Example: Configure IPSec VPN in Active-Active Multinode High Availability in a Layer 3 Network

user@host> request system software add optional://junos-ike.tgz
Verified junos-ike signed by PackageProductionECP256_2022 method ECDSA256+SHA256
Rebuilding schema and Activating configuration...
mgd: commit complete
Restarting MGD ...

WARNING: cli has been replaced by an updated version:
CLI release 20220208.163814_builder.r1239105 built by builder on 2022-02-08 17:07:55 UTC
Restart cli using the new version ? [yes,no] (yes)

set groups vpn_config when peers SRX-01
set groups vpn_config when peers SRX-02
set groups vpn_config security ike proposal SRG1_IKE_PROP authentication-method pre-shared-keys
set groups vpn_config security ike proposal SRG1_IKE_PROP dh-group group14
set groups vpn_config security ike proposal SRG1_IKE_PROP authentication-algorithm sha-256
set groups vpn_config security ike proposal SRG1_IKE_PROP encryption-algorithm aes-256-cbc
set groups vpn_config security ike proposal SRG1_IKE_PROP lifetime-seconds 3600
set groups vpn_config security ike proposal SRG2_IKE_PROP authentication-method pre-shared-keys
set groups vpn_config security ike proposal SRG2_IKE_PROP dh-group group14
set groups vpn_config security ike proposal SRG2_IKE_PROP authentication-algorithm sha-256
set groups vpn_config security ike proposal SRG2_IKE_PROP encryption-algorithm aes-256-cbc
set groups vpn_config security ike proposal SRG2_IKE_PROP lifetime-seconds 3600
set groups vpn_config security ike policy SRG1_IKE_POL1 proposals SRG1_IKE_PROP
set groups vpn_config security ike policy SRG1_IKE_POL1 pre-shared-key ascii-text "$ABC123"
set groups vpn_config security ike policy SRG2_IKE_POL500 proposals SRG2_IKE_PROP
set groups vpn_config security ike policy SRG2_IKE_POL500 pre-shared-key ascii-text "$ABC123"
set groups vpn_config security ike gateway SRG1_IKE_GW1 ike-policy SRG1_IKE_POL1
set groups vpn_config security ike gateway SRG1_IKE_GW1 address 10.112.0.1
set groups vpn_config security ike gateway SRG1_IKE_GW1 external-interface lo0
set groups vpn_config security ike gateway SRG1_IKE_GW1 local-address 10.11.0.1
set groups vpn_config security ike gateway SRG1_IKE_GW1 version v2-only
set groups vpn_config security ike gateway SRG2_IKE_GW500 ike-policy SRG2_IKE_POL500
set groups vpn_config security ike gateway SRG2_IKE_GW500 address 10.112.0.5
set groups vpn_config security ike gateway SRG2_IKE_GW500 external-interface lo0
set groups vpn_config security ike gateway SRG2_IKE_GW500 local-address 10.12.0.1
set groups vpn_config security ike gateway SRG2_IKE_GW500 version v2-only
set groups vpn_config security ipsec proposal SRG1_IPSEC_PROP protocol esp
set groups vpn_config security ipsec proposal SRG1_IPSEC_PROP authentication-algorithm hmac-sha-256-128
set groups vpn_config security ipsec proposal SRG1_IPSEC_PROP encryption-algorithm aes-256-cbc
set groups vpn_config security ipsec proposal SRG1_IPSEC_PROP lifetime-seconds 1800
set groups vpn_config security ipsec proposal SRG2_IPSEC_PROP protocol esp
set groups vpn_config security ipsec proposal SRG2_IPSEC_PROP authentication-algorithm hmac-sha-256-128
set groups vpn_config security ipsec proposal SRG2_IPSEC_PROP encryption-algorithm aes-256-cbc
set groups vpn_config security ipsec proposal SRG2_IPSEC_PROP lifetime-seconds 1800
set groups vpn_config security ipsec policy SRG1_IPSEC_POL1 proposals SRG1_IPSEC_PROP
set groups vpn_config security ipsec policy SRG2_IPSEC_POL501 proposals SRG2_IPSEC_PROP
set groups vpn_config security ipsec policy SRG2_IPSEC_POL500 proposals SRG2_IPSEC_PROP
set groups vpn_config security ipsec policy SRG2_IPSEC_POL502 proposals SRG2_IPSEC_PROP
set groups vpn_config security ipsec policy SRG2_IPSEC_POL503 proposals SRG2_IPSEC_PROP
set groups vpn_config security ipsec vpn SRG1_IPSEC_VPN1 bind-interface st0.1
set groups vpn_config security ipsec vpn SRG1_IPSEC_VPN1 ike gateway SRG1_IKE_GW1
set groups vpn_config security ipsec vpn SRG1_IPSEC_VPN1 ike ipsec-policy SRG1_IPSEC_POL1
set groups vpn_config security ipsec vpn SRG1_IPSEC_VPN1 traffic-selector ts1 local-ip 10.1.0.2/32
set groups vpn_config security ipsec vpn SRG1_IPSEC_VPN1 traffic-selector ts1 remote-ip 10.7.0.2/32
set groups vpn_config security ipsec vpn SRG1_IPSEC_VPN1 establish-tunnels on-traffic
set groups vpn_config security ipsec vpn SRG2_IPSEC_VPN500 bind-interface st0.500
set groups vpn_config security ipsec vpn SRG2_IPSEC_VPN500 ike gateway SRG2_IKE_GW500
set groups vpn_config security ipsec vpn SRG2_IPSEC_VPN500 ike ipsec-policy SRG2_IPSEC_POL500
set groups vpn_config security ipsec vpn SRG2_IPSEC_VPN500 traffic-selector ts500 local-ip 10.8.0.2/32
set groups vpn_config security ipsec vpn SRG2_IPSEC_VPN500 traffic-selector ts500 remote-ip 10.9.0.2/32
set groups vpn_config security ipsec vpn SRG2_IPSEC_VPN500 establish-tunnels on-traffic
set groups vpn_config security zones security-zone vpn host-inbound-traffic system-services ike
set groups vpn_config security zones security-zone vpn host-inbound-traffic protocols all
set groups vpn_config security zones security-zone vpn interfaces st0.1
set groups vpn_config security zones security-zone vpn interfaces st0.500
set groups vpn_config interfaces st0 unit 1 family inet
set groups vpn_config interfaces st0 unit 1 family inet6
set groups vpn_config interfaces st0 unit 500 family inet
set groups vpn_config interfaces st0 unit 500 family inet6
set apply-groups vpn_config
set chassis high-availability local-id 1
set chassis high-availability local-id local-ip 10.22.0.2
set chassis high-availability peer-id 2 peer-ip 10.22.0.1
set chassis high-availability peer-id 2 interface ge-0/0/2.0
set chassis high-availability peer-id 2 vpn-profile ICL_IPSEC_VPN
set chassis high-availability peer-id 2 liveness-detection minimum-interval 200
set chassis high-availability peer-id 2 liveness-detection multiplier 3
set chassis high-availability services-redundancy-group 1 deployment-type routing
set chassis high-availability services-redundancy-group 1 peer-id 2
set chassis high-availability services-redundancy-group 1 activeness-probe dest-ip 10.111.0.1
set chassis high-availability services-redundancy-group 1 activeness-probe dest-ip src-ip 10.11.0.1
set chassis high-availability services-redundancy-group 1 monitor bfd-liveliness 10.5.0.2 src-ip 10.5.0.1
set chassis high-availability services-redundancy-group 1 monitor bfd-liveliness 10.5.0.2 session-type singlehop
set chassis high-availability services-redundancy-group 1 monitor bfd-liveliness 10.5.0.2 interface ge-0/0/3.0
set chassis high-availability services-redundancy-group 1 monitor interface ge-0/0/3
set chassis high-availability services-redundancy-group 1 monitor interface ge-0/0/4
set chassis high-availability services-redundancy-group 1 active-signal-route 10.39.1.1
set chassis high-availability services-redundancy-group 1 backup-signal-route 10.39.1.2
set chassis high-availability services-redundancy-group 1 prefix-list SRG1_PFX
set chassis high-availability services-redundancy-group 1 managed-services ipsec
set chassis high-availability services-redundancy-group 1 preemption
set chassis high-availability services-redundancy-group 1 activeness-priority 1
set chassis high-availability services-redundancy-group 2 peer-id 2
set chassis high-availability services-redundancy-group 2 activeness-probe dest-ip 10.111.0.1
set chassis high-availability services-redundancy-group 2 activeness-probe dest-ip src-ip 10.12.0.1
set chassis high-availability services-redundancy-group 2 monitor bfd-liveliness 10.5.0.2 src-ip 10.5.0.1
set chassis high-availability services-redundancy-group 2 monitor bfd-liveliness 10.5.0.2 session-type singlehop
set chassis high-availability services-redundancy-group 2 monitor bfd-liveliness 10.5.0.2 interface ge-0/0/3.0
set chassis high-availability services-redundancy-group 2 monitor interface ge-0/0/3
set chassis high-availability services-redundancy-group 2 monitor interface ge-0/0/4
set chassis high-availability services-redundancy-group 2 active-signal-route 10.49.1.1
set chassis high-availability services-redundancy-group 2 backup-signal-route 10.49.1.2
set chassis high-availability services-redundancy-group 2 prefix-list SRG2_PFX
set chassis high-availability services-redundancy-group 2 managed-services ipsec
set chassis high-availability services-redundancy-group 2 preemption
set chassis high-availability services-redundancy-group 2 activeness-priority 200
set security ike proposal ICL_IKE_PROP description interchassis_link_encr_tunnel
set security ike proposal ICL_IKE_PROP authentication-method pre-shared-keys
set security ike proposal ICL_IKE_PROP dh-group group14
set security ike proposal ICL_IKE_PROP authentication-algorithm sha-256
set security ike proposal ICL_IKE_PROP encryption-algorithm aes-256-cbc
set security ike proposal ICL_IKE_PROP lifetime-seconds 300
set security ike policy ICL_IKE_POL description interchassis_link_encr_tunnel
set security ike policy ICL_IKE_POL proposals ICL_IKE_PROP
set security ike policy ICL_IKE_POL pre-shared-key ascii-text "$ABC123"
set security ike gateway ICL_IKE_GW ike-policy ICL_IKE_POL
set security ike gateway ICL_IKE_GW version v2-only
set security ipsec proposal ICL_IPSEC_PROP description interchassis_link_encr_tunnel
set security ipsec proposal ICL_IPSEC_PROP protocol esp
set security ipsec proposal ICL_IPSEC_PROP encryption-algorithm aes-256-gcm
set security ipsec proposal ICL_IPSEC_PROP lifetime-seconds 300
set security ipsec policy ICL_IPSEC_POL description interchassis_link_encr_tunnel
set security ipsec policy ICL_IPSEC_POL proposals ICL_IPSEC_PROP
set security ipsec vpn ICL_IPSEC_VPN ha-link-encryption
set security ipsec vpn ICL_IPSEC_VPN ike gateway ICL_IKE_GW
set security ipsec vpn ICL_IPSEC_VPN ike ipsec-policy ICL_IPSEC_POL
set security policies default-policy permit-all
set security zones security-zone vpn host-inbound-traffic system-services ike
set security zones security-zone vpn host-inbound-traffic protocols all
set security zones security-zone vpn interfaces st0.1
set security zones security-zone untrust host-inbound-traffic system-services ike
set security zones security-zone untrust host-inbound-traffic system-services ping
set security zones security-zone untrust host-inbound-traffic protocols bfd
set security zones security-zone untrust host-inbound-traffic protocols bgp
set security zones security-zone untrust interfaces lo0.0
set security zones security-zone untrust interfaces ge-0/0/3.0
set security zones security-zone trust host-inbound-traffic system-services all
set security zones security-zone trust host-inbound-traffic protocols all
set security zones security-zone trust interfaces ge-0/0/4.0
set security zones security-zone icl_zone host-inbound-traffic system-services ike
set security zones security-zone icl_zone host-inbound-traffic system-services ping
set security zones security-zone icl_zone host-inbound-traffic system-services high-availability
set security zones security-zone icl_zone host-inbound-traffic system-services ssh
set security zones security-zone icl_zone host-inbound-traffic protocols bfd
set security zones security-zone icl_zone host-inbound-traffic protocols bgp
set security zones security-zone icl_zone interfaces ge-0/0/2.0
set interfaces ge-0/0/1 unit 0 family inet
set interfaces ge-0/0/2 description inter_chassis_link
set interfaces ge-0/0/2 unit 0 family inet address 10.22.0.2/24
set interfaces ge-0/0/3 description untrust
set interfaces ge-0/0/3 unit 0 family inet address 10.3.0.2/24
set interfaces ge-0/0/4 description trust
set interfaces ge-0/0/4 unit 0 family inet address 10.5.0.1/24
set interfaces lo0 apply-groups-except global
set interfaces lo0 description untrust
set interfaces lo0 unit 0 family inet address 10.11.0.1/32
set interfaces lo0 unit 0 family inet address 10.12.0.1/32
set interfaces st0 unit 1
set policy-options prefix-list SRG1_PFX 10.11.0.0/24
set policy-options prefix-list SRG2_PFX 10.12.0.0/24
set policy-options route-filter-list srg1_rf_list 10.11.0.0/24 orlonger
set policy-options route-filter-list srg1_rf_list 10.7.0.0/16 orlonger
set policy-options route-filter-list srg1_rf_list 10.1.0.0/16 orlonger
set policy-options route-filter-list srg2_rf_list 10.12.0.0/24 orlonger
set policy-options route-filter-list srg2_rf_list 10.9.0.0/16 orlonger
set policy-options route-filter-list srg2_rf_list 10.8.0.0/16 orlonger
set policy-options policy-statement mnha-route-policy term 1 from route-filter-list srg1_rf_list
set policy-options policy-statement mnha-route-policy term 1 from condition active_route_exists_srg1
set policy-options policy-statement mnha-route-policy term 1 then metric 10
set policy-options policy-statement mnha-route-policy term 1 then accept
set policy-options policy-statement mnha-route-policy term 2 from route-filter-list srg1_rf_list
set policy-options policy-statement mnha-route-policy term 2 from condition backup_route_exists_srg1
set policy-options policy-statement mnha-route-policy term 2 then metric 20
set policy-options policy-statement mnha-route-policy term 2 then accept
set policy-options policy-statement mnha-route-policy term 3 from route-filter-list srg2_rf_list
set policy-options policy-statement mnha-route-policy term 3 from condition active_route_exists_srg2
set policy-options policy-statement mnha-route-policy term 3 then metric 10
set policy-options policy-statement mnha-route-policy term 3 then accept
set policy-options policy-statement mnha-route-policy term 4 from route-filter-list srg2_rf_list
set policy-options policy-statement mnha-route-policy term 4 from condition backup_route_exists_srg2
set policy-options policy-statement mnha-route-policy term 4 then metric 20
set policy-options policy-statement mnha-route-policy term 4 then accept
set policy-options policy-statement mnha-route-policy term default then reject
set policy-options condition active_route_exists_srg1 if-route-exists address-family inet 10.39.1.1/32
set policy-options condition active_route_exists_srg1 if-route-exists address-family inet table inet.0
set policy-options condition active_route_exists_srg2 if-route-exists address-family inet 10.49.1.1/32
set policy-options condition active_route_exists_srg2 if-route-exists address-family inet table inet.0
set policy-options condition backup_route_exists_srg1 if-route-exists address-family inet 10.39.1.2/32
set policy-options condition backup_route_exists_srg1 if-route-exists address-family inet table inet.0
set policy-options condition backup_route_exists_srg2 if-route-exists address-family inet 10.49.1.2/32
set policy-options condition backup_route_exists_srg2 if-route-exists address-family inet table inet.0
set protocols bgp group trust type internal
set protocols bgp group trust local-address 10.3.0.2
set protocols bgp group trust export mnha-route-policy
set protocols bgp group trust local-as 100
set protocols bgp group trust bfd-liveness-detection minimum-interval 500
set protocols bgp group trust bfd-liveness-detection minimum-receive-interval 500
set protocols bgp group trust bfd-liveness-detection multiplier 3
set protocols bgp group trust neighbor 10.3.0.1
set protocols bgp group untrust type internal
set protocols bgp group untrust local-address 10.5.0.1
set protocols bgp group untrust export mnha-route-policy
set protocols bgp group untrust local-as 100
set protocols bgp group untrust bfd-liveness-detection minimum-interval 500
set protocols bgp group untrust bfd-liveness-detection minimum-receive-interval 500
set protocols bgp group untrust bfd-liveness-detection multiplier 3
set protocols bgp group untrust neighbor 10.5.0.2
set routing-options autonomous-system 100
set routing-options static route 10.7.0.0/16 next-hop 10.5.0.2
set routing-options static route 10.112.0.0/24 next-hop 10.5.0.2

