VPNs in Logical Systems

set logical-systems ls-product-design interfaces st0 unit 1
set security ike proposal ike-phase1-proposal authentication-method pre-shared-keys 
set security ike proposal ike-phase1-proposal dh-group group2 
set security ike proposal ike-phase1-proposal authentication-algorithm sha1 
set security ike proposal ike-phase1-proposal encryption-algorithm aes-128-cbc 
set security ike policy ike-phase1-policy mode main 
set security ike policy ike-phase1-policy proposals ike-phase1-proposal 
set security ike policy ike-phase1-policy pre-shared-key ascii-text "$ABC123" 
set security ike gateway ike-gw ike-policy ike-phase1-policy 
set security ike gateway ike-gw address 2.2.2.2
set security ike gateway ike-gw external-interface ge-0/0/3.0
set security ipsec proposal ipsec-phase2-proposal protocol esp 
set security ipsec proposal ipsec-phase2-proposal authentication-algorithm hmac-sha1-96 
set security ipsec proposal ipsec-phase2-proposal encryption-algorithm aes-128-cbc 
set security ipsec policy vpn-policy1 perfect-forward-secrecy keys group2 
set security ipsec policy vpn-policy1 proposals ipsec-phase2-proposal 
set security ipsec vpn ike-vpn bind-interface st0.1 
set security ipsec vpn ike-vpn vpn-monitor source-interface st0.1 
set security ipsec vpn ike-vpn vpn-monitor destination-ip 4.0.0.1
set security ipsec vpn ike-vpn ike gateway ike-gw 
set security ipsec vpn ike-vpn ike ipsec-policy vpn-policy1 

[edit]
admin@host# show interfaces
    st0 {
        unit 1;
    }
[edit]
admin@host# show security ike 
    proposal ike-phase1-proposal {
        authentication-method pre-shared-keys;
        dh-group group2;
        authentication-algorithm sha1;
        encryption-algorithm aes-128-cbc;
    }
        policy ike-phase1-policy {
            mode main;
            proposals ike-phase1-proposal;
            pre-shared-key ascii-text "$ABC123"; ## SECRET-DATA
        }
        gateway ike-gw {
            ike-policy ike-phase1-policy;
            address 2.2.2.2;
            external-interface ge-0/0/3.0;
        }
[edit]
admin@host# show security ipsec
    proposal ipsec-phase2-proposal {
        protocol esp;
        authentication-algorithm hmac-sha1-96;
        encryption-algorithm aes-128-cbc;
    }
        policy vpn-policy1 {
            perfect-forward-secrecy {
                keys group2;
            }
            proposals ipsec-phase2-proposal;
        }
        vpn ike-vpn {
            bind-interface st0.1;
            vpn-monitor {
                source-interface st0.1;
                destination-ip 4.0.0.1;
            }
            ike {
                gateway ike-gw;
                ipsec-policy vpn-policy1;
            }
        }

user@host> show security ike sa detail
IKE peer 2.2.2.2, Index 7796166, Gateway Name: GW1
  Role: Initiator, State: UP
  Initiator cookie: a1a6b1516bc43d54, Responder cookie: f0846e4239c817f8
  Exchange type: Aggressive, Authentication method: Pre-shared-keys
  Local: 3.3.3.2:500, Remote: 2.2.2.2:500
  Lifetime: Expires in 3585 seconds
  Reauth Lifetime: Disabled
  IKE Fragmentation: Disabled, Size: 0
  Remote Access Client Info: Unknown Client
  Peer ike-id: 2.2.2.2
  AAA assigned IP: 0.0.0.0
  Algorithms:
   Authentication        : hmac-sha256-128 
   Encryption            : aes256-cbc
   Pseudo random function: hmac-sha256
   Diffie-Hellman group  : DH-group-14
  Traffic statistics:
   Input  bytes  :                 1056
   Output bytes  :                 1311
   Input  packets:                    2
   Output packets:                    4
   Input  fragmentated packets:       0
   Output fragmentated packets:       0
  IPSec security associations: 1 created, 0 deleted
  Phase 2 negotiations in progress: 1

