自己之前的手記，

Route-Based Site-to-Site VPN, AutoKey IKE

2端都是固定IP的

BO1是分公司1，HO是總公司

BO1

# 定義隧道
set interface "tunnel.1" zone "Untrust"
# 端口自己看著辦
set interface tunnel.1 ip unnumbered interface ethernetXX/XX
# 定義IP組及IP
set address "Untrust" "HO" XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX
set group address "Untrust" "HOG"
set group address "Untrust" "HOG" add "HO"
# 定義VPN，填對端的固定IP地址
set ike gateway TO_HO address XXX.XXX.XXX.XXX main outgoing-interface ethernetXX preshare XXXXX proposal pre-g2-3des-sha
set vpn BO1_HO gateway TO_HO sec-level compatible
set vpn BO1_HO bind interface tunnel.1
set vpn BO1_HO monitor optimized
# 定義路由
set vrouter trust-vr route XXX.XXX.XXX.XXX/XX interface tunnel.1
# 定義policy
set policy top name "TO_HO" from trust to untrust Any HOG any permit
set policy top name "FROM_HO" from untrust to trust HOG Any any permit
# 保存
save

HO

set interface "tunnel.1" zone "Untrust"
set interface tunnel.1 ip unnumbered interface ethernetXX/XX
# 總公司多了控制Trust的，所以也定義組了
set address "Trust" "Trust_LAN" XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX
set address "Untrust" "BO1" XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX
set group address "Untrust" "BO1G"
set group address "Untrust" "BO1G" add "BO1"
set ike gateway TO_BO1 address XXX.XXX.XXX.XXX main outgoing-interface ethernetXX preshare XXXXX proposal pre-g2-3des-sha
set vpn HO_BO1 gateway TO_BO1 sec-level compatible
set vpn HO_BO1 bind interface tunnel.1
set vpn HO_BO1 monitor optimized
set vrouter trust-vr route XXX.XXX.XXX.XXX/XX interface tunnel.1
set policy top name "TO_BO1" from trust to untrust "Trust_LAN" "BO1G" any permit
set policy top name "FROM_BO1" from untrust to trust "BO1G" "Trust_LAN" any permit
save

本文出自 “雪糕豬” 博客，請務必保留此出處http://icecreampig.blog.51cto.com/648013/1940590

Juniper SSG系列防火墻ScreenOS的IPsec VPN