set groups vpn_config when peers SRX-01
set groups vpn_config when peers SRX-02
set groups vpn_config security ike proposal SRG1_IKE_PROP authentication-method pre-shared-keys
set groups vpn_config security ike proposal SRG1_IKE_PROP dh-group group14
set groups vpn_config security ike proposal SRG1_IKE_PROP authentication-algorithm sha-256
set groups vpn_config security ike proposal SRG1_IKE_PROP encryption-algorithm aes-256-cbc
set groups vpn_config security ike proposal SRG1_IKE_PROP lifetime-seconds 3600
set groups vpn_config security ike proposal SRG2_IKE_PROP authentication-method pre-shared-keys
set groups vpn_config security ike proposal SRG2_IKE_PROP dh-group group14
set groups vpn_config security ike proposal SRG2_IKE_PROP authentication-algorithm sha-256
set groups vpn_config security ike proposal SRG2_IKE_PROP encryption-algorithm aes-256-cbc
set groups vpn_config security ike proposal SRG2_IKE_PROP lifetime-seconds 3600
set groups vpn_config security ike policy SRG1_IKE_POL1 proposals SRG1_IKE_PROP
set groups vpn_config security ike policy SRG1_IKE_POL1 pre-shared-key ascii-text "$ABC123"
set groups vpn_config security ike policy SRG2_IKE_POL500 proposals SRG2_IKE_PROP
set groups vpn_config security ike policy SRG2_IKE_POL500 pre-shared-key ascii-text "$ABC123"
set groups vpn_config security ike gateway SRG1_IKE_GW1 ike-policy SRG1_IKE_POL1
set groups vpn_config security ike gateway SRG1_IKE_GW1 address 10.112.0.1
set groups vpn_config security ike gateway SRG1_IKE_GW1 external-interface lo0
set groups vpn_config security ike gateway SRG1_IKE_GW1 local-address 10.11.0.1
set groups vpn_config security ike gateway SRG1_IKE_GW1 version v2-only
set groups vpn_config security ike gateway SRG2_IKE_GW500 ike-policy SRG2_IKE_POL500
set groups vpn_config security ike gateway SRG2_IKE_GW500 address 10.112.0.5
set groups vpn_config security ike gateway SRG2_IKE_GW500 external-interface lo0
set groups vpn_config security ike gateway SRG2_IKE_GW500 local-address 10.12.0.1
set groups vpn_config security ike gateway SRG2_IKE_GW500 version v2-only
set groups vpn_config security ipsec proposal SRG1_IPSEC_PROP protocol esp
set groups vpn_config security ipsec proposal SRG1_IPSEC_PROP authentication-algorithm hmac-sha-256-128
set groups vpn_config security ipsec proposal SRG1_IPSEC_PROP encryption-algorithm aes-256-cbc
set groups vpn_config security ipsec proposal SRG1_IPSEC_PROP lifetime-seconds 1800
set groups vpn_config security ipsec proposal SRG2_IPSEC_PROP protocol esp
set groups vpn_config security ipsec proposal SRG2_IPSEC_PROP authentication-algorithm hmac-sha-256-128
set groups vpn_config security ipsec proposal SRG2_IPSEC_PROP encryption-algorithm aes-256-cbc
set groups vpn_config security ipsec proposal SRG2_IPSEC_PROP lifetime-seconds 1800
set groups vpn_config security ipsec policy SRG1_IPSEC_POL1 proposals SRG1_IPSEC_PROP
set groups vpn_config security ipsec policy SRG2_IPSEC_POL501 proposals SRG2_IPSEC_PROP
set groups vpn_config security ipsec policy SRG2_IPSEC_POL500 proposals SRG2_IPSEC_PROP
set groups vpn_config security ipsec policy SRG2_IPSEC_POL502 proposals SRG2_IPSEC_PROP
set groups vpn_config security ipsec policy SRG2_IPSEC_POL503 proposals SRG2_IPSEC_PROP
set groups vpn_config security ipsec vpn SRG1_IPSEC_VPN1 bind-interface st0.1
set groups vpn_config security ipsec vpn SRG1_IPSEC_VPN1 ike gateway SRG1_IKE_GW1
set groups vpn_config security ipsec vpn SRG1_IPSEC_VPN1 ike ipsec-policy SRG1_IPSEC_POL1
set groups vpn_config security ipsec vpn SRG1_IPSEC_VPN1 traffic-selector ts1 local-ip 10.1.0.2/32
set groups vpn_config security ipsec vpn SRG1_IPSEC_VPN1 traffic-selector ts1 remote-ip 10.7.0.2/32
set groups vpn_config security ipsec vpn SRG1_IPSEC_VPN1 establish-tunnels on-traffic
set groups vpn_config security ipsec vpn SRG2_IPSEC_VPN500 bind-interface st0.500
set groups vpn_config security ipsec vpn SRG2_IPSEC_VPN500 ike gateway SRG2_IKE_GW500
set groups vpn_config security ipsec vpn SRG2_IPSEC_VPN500 ike ipsec-policy SRG2_IPSEC_POL500
set groups vpn_config security ipsec vpn SRG2_IPSEC_VPN500 traffic-selector ts500 local-ip 10.8.0.2/32
set groups vpn_config security ipsec vpn SRG2_IPSEC_VPN500 traffic-selector ts500 remote-ip 10.9.0.2/32
set groups vpn_config security ipsec vpn SRG2_IPSEC_VPN500 establish-tunnels on-traffic
set groups vpn_config security zones security-zone vpn host-inbound-traffic system-services ike
set groups vpn_config security zones security-zone vpn host-inbound-traffic protocols all
set groups vpn_config security zones security-zone vpn interfaces st0.1
set groups vpn_config security zones security-zone vpn interfaces st0.500
set groups vpn_config interfaces st0 unit 1 family inet
set groups vpn_config interfaces st0 unit 1 family inet6
set groups vpn_config interfaces st0 unit 500 family inet
set groups vpn_config interfaces st0 unit 500 family inet6
set apply-groups vpn_config
set chassis high-availability local-id 2
set chassis high-availability local-id local-ip 10.22.0.1
set chassis high-availability peer-id 1 peer-ip 10.22.0.2
set chassis high-availability peer-id 1 interface ge-0/0/2.0
set chassis high-availability peer-id 1 vpn-profile ICL_IPSEC_VPN
set chassis high-availability peer-id 1 liveness-detection minimum-interval 200
set chassis high-availability peer-id 1 liveness-detection multiplier 3
set chassis high-availability services-redundancy-group 1 deployment-type routing
set chassis high-availability services-redundancy-group 1 peer-id 1
set chassis high-availability services-redundancy-group 1 activeness-probe dest-ip 10.111.0.1
set chassis high-availability services-redundancy-group 1 activeness-probe dest-ip src-ip 10.11.0.1
set chassis high-availability services-redundancy-group 1 monitor bfd-liveliness 10.4.0.2 src-ip 10.4.0.1
set chassis high-availability services-redundancy-group 1 monitor bfd-liveliness 10.4.0.2 session-type singlehop
set chassis high-availability services-redundancy-group 1 monitor bfd-liveliness 10.4.0.2 interface ge-0/0/3.0
set chassis high-availability services-redundancy-group 1 monitor interface ge-0/0/3
set chassis high-availability services-redundancy-group 1 monitor interface ge-0/0/4
set chassis high-availability services-redundancy-group 1 active-signal-route 10.39.1.1
set chassis high-availability services-redundancy-group 1 backup-signal-route 10.39.1.2
set chassis high-availability services-redundancy-group 1 prefix-list SRG1_PFX
set chassis high-availability services-redundancy-group 1 managed-services ipsec
set chassis high-availability services-redundancy-group 1 preemption
set chassis high-availability services-redundancy-group 1 activeness-priority 200
set chassis high-availability services-redundancy-group 2 peer-id 1
set chassis high-availability services-redundancy-group 2 activeness-probe dest-ip 10.111.0.1
set chassis high-availability services-redundancy-group 2 activeness-probe dest-ip src-ip 10.12.0.1
set chassis high-availability services-redundancy-group 2 monitor bfd-liveliness 10.4.0.2 src-ip 10.4.0.1
set chassis high-availability services-redundancy-group 2 monitor bfd-liveliness 10.4.0.2 session-type singlehop
set chassis high-availability services-redundancy-group 2 monitor bfd-liveliness 10.4.0.2 interface ge-0/0/3.0
set chassis high-availability services-redundancy-group 2 monitor interface ge-0/0/3
set chassis high-availability services-redundancy-group 2 monitor interface ge-0/0/4
set chassis high-availability services-redundancy-group 2 active-signal-route 10.49.1.1
set chassis high-availability services-redundancy-group 2 backup-signal-route 10.49.1.2
set chassis high-availability services-redundancy-group 2 prefix-list SRG2_PFX
set chassis high-availability services-redundancy-group 2 managed-services ipsec
set chassis high-availability services-redundancy-group 2 preemption
set chassis high-availability services-redundancy-group 2 activeness-priority 1
set security ike proposal ICL_IKE_PROP description interchassisa_link_encr_tunnel
set security ike proposal ICL_IKE_PROP authentication-method pre-shared-keys
set security ike proposal ICL_IKE_PROP dh-group group14
set security ike proposal ICL_IKE_PROP authentication-algorithm sha-256
set security ike proposal ICL_IKE_PROP encryption-algorithm aes-256-cbc
set security ike proposal ICL_IKE_PROP lifetime-seconds 300
set security ike policy ICL_IKE_POL description interchassis_link_encr_tunnel
set security ike policy ICL_IKE_POL proposals ICL_IKE_PROP
set security ike policy ICL_IKE_POL pre-shared-key ascii-text "$ABC123"
set security ike gateway ICL_IKE_GW ike-policy ICL_IKE_POL
set security ike gateway ICL_IKE_GW version v2-only
set security ipsec proposal ICL_IPSEC_PROP description interchassis_link_encr_tunnel
set security ipsec proposal ICL_IPSEC_PROP protocol esp
set security ipsec proposal ICL_IPSEC_PROP encryption-algorithm aes-256-gcm
set security ipsec proposal ICL_IPSEC_PROP lifetime-seconds 300
set security ipsec policy ICL_IPSEC_POL description interchassis_link_encr_tunnel
set security ipsec policy ICL_IPSEC_POL proposals ICL_IPSEC_PROP
set security ipsec vpn ICL_IPSEC_VPN ha-link-encryption
set security ipsec vpn ICL_IPSEC_VPN ike gateway ICL_IKE_GW
set security ipsec vpn ICL_IPSEC_VPN ike ipsec-policy ICL_IPSEC_POL
set security policies default-policy permit-all
set security zones security-zone untrust host-inbound-traffic system-services ike
set security zones security-zone untrust host-inbound-traffic system-services ping
set security zones security-zone untrust host-inbound-traffic protocols bfd
set security zones security-zone untrust host-inbound-traffic protocols bgp
set security zones security-zone untrust interfaces lo0.0
set security zones security-zone untrust interfaces ge-0/0/3.0
set security zones security-zone vpn host-inbound-traffic system-services ike
set security zones security-zone vpn host-inbound-traffic protocols all
set security zones security-zone vpn interfaces st0.1
set security zones security-zone trust host-inbound-traffic system-services all
set security zones security-zone trust host-inbound-traffic protocols all
set security zones security-zone trust interfaces ge-0/0/4.0
set security zones security-zone icl_zone host-inbound-traffic system-services ike
set security zones security-zone icl_zone host-inbound-traffic system-services ping
set security zones security-zone icl_zone host-inbound-traffic system-services high-availability
set security zones security-zone icl_zone host-inbound-traffic system-services ssh
set security zones security-zone icl_zone host-inbound-traffic protocols bfd
set security zones security-zone icl_zone host-inbound-traffic protocols bgp
set security zones security-zone icl_zone interfaces ge-0/0/2.0
set interfaces ge-0/0/1 unit 0 family inet
set interfaces ge-0/0/2 description inter_chassis_link
set interfaces ge-0/0/2 unit 0 family inet address 10.22.0.1/24
set interfaces ge-0/0/3 description untrust
set interfaces ge-0/0/3 unit 0 family inet address 10.2.0.2/24
set interfaces ge-0/0/4 description trust
set interfaces ge-0/0/4 unit 0 family inet address 10.4.0.1/24
set interfaces lo0 apply-groups-except global
set interfaces lo0 description untrust
set interfaces lo0 unit 0 family inet address 10.11.0.1/32
set interfaces lo0 unit 0 family inet address 10.12.0.1/32
set interfaces st0 unit 1 family inet
set interfaces st0 unit 1 family inet6
set policy-options prefix-list SRG1_PFX 10.11.0.0/24
set policy-options prefix-list SRG2_PFX 10.12.0.0/24
set policy-options route-filter-list srg1_rf_list 10.11.0.0/24 orlonger
set policy-options route-filter-list srg1_rf_list 10.7.0.0/24 orlonger
set policy-options route-filter-list srg1_rf_list 10.1.0.0/24 orlonger
set policy-options route-filter-list srg2_rf_list 10.12.0.0/24 orlonger
set policy-options route-filter-list srg2_rf_list 10.9.0.0/24 orlonger
set policy-options route-filter-list srg2_rf_list 10.8.0.0/24 orlonger
set policy-options policy-statement mnha-route-policy term 1 from route-filter-list srg1_rf_list
set policy-options policy-statement mnha-route-policy term 1 from condition active_route_exists_srg1
set policy-options policy-statement mnha-route-policy term 1 then metric 10
set policy-options policy-statement mnha-route-policy term 1 then accept
set policy-options policy-statement mnha-route-policy term 2 from route-filter-list srg1_rf_list
set policy-options policy-statement mnha-route-policy term 2 from condition backup_route_exists_srg1
set policy-options policy-statement mnha-route-policy term 2 then metric 20
set policy-options policy-statement mnha-route-policy term 2 then accept
set policy-options policy-statement mnha-route-policy term 3 from route-filter-list srg2_rf_list
set policy-options policy-statement mnha-route-policy term 3 from condition active_route_exists_srg2
set policy-options policy-statement mnha-route-policy term 3 then metric 10
set policy-options policy-statement mnha-route-policy term 3 then accept
set policy-options policy-statement mnha-route-policy term 4 from route-filter-list srg2_rf_list
set policy-options policy-statement mnha-route-policy term 4 from condition backup_route_exists_srg2
set policy-options policy-statement mnha-route-policy term 4 then metric 20
set policy-options policy-statement mnha-route-policy term 4 then accept
set policy-options policy-statement mnha-route-policy term default then reject
set policy-options condition active_route_exists_srg1 if-route-exists address-family inet 10.39.1.1/32
set policy-options condition active_route_exists_srg1 if-route-exists address-family inet table inet.0
set policy-options condition active_route_exists_srg2 if-route-exists address-family inet 10.49.1.1/32
set policy-options condition active_route_exists_srg2 if-route-exists address-family inet table inet.0
set policy-options condition backup_route_exists_srg1 if-route-exists address-family inet 10.39.1.2/32
set policy-options condition backup_route_exists_srg1 if-route-exists address-family inet table inet.0
set policy-options condition backup_route_exists_srg2 if-route-exists address-family inet 10.49.1.2/32
set policy-options condition backup_route_exists_srg2 if-route-exists address-family inet table inet.0
set protocols bgp group trust type internal
set protocols bgp group trust local-address 10.2.0.2
set protocols bgp group trust export mnha-route-policy
set protocols bgp group trust local-as 100
set protocols bgp group trust bfd-liveness-detection minimum-interval 500
set protocols bgp group trust bfd-liveness-detection minimum-receive-interval 500
set protocols bgp group trust bfd-liveness-detection multiplier 3
set protocols bgp group trust neighbor 10.2.0.1
set protocols bgp group untrust type internal
set protocols bgp group untrust local-address 10.4.0.1
set protocols bgp group untrust export mnha-route-policy
set protocols bgp group untrust local-as 100
set protocols bgp group untrust bfd-liveness-detection minimum-interval 500
set protocols bgp group untrust bfd-liveness-detection minimum-receive-interval 500
set protocols bgp group untrust bfd-liveness-detection multiplier 3
set protocols bgp group untrust neighbor 10.4.0.2
set routing-options autonomous-system 100
set routing-options static route 10.7.0.0/24 next-hop 10.4.0.2
set routing-options static route 10.112.0.0/24 next-hop 10.4.0.2