    Negotiation type: Quick mode, Role: Initiator, Message ID: 0
    Local: 3.3.3.2:500, Remote: 2.2.2.2:500
    Local identity: r0r2_store1@juniper.net
    Remote identity: 2.2.2.2
    Flags: IKE SA is created

user@host> show security ipsec sa detail
ID: 67109793 Virtual-system: root, VPN Name: VPN1
  Local Gateway: 3.3.3.2, Remote Gateway: 2.2.2.2
  Traffic Selector Name: VPN1_TS1
  Local Identity: ipv4(51.0.1.0-51.0.1.255)
  Remote Identity: ipv4(41.0.1.0-41.0.1.255)
  Version: IKEv1
  DF-bit: clear, Copy-Outer-DSCP Disabled, Bind-interface: st0.1
  Port: 500, Nego#: 0, Fail#: 0, Def-Del#: 0 Flag: 0x2c608b29 
  Tunnel events: 
    Wed Aug 16 2017 23:50:07 -0700: IPSec SA negotiation successfully completed (1 times)
    Wed Aug 16 2017 23:50:07 -0700: IKE SA negotiation successfully completed (1 times)
    Wed Aug 16 2017 23:49:46 -0700: Negotiation failed with error code AUTHENTICATION_FAILED received from peer (2 times)
    Wed Aug 16 2017 23:49:30 -0700: Tunnel is ready. Waiting for trigger event or peer to trigger negotiation (1 times)
  Direction: inbound, SPI: e651d79e, AUX-SPI: 0, VPN Monitoring: -
    Hard lifetime: Expires in 2552 seconds
    Lifesize Remaining:  Unlimited
    Soft lifetime: Expires in 1988 seconds
    Mode: Tunnel(0 0), Type: dynamic, State: installed
    Protocol: ESP, Authentication: hmac-sha256-128, Encryption: aes-cbc (256 bits)
    Anti-replay service: counter-based enabled, Replay window size: 64
  Direction: outbound, SPI: 8ac9ce8, AUX-SPI: 0, VPN Monitoring: -
    Hard lifetime: Expires in 2552 seconds
    Lifesize Remaining:  Unlimited
    Soft lifetime: Expires in 1988 seconds
    Mode: Tunnel(0 0), Type: dynamic, State: installed
    Protocol: ESP, Authentication: hmac-sha256-128, Encryption: aes-cbc (256 bits)
    Anti-replay service: counter-based enabled, Replay window size: 64

set interfaces st0 unit 1 family inet address 10.11.11.150/24
set routing-options static route 192.168.168.0/24 next-hop st0.1
set security policies from-zone ls-product-design-trust to-zone ls-product-design-untrust policy through-vpn match source-address any
set security policies from-zone ls-product-design-trust to-zone ls-product-design-untrust policy through-vpn match destination-address 192.168.168.0/24
set security policies from-zone ls-product-design-trust to-zone ls-product-design-untrust policy through-vpn match application any
set security policies from-zone ls-product-design-trust to-zone ls-product-design-untrust policy through-vpn then permit

[edit]
lsdesignadmin1@host:ls-product-design# show interfaces st0
    unit 1 {
        family inet {
            address 10.11.11.150/24;
        }
    }
    lsdesignadmin1@host:ls-product-design# show routing-options
        static {
            route 192.168.168.0/24 next-hop st0.1;
        }
    [edit]
    lsdesignadmin1@host:ls-product-design# show security policies 
        from-zone ls-product-design-trust to-zone ls-product-design-untrust {
            policy through-vpn {
                match {
                    source-address any;
                    destination-address 192.168.168.0/24;
                    application any;
                }
                then {
                    permit;
                }
            }
            ...
        }