Set security ike policy OUR-IKE-POLICY proposals OUR-IKE-PROPOSAL

Set security ike policy OUR-IKE-POLICY mode main Set security ike proposal OUR-IKE-PROPOSAL lifetime-seconds 86400 Set security ike proposal OUR-IKE-PROPOSAL encryption-algorithm 3des-cbc Set security ike proposal OUR-IKE-PROPOSAL authentication-algorithm sha-256 Set security ike proposal OUR-IKE-PROPOSAL dh-group group5 Set security ike proposal OUR-IKE-PROPOSAL authentication-method pre-shared-keys In the next step, we will configure IKE proposal and IKE policy for both SRX. Set security policies default-policy permit-all

Set security policies default-policy run show configuration security policies | display set run show configuration security policies | display set You need to make the policy as per your requirements. It’s our LAB, that’s why we have default policy which allow everything. Next, we need to configure proper policies for VPN zone. Set security zones security-zone VPN interfaces st0.0 Set security zones security-zone VPN host-inbound-traffic protocols all Set security zones security-zone VPN host-inbound-traffic system-services all In our lab, we named it VPN and for simplicity, we are allowing all protocol and services on this VPN zone. Now, we need to define zone for st0.0 interface. set interfaces st0.0 family inet address set interfaces st0.0 family inet address 192.168.0.2/30 Now, let’s configure st0.0 (tunnel interface) for both SRX end. Set security zones security-zone UNTRUST host-inbound-traffic system-services ike Set security zones security-zone UNTRUST host-inbound-traffic system-services run show config | match UNTRUST | match system-services | display set Now, we need to verify system-service ike are allowed on the external interface or not? run show config | match UNTRUST | match system-services | display set Round-trip min/avg/max/stddev = 10.190/10.697/11.684/0.594 result shows, a full reachability to IPSec peer IP.

Checkpoint route based vpn