set security ike proposal SRG1_IKE_PROP authentication-method pre-shared-keys
set security ike proposal SRG1_IKE_PROP dh-group group14
set security ike proposal SRG1_IKE_PROP authentication-algorithm sha-256
set security ike proposal SRG1_IKE_PROP encryption-algorithm aes-256-cbc
set security ike proposal SRG1_IKE_PROP lifetime-seconds 3600
set security ike proposal SRG2_IKE_PROP authentication-method pre-shared-keys
set security ike proposal SRG2_IKE_PROP dh-group group14
set security ike proposal SRG2_IKE_PROP authentication-algorithm sha-256
set security ike proposal SRG2_IKE_PROP encryption-algorithm aes-256-cbc
set security ike proposal SRG2_IKE_PROP lifetime-seconds 3600
set security ike policy SRG1_IKE_POL1 proposals SRG1_IKE_PROP
set security ike policy SRG1_IKE_POL1 pre-shared-key ascii-text "$ABC123"
set security ike policy SRG2_IKE_POL500 proposals SRG2_IKE_PROP
set security ike policy SRG2_IKE_POL500 pre-shared-key ascii-text "$ABC123"
set security ike gateway SRG1_IKE_GW1 ike-policy SRG1_IKE_POL1
set security ike gateway SRG1_IKE_GW1 address 10.11.0.1
set security ike gateway SRG1_IKE_GW1 external-interface lo0
set security ike gateway SRG1_IKE_GW1 local-address 10.112.0.1
set security ike gateway SRG1_IKE_GW1 version v2-only
set security ike gateway SRG2_IKE_GW500 ike-policy SRG2_IKE_POL500
set security ike gateway SRG2_IKE_GW500 address 10.12.0.1
set security ike gateway SRG2_IKE_GW500 external-interface lo0
set security ike gateway SRG2_IKE_GW500 local-address 10.112.0.5
set security ike gateway SRG2_IKE_GW500 version v2-only
set security ipsec proposal SRG1_IPSEC_PROP protocol esp
set security ipsec proposal SRG1_IPSEC_PROP authentication-algorithm hmac-sha-256-128
set security ipsec proposal SRG1_IPSEC_PROP encryption-algorithm aes-256-cbc
set security ipsec proposal SRG1_IPSEC_PROP lifetime-seconds 1800
set security ipsec proposal SRG2_IPSEC_PROP protocol esp
set security ipsec proposal SRG2_IPSEC_PROP authentication-algorithm hmac-sha-256-128
set security ipsec proposal SRG2_IPSEC_PROP encryption-algorithm aes-256-cbc
set security ipsec proposal SRG2_IPSEC_PROP lifetime-seconds 1800
set security ipsec policy SRG1_IPSEC_POL1 proposals SRG1_IPSEC_PROP
set security ipsec policy SRG2_IPSEC_POL500 proposals SRG2_IPSEC_PROP
set security ipsec vpn SRG1_IPSEC_VPN1 bind-interface st0.1
set security ipsec vpn SRG1_IPSEC_VPN1 ike gateway SRG1_IKE_GW1
set security ipsec vpn SRG1_IPSEC_VPN1 ike ipsec-policy SRG1_IPSEC_POL1
set security ipsec vpn SRG1_IPSEC_VPN1 traffic-selector ts1 local-ip 10.7.0.2/32
set security ipsec vpn SRG1_IPSEC_VPN1 traffic-selector ts1 remote-ip 10.1.0.2/32
set security ipsec vpn SRG1_IPSEC_VPN1 establish-tunnels immediately
set security ipsec vpn SRG2_IPSEC_VPN500 bind-interface st0.500
set security ipsec vpn SRG2_IPSEC_VPN500 ike gateway SRG2_IKE_GW500
set security ipsec vpn SRG2_IPSEC_VPN500 ike ipsec-policy SRG2_IPSEC_POL500
set security ipsec vpn SRG2_IPSEC_VPN500 traffic-selector ts1 local-ip 10.9.0.2/32
set security ipsec vpn SRG2_IPSEC_VPN500 traffic-selector ts1 remote-ip 10.8.0.2/32
set security ipsec vpn SRG2_IPSEC_VPN500 establish-tunnels immediately
set security policies default-policy permit-all
set security zones security-zone untrust host-inbound-traffic system-services ike
set security zones security-zone untrust host-inbound-traffic protocols all
set security zones security-zone untrust interfaces st0.1
set security zones security-zone untrust interfaces lo0.0
set security zones security-zone untrust interfaces st0.500
set security zones security-zone untrust interfaces ge-0/0/1.0
set security zones security-zone untrust interfaces ge-0/0/0.0
set security zones security-zone trust host-inbound-traffic system-services ike
set security zones security-zone trust host-inbound-traffic protocols all
set security zones security-zone trust interfaces ge-0/0/2.0
set interfaces ge-0/0/0 description trust
set interfaces ge-0/0/0 unit 0 family inet address 10.7.0.1/24
set interfaces ge-0/0/1 description untrust
set interfaces ge-0/0/1 unit 0 family inet address 10.6.0.2/24
set interfaces ge-0/0/2 description trust
set interfaces ge-0/0/2 unit 0 family inet address 10.9.0.1/24
set interfaces lo0 description untrust
set interfaces lo0 unit 0 family inet address 10.112.0.1/32
set interfaces lo0 unit 0 family inet address 10.112.0.5/32
set interfaces st0 unit 1 family inet
set interfaces st0 unit 500 family inet
set routing-options autonomous-system 100
set routing-options static route 10.4.0.0/24 next-hop 10.7.0.2
set routing-options static route 10.5.0.0/24 next-hop 10.7.0.2
set routing-options static route 10.11.0.0/24 next-hop 10.7.0.2
set routing-options static route 10.12.0.0/24 next-hop 10.7.0.2
set routing-options static route 10.111.0.1/32 next-hop 10.7.0.2
set routing-options static route 10.111.0.2/32 next-hop 10.7.0.2

