
                }
                ipsec-vpn dyn-vpn;
                user {
                    <User>;
                }
            }
        }
    }
    screen {
        ids-option untrust-screen {
            icmp {
                ping-death;
            }
            ip {
                source-route-option;
                tear-drop;
            }
            tcp {
                syn-flood {
                    alarm-threshold 1024;
                    attack-threshold 200;
                    source-threshold 1024;
                    destination-threshold 2048;
                    timeout 20;
                }
                land;
            }
        }
    }
    nat {
        source {
            rule-set trust-to-untrust {
                from zone trust;
                to zone untrust;
                rule source-nat-rule {
                    match {
                        source-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            interface;
                        }
                    }
                }
            }
        }
        destination {
            pool citrix-dst-nat {
                description "Citrix Destination NAT Pool";
                routing-instance {
                    default;
                }
                address <Citrix Server IP>;
            }
            pool pbx-dst-nat-01 {
                address <PBX Server IP>;
            }
            pool pbx-dst-nat-02 {
                address <PBX Server IP>;
            }
            pool pbx-dst-nat-03 {
                address <PBX Server IP>;
            }
            rule-set dst-rs-01 {
                description "Untrusted Destination Rule Set";
                from zone untrust;
                rule citrix-rule-01 {
                    description "Citrix NAT Pool";
                    match {
                        destination-address <Public Citrix IP>;
                    }
                    then {
                        destination-nat {
                            pool {
                                citrix-dst-nat;
                            }
                        }
                    }
                }
                rule pbx-dst-nat-01 {
                    description "PBX NAT Pool";
                    match {
                        destination-address <Public PBX IP>;
                        destination-port {
                            <PBX Port>;
                        }
                        protocol udp;
                    }
                    then {
                        destination-nat {
                            pool {
                                pbx-dst-nat-01;
                            }
                        }
                    }
                }
                rule pbx-dst-nat-02 {
                    match {
                        destination-address <Public PBX IP>;
                        destination-port {
                            <PBX Port>;
                        }
                        protocol udp;
                    }
                    then {
                        destination-nat {
                            pool {
                                pbx-dst-nat-02;
                            }
                        }
                    }
                }
                rule pbx-dst-nat-03 {
                    match {
                        destination-address <Public PBX IP>;
                        protocol udp;
                    }
                    then {
                        destination-nat {
                            pool {
                                pbx-dst-nat-03;
                            }
                        }
                    }
                }
            }
        }
    }
    policies {
        from-zone trust to-zone trust {
            policy trust-to-trust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone untrust {
            policy trust-to-untrust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone untrust to-zone trust {
            policy citrix-connections {
                description "Permit Citrix Connections from Untrusted Zone";
                match {
                    source-address any;
                    destination-address citrix;
                    application [ <Citrix Applications> ];
                }
                then {
                    permit;
                }
            }
            policy pbx-connections {
                description "Permit PBX Connections from Untrusted Zone";
                match {
                    source-address any;
                    destination-address pbx;
                    application pbx-udp-ports;
                }
                then {
                    permit;
                }
            }
            policy dyn-vpn-policy {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit {
                        tunnel {
                            ipsec-vpn dyn-vpn;
                        }
                    }
                }
            }
        }
    }
    zones {
        security-zone trust {
            address-book {
                address citrix <Internal Citrix IP>;
                address pbx {
                    range-address <Internal PBX IP> {
                        to {
                            <Internal PBX IP;
                        }
                    }
                }
            }
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                irb.0;
                irb.50;
                irb.60;
                irb.90;
                irb.200;
                irb.70;
                irb.20;
                irb.91;
            }
        }
        security-zone untrust {
            screen untrust-screen;
            interfaces {
                ge-0/0/0.0 {
                    host-inbound-traffic {
                        system-services {
                            dhcp;
                            tftp;
                            ike;
                            https;
                            ping;
