одна из конфигурций которую пытался поднять
|
|
|
|
V

--------------------------Interface-----------------------------------

ge-0/0/1 {
    vlan-tagging;
    unit 3 {
        description untrust-link;
        vlan-id 3;
        family inet {
            address yyy.yyy.yyy.1/30;
   }
    }
    unit 4 {
        description trust;
        vlan-id 4;
        family inet {
            address aaa.aaa.aaa.1/30;

----------------------------------Zone's---------------------------------------

security-zone trust {
    address-book {
        address local-net aaa.aaa.aaa.aaa/24;
    }
    host-inbound-traffic {
        system-services {
            ping;
            traceroute;
            http;
        }
        protocols {
            all;
        }
    }
    interfaces {
        ge-0/0/1.4;

security-zone untrust {
    address-book {
        address remote-net bbb.bbb.bbb.bbb/27;
    }
    host-inbound-traffic {
        system-services {
            ike;                        
            ping;                      
            traceroute;                
                              
        }                              
        protocols {                    
            all;                        
        }                              
    }                                  
    interfaces {                        
        ge-0/0/1.3;                    
                            
    }  

---------------------------------------Routing---------------------------------                      
static {
    route aaa.aaa.aaa.aaa/24 next-hop aaa.aaa.aaa.2;
    route xxx.xxx.xxx.xxx/32 next-hop yyy.yyy.yyy.2;
}

---------------------------------------------------------------------------

security ike

proposal Phase1_for_##### {
    authentication-method pre-shared-keys;
    dh-group group2;
    authentication-algorithm sha1;
    encryption-algorithm 3des-cbc;
    lifetime-seconds 3600;

Policy Policy_for_##### {
    mode main;
    proposals Phase1_for_#####;
    pre-shared-key ascii-text "encrypted keys"; ## SECRET-DATA

gateway ##### {            
    ike-policy Policy_for_#####;  
    address xxx.xxx.xxx.xxx;            
    external-interface ge-0/0/1.3;  
------------------------------------------------------

security ipsec

proposal Phase-2_for_##### {
    protocol esp;
    authentication-algorithm hmac-sha1-96;
    encryption-algorithm 3des-cbc;
    lifetime-seconds 3600;
    lifetime-kilobytes 1048576;

policy Police_Phase2_for_##### {  
    perfect-forward-secrecy {          
        keys group2;                    
    }                                  
    proposals Phase-2_for_#####;  

vpn VPN_##### {
    ike {
        gateway #####;
        ipsec-policy Police_Phase2_for_#####;
    }
    establish-tunnels immediately;
}
------------------------------------------------------------
Policy

from-zone trust to-zone untrust {
    policy vpnpolicy-tr-unt {
        match {
            source-address local-net;
            destination-address remote-net;
            application any;
        }
        then {
            permit {
                tunnel {
                    ipsec-vpn #####;
                    pair-policy vpnpolicy-unt-tr;
                }
            }
        }
    }
    policy any-permit {
        match {
            source-address any;
            destination-address any;    
            application any;            
        }                              
        then {                          
            permit;                    
        }                              
    }                                  
}                                      
from-zone untrust to-zone trust {
    policy vpnpolicy-unt-tr {          
        match {                        
            source-address remote-net;  
            destination-address local-net;
            application any;            
        }                              
        then {                          
            permit {                    
                tunnel {                
                    ipsec-vpn #####;
                    pair-policy vpnpolicy-tr-unt;
                }                      
            }                          
        }                              
    }                                  
}                                      
------------------------------------------------------------