set interfaces ge-0/0/0 description srx_1
set interfaces ge-0/0/0 unit 0 family inet address 10.3.0.1/24
set interfaces ge-0/0/1 description srx_2
set interfaces ge-0/0/1 unit 0 family inet address 10.2.0.1/24
set interfaces lo0 description loopback
set interfaces lo0 unit 0 family inet address 10.111.0.1/32 primary
set interfaces lo0 unit 0 family inet address 10.111.0.1/32 preferred
set routing-options autonomous-system 100
set protocols bgp group srx2_group type internal
set protocols bgp group srx2_group local-address 10.2.0.1
set protocols bgp group srx2_group local-as 100
set protocols bgp group srx2_group bfd-liveness-detection minimum-interval 500
set protocols bgp group srx2_group bfd-liveness-detection minimum-receive-interval 500
set protocols bgp group srx2_group bfd-liveness-detection multiplier 3
set protocols bgp group srx2_group neighbor 10.2.0.2
set protocols bgp group srx1_group type internal
set protocols bgp group srx1_group local-address 10.3.0.1
set protocols bgp group srx1_group local-as 100
set protocols bgp group srx1_group bfd-liveness-detection minimum-interval 500
set protocols bgp group srx1_group bfd-liveness-detection minimum-receive-interval 500
set protocols bgp group srx1_group bfd-liveness-detection multiplier 3
set protocols bgp group srx1_group neighbor 10.3.0.2

