! PermitANY — Juniper JunOS Site-to-Site IPSec VPN
! IKEv2 site-to-site IPSec VPN for Juniper SRX firewalls: IKE proposal/policy/gateway, IPSec proposal/policy/VPN, tunnel interface, and security zone/policy binding.
! Generated: 2026-09-20
! These are EXAMPLE values. Replace with your actual config before deploying.
!
set system host-name SRX-HQ-01
!
# IKE Proposal
set security ike proposal IKE-PROP-203.0.113.2 authentication-method pre-shared-keys
set security ike proposal IKE-PROP-203.0.113.2 dh-group group20
set security ike proposal IKE-PROP-203.0.113.2 authentication-algorithm hmac-sha2-512
set security ike proposal IKE-PROP-203.0.113.2 encryption-algorithm aes-256-cbc
set security ike proposal IKE-PROP-203.0.113.2 lifetime-seconds 86400
!
# IKE Policy
set security ike policy IKE-POL-203.0.113.2 mode main
set security ike policy IKE-POL-203.0.113.2 proposals IKE-PROP-203.0.113.2
set security ike policy IKE-POL-203.0.113.2 pre-shared-key ascii-text "VPNKey2024!"
!
# IKE Gateway
set security ike gateway GW-203.0.113.2 ike-policy IKE-POL-203.0.113.2
set security ike gateway GW-203.0.113.2 address 203.0.113.2
set security ike gateway GW-203.0.113.2 local-identity inet 203.0.113.1
set security ike gateway GW-203.0.113.2 remote-identity inet 203.0.113.2
set security ike gateway GW-203.0.113.2 external-interface ge-0/0/0.0
{{#if (eq ike_version "v2")}}
set security ike gateway GW-203.0.113.2 version v2-only
{{/if}}
!
# IPSec Proposal
set security ipsec proposal IPSEC-PROP-203.0.113.2 protocol esp
set security ipsec proposal IPSEC-PROP-203.0.113.2 encryption-algorithm aes-256-gcm
{{#unless (eq esp_auth "null")}}
set security ipsec proposal IPSEC-PROP-203.0.113.2 authentication-algorithm hmac-sha2-256
{{/unless}}
set security ipsec proposal IPSEC-PROP-203.0.113.2 lifetime-seconds 3600
!
# IPSec Policy
set security ipsec policy IPSEC-POL-203.0.113.2 perfect-forward-secrecy keys group20
set security ipsec policy IPSEC-POL-203.0.113.2 proposals IPSEC-PROP-203.0.113.2
!
# IPSec VPN
set security ipsec vpn VPN-203.0.113.2 bind-interface st0.1
set security ipsec vpn VPN-203.0.113.2 ike gateway GW-203.0.113.2
set security ipsec vpn VPN-203.0.113.2 ike ipsec-policy IPSEC-POL-203.0.113.2
set security ipsec vpn VPN-203.0.113.2 establish-tunnels immediately
!
# Tunnel Interface
set interfaces st0 unit 1 description "VPN to 203.0.113.2"
set interfaces st0 unit 1 family inet address 10.255.0.1/30
!
# Security Zone
set security zones security-zone vpn interfaces st0.1
!
# Static Route
set routing-options static route 10.0.0.0/24 next-hop st0.1
!
# Security Policy (allow VPN traffic)
set security policies from-zone trust to-zone vpn policy ALLOW-VPN-OUT match source-address any
set security policies from-zone trust to-zone vpn policy ALLOW-VPN-OUT match destination-address any
set security policies from-zone trust to-zone vpn policy ALLOW-VPN-OUT match application any
set security policies from-zone trust to-zone vpn policy ALLOW-VPN-OUT then permit
set security policies from-zone vpn to-zone trust policy ALLOW-VPN-IN match source-address any
set security policies from-zone vpn to-zone trust policy ALLOW-VPN-IN match destination-address any
set security policies from-zone vpn to-zone trust policy ALLOW-VPN-IN match application any
set security policies from-zone vpn to-zone trust policy ALLOW-VPN-IN then permit