                            ssh;
                        }
                    }
                }
            }
        }
    }
}
interfaces {
    ge-0/0/0 {
        unit 0 {
            family inet {
                address <External Citrix IP>;
                address <External PBX IP>;
                address <External VPN IP>;
            }
        }
    }
    ge-0/0/1 {
        unit 0 {
            family ethernet-switching {
                interface-mode trunk;
                vlan {
                    members [ vlan-trust vlan50 vlan60 vlan90 vlan200 vlan70 vlan20 vlan91 ];
                }
            }
        }
    }
    ge-0/0/2 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/3 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/4 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/5 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/6 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/7 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/8 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/9 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/10 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/11 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/12 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/13 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/14 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/15 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    fxp0 {
        unit 0 {
            family inet {
                address 192.168.1.1/24;
            }
        }
    }
    irb {
        unit 0 {
            family inet {
                address 192.168.0.1/24;
            }
        }
        unit 20 {
            family inet {
                address 192.168.20.1/24;
            }
        }
        unit 50 {
            family inet {
                address 192.168.50.1/24;
            }
        }
        unit 60 {
            family inet {
                address 192.168.60.1/24;
            }
        }
        unit 70 {
            family inet {
                address 192.168.70.1/24;
            }
        }
        unit 90 {
            family inet {
                address 192.168.90.1/24;
            }
        }
        unit 91 {
            family inet {
                address 192.168.91.1/24;
            }
        }
        unit 200 {
            family inet {
                address 192.168.200.1/24;
            }
        }
    }
}
forwarding-options {
    dhcp-relay {
        server-group {
            DHCP_Servers {
                <Internal DHCP Server IP>;
                <Internal DHCP Server IP>;
            }
        }
        active-server-group DHCP_Servers;
        group All {
            interface irb.50;
            interface irb.60;
            interface irb.70;
            interface irb.200;
        }
    }
}
routing-options {
    static {
        route 0.0.0.0/0 next-hop <External Gateway>;
    }
}
protocols {
    l2-learning {
        global-mode switching;
    }
}
access {
    profile dyn-vpn-access-profile {
        authentication-order password;
        client <User> {
            firewall-user {
                password ## SECRET-DATA
            }
        }
        address-assignment {
            pool dyn-vpn-address-pool;
        }
    }
    address-assignment {
        pool junosDHCPPool1 {
            family inet {
                network 192.168.1.0/24;
                range junosRange {
                    low 192.168.1.2;
                    high 192.168.1.254;
                }
                dhcp-attributes {
                    router {
                        192.168.1.1;
                    }
                    propagate-settings ge-0/0/0.0;
                }
            }
        }
        pool junosDHCPPool2 {
            family inet {
                network 192.168.2.0/24;
                range junosRange {
                    low 192.168.2.2;
                    high 192.168.2.254;
                }
                dhcp-attributes {
                    router {
                        192.168.2.1;
                    }
                    propagate-settings ge-0/0/0.0;
                }
            }
        }
        pool dyn-vpn-address-pool {
            family inet {
                network 192.168.199.0/24;
                xauth-attributes {
                    primary-dns <Internal DNS IP>;
                    secondary-dns <Internal DNS IP>;
                }
            }
        }
    }
    firewall-authentication {
        web-authentication {
            default-profile dyn-vpn-access-profile;
        }
    }
}
applications {
    application citrix-ica {
        protocol tcp;
        destination-port <Citrix Port>;
        description "Citrix Applications and Desktops";
    }
    application pbx-ctrl-signals {
        protocol udp;
        destination-port <PBX Ports>;
        description "PBX Control Signals";
    }
    application pbx-voice-paths {
        protocol udp;
        destination-port <PBX Ports>;
        description "PBX Voice Paths";
    }
    application-set pbx-udp-ports {
        description "PBX UDP Communication Ports";
        application pbx-ctrl-signals;
        application pbx-voice-paths;
    }
}
vlans {
    vlan-trust {
        vlan-id 3;
        l3-interface irb.0;
    }
    vlan20 {
        description <Internal Network>;
        vlan-id 20;
        l3-interface irb.20;
    }
    vlan200 {
        description <Internal Network>;
        vlan-id 200;
        l3-interface irb.200;
    }
    vlan50 {
        description <Internal Network>;
        vlan-id 50;
        l3-interface irb.50;
    }
    vlan60 {
        description <Internal Network>;
        vlan-id 60;
        l3-interface irb.60;
    }
    vlan70 {
        description <Internal Network>;
        vlan-id 70;
        l3-interface irb.70;
    }
    vlan90 {
        description <Internal Network>;
        vlan-id 90;
        l3-interface irb.90;
    }
    vlan91 {
        description <Internal Network>;
        vlan-id 91;
        l3-interface irb.91;
    }
}