set interfaces ge-0/0/0 description srx_1
set interfaces ge-0/0/0 unit 0 family inet address 10.5.0.2/24
set interfaces ge-0/0/1 description srx_2
set interfaces ge-0/0/1 unit 0 family inet address 10.4.0.2/24
set interfaces ge-0/0/2 description srx-3
set interfaces ge-0/0/2 unit 0 family inet address 10.7.0.2/24
set interfaces lo0 description loopback
set interfaces lo0 unit 0 family inet address 10.111.0.2/32 primary
set interfaces lo0 unit 0 family inet address 10.111.0.2/32 preferred
set routing-options autonomous-system 100
set routing-options static route 10.112.0.0/24 next-hop 10.7.0.1
set protocols bgp group srx2_group type internal
set protocols bgp group srx2_group local-address 10.4.0.2
set protocols bgp group srx2_group local-as 100
set protocols bgp group srx2_group bfd-liveness-detection minimum-interval 500
set protocols bgp group srx2_group bfd-liveness-detection minimum-receive-interval 500
set protocols bgp group srx2_group bfd-liveness-detection multiplier 3
set protocols bgp group srx2_group neighbor 10.4.0.1
set protocols bgp group srx1_group type internal
set protocols bgp group srx1_group local-address 10.5.0.2
set protocols bgp group srx1_group local-as 100
set protocols bgp group srx1_group bfd-liveness-detection minimum-interval 500
set protocols bgp group srx1_group bfd-liveness-detection minimum-receive-interval 500
set protocols bgp group srx1_group bfd-liveness-detection multiplier 3
set protocols bgp group srx1_group neighbor 10.5.0.1

[edit]
user@srx-1# show groups vpn_config

when {
    peers [ SRX-01 SRX-02 ];
}
security {
    ike {
        proposal SRG1_IKE_PROP {
            authentication-method pre-shared-keys;
            dh-group group14;
            authentication-algorithm sha-256;
            encryption-algorithm aes-256-cbc;
            lifetime-seconds 3600;
        }
        proposal SRG2_IKE_PROP {
            authentication-method pre-shared-keys;
            dh-group group14;
            authentication-algorithm sha-256;
            encryption-algorithm aes-256-cbc;
            lifetime-seconds 3600;
        }
        policy SRG1_IKE_POL1 {
            proposals SRG1_IKE_PROP;
            pre-shared-key ascii-text "$ABC123"; ## SECRET-DATA
        }
        policy SRG2_IKE_POL500 {
            proposals SRG2_IKE_PROP;
            pre-shared-key ascii-text "$ABC123"; ## SECRET-DATA
        }
        gateway SRG1_IKE_GW1 {
            ike-policy SRG1_IKE_POL1;
            address 10.112.0.1;
            external-interface lo0;
            local-address 10.11.0.1;
            version v2-only;
        }
        gateway SRG2_IKE_GW500 {
            ike-policy SRG2_IKE_POL500;
            address 10.112.0.5;
            external-interface lo0;
            local-address 10.12.0.1;
            version v2-only;
        }
    }
    ipsec {
        proposal SRG1_IPSEC_PROP {
            protocol esp;
            authentication-algorithm hmac-sha-256-128;
            encryption-algorithm aes-256-cbc;
            lifetime-seconds 1800;
        }
        proposal SRG2_IPSEC_PROP {
            protocol esp;
            authentication-algorithm hmac-sha-256-128;
            encryption-algorithm aes-256-cbc;
            lifetime-seconds 1800;
        }
        policy SRG1_IPSEC_POL1 {
            proposals SRG1_IPSEC_PROP;
        }
        policy SRG2_IPSEC_POL501 {
            proposals SRG2_IPSEC_PROP;
        }
        policy SRG2_IPSEC_POL500 {
            proposals SRG2_IPSEC_PROP;
        }
        policy SRG2_IPSEC_POL502 {
            proposals SRG2_IPSEC_PROP;
        }
        policy SRG2_IPSEC_POL503 {
            proposals SRG2_IPSEC_PROP;
        }
        vpn SRG1_IPSEC_VPN1 {
            bind-interface st0.1;
            ike {
                gateway SRG1_IKE_GW1;
                ipsec-policy SRG1_IPSEC_POL1;
            }
            traffic-selector ts1 {
                local-ip 10.1.0.2/32;
                remote-ip 10.7.0.2/32;
            }
            establish-tunnels on-traffic;
        }
        vpn SRG2_IPSEC_VPN500 {
            bind-interface st0.500;
            ike {
                gateway SRG2_IKE_GW500;
                ipsec-policy SRG2_IPSEC_POL500;
            }
            traffic-selector ts500 {
                local-ip 10.8.0.2/32;
                remote-ip 10.9.0.2/32;
            }
            establish-tunnels on-traffic;
        }
    }
    zones {
        security-zone vpn {
            host-inbound-traffic {
                system-services {
                    ike;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                st0.1;
                st0.500;
            }
        }
    }
}
interfaces {
    st0 {
        unit 1 {
            family inet;
            family inet6;
        }
        unit 500 {
            family inet;
            family inet6;
        }
    }
}

[edit]
user@srx-1# show chassis high-availability
local-id 1 local-ip 10.22.0.2;
peer-id 2 {
    peer-ip 10.22.0.1;
    interface ge-0/0/2.0;
    vpn-profile ICL_IPSEC_VPN;
    liveness-detection {
        minimum-interval 200;
        multiplier 3;
    }
}
services-redundancy-group 1 {
    deployment-type routing;
    peer-id {
        2;
    }
    activeness-probe {
        dest-ip {
            10.111.0.1;
            src-ip 10.11.0.1;
        }
    }
    monitor {
        bfd-liveliness 10.5.0.2 {
            src-ip 10.5.0.1;
            session-type singlehop;
            interface ge-0/0/3.0;
        }
        interface {
            ge-0/0/3;
            ge-0/0/4;
        }
    }
    active-signal-route {
        10.39.1.1;
    }
    backup-signal-route {
        10.39.1.2;
    }
    prefix-list SRG1_PFX;
    managed-services ipsec;
    preemption;
    activeness-priority 1;
}
services-redundancy-group 2 {
    peer-id {
        2;
    }
    activeness-probe {
        dest-ip {
            10.111.0.1;
            src-ip 10.12.0.1;
        }
    }
    monitor {
        bfd-liveliness 10.5.0.2 {
            src-ip 10.5.0.1;
            session-type singlehop;
            interface ge-0/0/3.0;
        }
        interface {
            ge-0/0/3;
            ge-0/0/4;
        }
    }
    active-signal-route {
        10.49.1.1;
    }
    backup-signal-route {
        10.49.1.2;
    }
    prefix-list SRG2_PFX;
    managed-services ipsec;
    preemption;
    activeness-priority 200;
}

[edit]
user@srx-1# show security ike
proposal ICL_IKE_PROP {
    description interchassis_link_encr_tunnel;
    authentication-method pre-shared-keys;
    dh-group group14;
    authentication-algorithm sha-256;
    encryption-algorithm aes-256-cbc;
    lifetime-seconds 300;
}
policy ICL_IKE_POL {
    description interchassis_link_encr_tunnel;
    proposals ICL_IKE_PROP;
    pre-shared-key ascii-text "$ABC123"; ## SECRET-DATA
}
gateway ICL_IKE_GW {
    ike-policy ICL_IKE_POL;
    version v2-only;
}

[edit]
user@srx-1# show security ipsec
proposal ICL_IPSEC_PROP {
    description interchassis_link_encr_tunnel;
    protocol esp;
    encryption-algorithm aes-256-gcm;
    lifetime-seconds 300;
}
policy ICL_IPSEC_POL {
    description interchassis_link_encr_tunnel;
    proposals ICL_IPSEC_PROP;
}
vpn ICL_IPSEC_VPN {
    ha-link-encryption;
    ike {
        gateway ICL_IKE_GW;
        ipsec-policy ICL_IPSEC_POL;
    }
}

[edit]
user@srx-1# show policy-options

prefix-list SRG1_PFX {
    10.11.0.0/24;
}
prefix-list SRG2_PFX {
    10.12.0.0/24;
}
route-filter-list srg1_rf_list {
    10.11.0.0/24 orlonger;
    10.7.0.0/16 orlonger;
    10.1.0.0/16 orlonger;
}
route-filter-list srg2_rf_list {
    10.12.0.0/24 orlonger;
    10.9.0.0/16 orlonger;
    10.8.0.0/16 orlonger;
}
policy-statement mnha-route-policy {
    term 1 {
        from {
            route-filter-list srg1_rf_list;
            condition active_route_exists_srg1;
        }
        then {
            metric 10;
            accept;
        }
    }
    term 2 {
        from {
            route-filter-list srg1_rf_list;
            condition backup_route_exists_srg1;
        }
        then {
            metric 20;
            accept;
        }
    }
    term 3 {
        from {
            route-filter-list srg2_rf_list;
            condition active_route_exists_srg2;
        }
        then {
            metric 10;
            accept;
        }
    }
    term 4 {
        from {
            route-filter-list srg2_rf_list;
            condition backup_route_exists_srg2;
        }
        then {
            metric 20;
            accept;
        }
    }
    term default {
        then reject;
    }
}
condition active_route_exists_srg1 {
    if-route-exists {
        address-family {
            inet {
                10.39.1.1/32;
                table inet.0;
            }
        }
    }
}
condition active_route_exists_srg2 {
    if-route-exists {
        address-family {
            inet {
                10.49.1.1/32;
                table inet.0;
            }
        }
    }
}
condition backup_route_exists_srg1 {
    if-route-exists {
        address-family {
            inet {
                10.39.1.2/32;
                table inet.0;
            }
        }
    }
}
condition backup_route_exists_srg2 {
    if-route-exists {
        address-family {
            inet {
                10.49.1.2/32;
                table inet.0;
            }
        }
    }
}

[edit]
user@srx-1# show routing-options
autonomous-system 100;
static {
    route 10.7.0.0/16 next-hop 10.5.0.2;
    route 10.112.0.0/24 next-hop 10.5.0.2;
}

[edit]
user@srx-1# show security zones
security-zone vpn {
    host-inbound-traffic {
        system-services {
            ike;
        }
        protocols {
            all;
        }
    }
    interfaces {
        st0.1;
    }
}
security-zone untrust {
    host-inbound-traffic {
        system-services {
            ike;
            ping;
        }
        protocols {
            bfd;
            bgp;
        }
    }
    interfaces {
        lo0.0;
        ge-0/0/3.0;
    }
}
security-zone trust {
    host-inbound-traffic {
        system-services {
            all;
        }
        protocols {
            all;
        }
    }
    interfaces {
        ge-0/0/4.0;
    }
}
security-zone icl_zone {
    host-inbound-traffic {
        system-services {
            ike;
            ping;
            high-availability;
            ssh;
        }
        protocols {
            bfd;
            bgp;
        }
    }
    interfaces {
        ge-0/0/2.0;
    }
}

 

[edit]
user@srx-1# show interfaces
ge-0/0/1 {
    unit 0 {
        family inet;
    }
}
ge-0/0/2 {
    description inter_chassis_link;
    unit 0 {
        family inet {
            address 10.22.0.2/24;
        }
    }
}
ge-0/0/3 {
    description untrust;
    unit 0 {
        family inet {
            address 10.3.0.2/24;
        }
    }
}
ge-0/0/4 {
    description trust;
    unit 0 {
        family inet {
            address 10.5.0.1/24;
        }
    }
}
lo0 {
    apply-groups-except global;
    description untrust;
    unit 0 {
        family inet {
            address 10.11.0.1/32;
            address 10.12.0.1/32;
        }
    }
}
st0 {
    unit 1;
}

[edit]
user@srx-2# show groups vpn_config
when {
    peers [ SRX-01 SRX-02 ];
}
security {
    ike {
        proposal SRG1_IKE_PROP {
            authentication-method pre-shared-keys;
            dh-group group14;
            authentication-algorithm sha-256;
            encryption-algorithm aes-256-cbc;
            lifetime-seconds 3600;
        }
        proposal SRG2_IKE_PROP {
            authentication-method pre-shared-keys;
            dh-group group14;
            authentication-algorithm sha-256;
            encryption-algorithm aes-256-cbc;
            lifetime-seconds 3600;
        }
        policy SRG1_IKE_POL1 {
            proposals SRG1_IKE_PROP;
            pre-shared-key ascii-text "$ABC123"; ## SECRET-DATA
        }
        policy SRG2_IKE_POL500 {
            proposals SRG2_IKE_PROP;
            pre-shared-key ascii-text "$ABC123"; ## SECRET-DATA
        }
        gateway SRG1_IKE_GW1 {
            ike-policy SRG1_IKE_POL1;
            address 10.112.0.1;
            external-interface lo0;
            local-address 10.11.0.1;
            version v2-only;
        }
        gateway SRG2_IKE_GW500 {
            ike-policy SRG2_IKE_POL500;
            address 10.112.0.5;
            external-interface lo0;
            local-address 10.12.0.1;
            version v2-only;
        }
    }
    ipsec {
        proposal SRG1_IPSEC_PROP {
            protocol esp;
            authentication-algorithm hmac-sha-256-128;
            encryption-algorithm aes-256-cbc;
            lifetime-seconds 1800;
        }
        proposal SRG2_IPSEC_PROP {
            protocol esp;
            authentication-algorithm hmac-sha-256-128;
            encryption-algorithm aes-256-cbc;
            lifetime-seconds 1800;
        }
        policy SRG1_IPSEC_POL1 {
            proposals SRG1_IPSEC_PROP;
        }
        policy SRG2_IPSEC_POL501 {
            proposals SRG2_IPSEC_PROP;
        }
        policy SRG2_IPSEC_POL500 {
            proposals SRG2_IPSEC_PROP;
        }
        policy SRG2_IPSEC_POL502 {
            proposals SRG2_IPSEC_PROP;
        }
        policy SRG2_IPSEC_POL503 {
            proposals SRG2_IPSEC_PROP;
        }
        vpn SRG1_IPSEC_VPN1 {
            bind-interface st0.1;
            ike {
                gateway SRG1_IKE_GW1;
                ipsec-policy SRG1_IPSEC_POL1;
            }
            traffic-selector ts1 {
                local-ip 10.1.0.2/32;
                remote-ip 10.7.0.2/32;
            }
            establish-tunnels on-traffic;
        }
        vpn SRG2_IPSEC_VPN500 {
            bind-interface st0.500;
            ike {
                gateway SRG2_IKE_GW500;
                ipsec-policy SRG2_IPSEC_POL500;
            }
            traffic-selector ts500 {
                local-ip 10.8.0.2/32;
                remote-ip 10.9.0.2/32;
            }
            establish-tunnels on-traffic;
        }
    }
    zones {
        security-zone vpn {
            host-inbound-traffic {
                system-services {
                    ike;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                st0.1;
                st0.500;
            }
        }
    }
}
interfaces {
    st0 {
        unit 1 {
            family inet;
            family inet6;
        }
        unit 500 {
            family inet;
            family inet6;
        }
    }
}

[edit]
user@srx-2# show chassis high-availability
local-id 2 local-ip 10.22.0.1;
peer-id 1 {
    peer-ip 10.22.0.2;
    interface ge-0/0/2.0;
    vpn-profile ICL_IPSEC_VPN;
    liveness-detection {
        minimum-interval 200;
        multiplier 3;
    }
}
services-redundancy-group 1 {
    deployment-type routing;
    peer-id {
        1;
    }
    activeness-probe {
        dest-ip {
            10.111.0.1;
            src-ip 10.11.0.1;
        }
    }
    monitor {
        bfd-liveliness 10.4.0.2 {
            src-ip 10.4.0.1;
            session-type singlehop;
            interface ge-0/0/3.0;
        }
        interface {
            ge-0/0/3;
            ge-0/0/4;
        }
    }
    active-signal-route {
        10.39.1.1;
    }
    backup-signal-route {
        10.39.1.2;
    }
    prefix-list SRG1_PFX;
    managed-services ipsec;
    preemption;
    activeness-priority 200;
}
services-redundancy-group 2 {
    peer-id {
        1;
    }
    activeness-probe {
        dest-ip {
            10.111.0.1;
            src-ip 10.12.0.1;
        }
    }
    monitor {
        bfd-liveliness 10.4.0.2 {
            src-ip 10.4.0.1;
            session-type singlehop;
            interface ge-0/0/3.0;
        }
        interface {
            ge-0/0/3;
            ge-0/0/4;
        }
    }
    active-signal-route {
        10.49.1.1;
    }
    backup-signal-route {
        10.49.1.2;
    }
    prefix-list SRG2_PFX;
    managed-services ipsec;
    preemption;
    activeness-priority 1;
}

[edit]
user@srx-2# show security ike
proposal ICL_IKE_PROP {
    description interchassisa_link_encr_tunnel;
    authentication-method pre-shared-keys;
    dh-group group14;
    authentication-algorithm sha-256;
    encryption-algorithm aes-256-cbc;
    lifetime-seconds 300;
}
policy ICL_IKE_POL {
    description interchassis_link_encr_tunnel;
    proposals ICL_IKE_PROP;
    pre-shared-key ascii-text "$ABC123"; ## SECRET-DATA
}
gateway ICL_IKE_GW {
    ike-policy ICL_IKE_POL;
    version v2-only;
}

[edit]
user@srx-2# show security ipsec
proposal ICL_IPSEC_PROP {
    description interchassis_link_encr_tunnel;
    protocol esp;
    encryption-algorithm aes-256-gcm;
    lifetime-seconds 300;
}
policy ICL_IPSEC_POL {
    description interchassis_link_encr_tunnel;
    proposals ICL_IPSEC_PROP;
}
vpn ICL_IPSEC_VPN {
    ha-link-encryption;
    ike {
        gateway ICL_IKE_GW;
        ipsec-policy ICL_IPSEC_POL;
    }
}

[edit]
user@srx-2# show policy-options
prefix-list SRG1_PFX {
    10.11.0.0/24;
}
prefix-list SRG2_PFX {
    10.12.0.0/24;
}
route-filter-list srg1_rf_list {
    10.11.0.0/24 orlonger;
    10.7.0.0/24 orlonger;
    10.1.0.0/24 orlonger;
}
route-filter-list srg2_rf_list {
    10.12.0.0/24 orlonger;
    10.9.0.0/24 orlonger;
    10.8.0.0/24 orlonger;
}
policy-statement mnha-route-policy {
    term 1 {
        from {
            route-filter-list srg1_rf_list;
            condition active_route_exists_srg1;
        }
        then {
            metric 10;
            accept;
        }
    }
    term 2 {
        from {
            route-filter-list srg1_rf_list;
            condition backup_route_exists_srg1;
        }
        then {
            metric 20;
            accept;
        }
    }
    term 3 {
        from {
            route-filter-list srg2_rf_list;
            condition active_route_exists_srg2;
        }
        then {
            metric 10;
            accept;
        }
    }
    term 4 {
        from {
            route-filter-list srg2_rf_list;
            condition backup_route_exists_srg2;
        }
        then {
            metric 20;
            accept;
        }
    }
    term default {
        then reject;
    }
}
condition active_route_exists_srg1 {
    if-route-exists {
        address-family {
            inet {
                10.39.1.1/32;
                table inet.0;
            }
        }
    }
}
condition active_route_exists_srg2 {
    if-route-exists {
        address-family {
            inet {
                10.49.1.1/32;
                table inet.0;
            }
        }
    }
}
condition backup_route_exists_srg1 {
    if-route-exists {
        address-family {
            inet {
                10.39.1.2/32;
                table inet.0;
            }
        }
    }
}
condition backup_route_exists_srg2 {
    if-route-exists {
        address-family {
            inet {
                10.49.1.2/32;
                table inet.0;
            }
        }
    }
}

[edit]
user@srx-2# show routing-options
autonomous-system 100;
static {
    route 10.7.0.0/24 next-hop 10.4.0.2;
    route 10.112.0.0/24 next-hop 10.4.0.2;
}

[edit]
user@srx-2# show security zones 
    security-zone untrust {
    host-inbound-traffic {
        system-services {
            ike;
            ping;
        }
        protocols {
            bfd;
            bgp;
        }
    }
    interfaces {
        lo0.0;
        ge-0/0/3.0;
    }
}
security-zone vpn {
    host-inbound-traffic {
        system-services {
            ike;
        }
        protocols {
            all;
        }
    }
    interfaces {
        st0.1;
    }
}
security-zone trust {
    host-inbound-traffic {
        system-services {
            all;
        }
        protocols {
            all;
        }
    }
    interfaces {
        ge-0/0/4.0;
    }
}
security-zone icl_zone {
    host-inbound-traffic {
        system-services {
            ike;
            ping;
            high-availability;
            ssh;
        }
        protocols {
            bfd;
            bgp;
        }
    }
    interfaces {
        ge-0/0/2.0;
    }
}

[edit]
user@srx-2# show interfaces
ge-0/0/1 {
    unit 0 {
        family inet;
    }
}
ge-0/0/2 {
    description inter_chassis_link;
    unit 0 {
        family inet {
            address 10.22.0.1/24;
        }
    }
}
ge-0/0/3 {
    description untrust;
    unit 0 {
        family inet {
            address 10.2.0.2/24;
        }
    }
}
ge-0/0/4 {
    description trust;
    unit 0 {
        family inet {
            address 10.4.0.1/24;
        }
    }
}
lo0 {
    apply-groups-except global;
    description untrust;
    unit 0 {
        family inet {
            address 10.11.0.1/32;
            address 10.12.0.1/32;
        }
    }
}
st0 {
    unit 1 {
        family inet;
        }
}

user@host# commit
warning: High Availability Mode changed, please reboot the device to avoid undesirable behavior
commit complete

[edit]
user@srx-3# show security ike
proposal SRG1_IKE_PROP {
    authentication-method pre-shared-keys;
    dh-group group14;
    authentication-algorithm sha-256;
    encryption-algorithm aes-256-cbc;
    lifetime-seconds 3600;
}
proposal SRG2_IKE_PROP {
    authentication-method pre-shared-keys;
    dh-group group14;
    authentication-algorithm sha-256;
    encryption-algorithm aes-256-cbc;
    lifetime-seconds 3600;
}
policy SRG1_IKE_POL1 {
    proposals SRG1_IKE_PROP;
    pre-shared-key ascii-text "$ABC123"; ## SECRET-DATA
}
policy SRG2_IKE_POL500 {
    proposals SRG2_IKE_PROP;
    pre-shared-key ascii-text "$ABC123"; ## SECRET-DATA
}
gateway SRG1_IKE_GW1 {
    ike-policy SRG1_IKE_POL1;
    address 10.11.0.1;
    external-interface lo0;
    local-address 10.112.0.1;
    version v2-only;
}
gateway SRG2_IKE_GW500 {
    ike-policy SRG2_IKE_POL500;
    address 10.12.0.1;
    external-interface lo0;
    local-address 10.112.0.5;
    version v2-only;
}

[edit]
user@srx-3# show security ipsec
proposal SRG1_IPSEC_PROP {
    protocol esp;
    authentication-algorithm hmac-sha-256-128;
    encryption-algorithm aes-256-cbc;
    lifetime-seconds 1800;
}
proposal SRG2_IPSEC_PROP {
    protocol esp;
    authentication-algorithm hmac-sha-256-128;
    encryption-algorithm aes-256-cbc;
    lifetime-seconds 1800;
}
policy SRG1_IPSEC_POL1 {
    proposals SRG1_IPSEC_PROP;
}
policy SRG2_IPSEC_POL500 {
    proposals SRG2_IPSEC_PROP;
}
vpn SRG1_IPSEC_VPN1 {
    bind-interface st0.1;
    ike {
        gateway SRG1_IKE_GW1;
        ipsec-policy SRG1_IPSEC_POL1;
    }
    traffic-selector ts1 {
        local-ip 10.7.0.2/32;
        remote-ip 10.1.0.2/32;
    }
    establish-tunnels immediately;
}
vpn SRG2_IPSEC_VPN500 {
    bind-interface st0.500;
    ike {
        gateway SRG2_IKE_GW500;
        ipsec-policy SRG2_IPSEC_POL500;
    }
    traffic-selector ts1 {
        local-ip 10.9.0.2/32;
        remote-ip 10.8.0.2/32;
    }
    establish-tunnels immediately;
}

[edit]
user@srx-3# show routing-options
autonomous-system 100;
static {
    route 10.4.0.0/24 next-hop 10.7.0.2;
    route 10.5.0.0/24 next-hop 10.7.0.2;
    route 10.11.0.0/24 next-hop 10.7.0.2;
    route 10.12.0.0/24 next-hop 10.7.0.2;
    route 10.111.0.1/32 next-hop 10.7.0.2;
    route 10.111.0.2/32 next-hop 10.7.0.2;
}

[edit]
user@srx-3# show security zones 
    security-zone untrust {
    host-inbound-traffic {
        system-services {
            ike;
        }
        protocols {
            all;
        }
    }
    interfaces {
        st0.1;
        lo0.0;
        st0.500;
        ge-0/0/1.0;
        ge-0/0/0.0;
    }
}
security-zone trust {
    host-inbound-traffic {
        system-services {
            ike;
        }
        protocols {
            all;
        }
    }
    interfaces {
        ge-0/0/2.0;
    }
}

[edit]
user@srx-3# show interfaces
ge-0/0/0 {
    description trust;
    unit 0 {
        family inet {
            address 10.7.0.1/24;
        }
    }
}
ge-0/0/1 {
    description untrust;
    unit 0 {
        family inet {
            address 10.6.0.2/24;
        }
    }
}
ge-0/0/2 {
    description trust;
    unit 0 {
        family inet {
            address 10.9.0.1/24;
        }
    }
}
lo0 {
    description untrust;
    unit 0 {
        family inet {
            address 10.112.0.1/32;
            address 10.112.0.5/32;
        }
    }
}
st0 {
    unit 1 {
        family inet;
    }
    unit 500 {
        family inet;
    }
}

user@srx-02> show chassis high-availability information 
Node failure codes:
    HW  Hardware monitoring    LB  Loopback monitoring
    MB  Mbuf monitoring        SP  SPU monitoring
    CS  Cold Sync monitoring   SU  Software Upgrade

Node Status: ONLINE
Local-id: 2
Local-IP: 10.22.0.1
HA Peer Information:

    Peer Id: 1        IP address: 10.22.0.2     Interface: ge-0/0/2.0
    Routing Instance: default
    Encrypted: YES    Conn State: UP
    Cold Sync Status: COMPLETE

SRG failure event codes:
    BF  BFD monitoring
    IP  IP monitoring
    IF  Interface monitoring
    CP  Control Plane monitoring

Services Redundancy Group: 1
        Deployment Type: ROUTING
        Status: ACTIVE
        Activeness Priority: 200
        Preemption: ENABLED
        Process Packet In Backup State: NO
        Control Plane State: READY
        System Integrity Check: N/A
        Failure Events: NONE
        Peer Information:
          Peer Id: 1
          Status : BACKUP
          Health Status: HEALTHY
          Failover Readiness: NOT READY


Services Redundancy Group: 2
        Deployment Type: ROUTING
        Status: BACKUP
        Activeness Priority: 1
        Preemption: ENABLED
        Process Packet In Backup State: NO
        Control Plane State: READY
        System Integrity Check: COMPLETE
        Failure Events: NONE
        Peer Information:
          Peer Id: 1
          Status : ACTIVE
          Health Status: HEALTHY
          Failover Readiness: N/A

user@srx-02> show chassis high-availability services-redundancy-group 2
SRG failure event codes:
    BF  BFD monitoring
    IP  IP monitoring
    IF  Interface monitoring
    CP  Control Plane monitoring

Services Redundancy Group: 2
        Deployment Type: ROUTING
        Status: BACKUP
        Activeness Priority: 1
        Preemption: ENABLED
        Process Packet In Backup State: NO
        Control Plane State: READY
        System Integrity Check: COMPLETE
        Failure Events: NONE
        Peer Information:
          Peer Id: 1
          Status : ACTIVE
          Health Status: HEALTHY
          Failover Readiness: N/A

        Signal Route Info:
          Active Signal Route:
          IP: 10.49.1.1
          Routing Instance: default
          Status: NOT INSTALLED

          Backup Signal Route:
          IP: 10.49.1.2
          Routing Instance: default
          Status: INSTALLED

        Split-brain Prevention Probe Info:
          DST-IP: 10.111.0.1
          SRC-IP: 10.12.0.1
          Routing Instance: default
          Status: NOT RUNNING
          Result: N/A           Reason: N/A


        BFD Monitoring:
          Status: UNKNOWN

          SRC-IP: 10.4.0.1     DST-IP: 10.4.0.2
          Routing Instance: default
          Type: SINGLE-HOP
              IFL Name: ge-0/0/3.0
          State: INSTALLED


        Interface Monitoring:
          Status: UP

          IF Name: ge-0/0/4     State: Up

          IF Name: ge-0/0/3     State: Up


IP SRGID Table:
        SRGID    IP Prefix                                   Routing Table
        2        10.12.0.0/24                                default

user@srx-01> show chassis high-availability services-redundancy-group 2
SRG failure event codes:
    BF  BFD monitoring
    IP  IP monitoring
    IF  Interface monitoring
    CP  Control Plane monitoring

Services Redundancy Group: 2
        Deployment Type: ROUTING
        Status: ACTIVE
        Activeness Priority: 200
        Preemption: ENABLED
        Process Packet In Backup State: NO
        Control Plane State: READY
        System Integrity Check: N/A
        Failure Events: NONE
        Peer Information:
          Peer Id: 2
          Status : BACKUP
          Health Status: HEALTHY
          Failover Readiness: NOT READY

        Signal Route Info:
          Active Signal Route:
          IP: 10.49.1.1
          Routing Instance: default
          Status: INSTALLED

          Backup Signal Route:
          IP: 10.49.1.2
          Routing Instance: default
          Status: NOT INSTALLED

        Split-brain Prevention Probe Info:
          DST-IP: 10.111.0.1
          SRC-IP: 10.12.0.1
          Routing Instance: default
          Status: NOT RUNNING
          Result: N/A           Reason: N/A


        BFD Monitoring:
          Status: UNKNOWN

          SRC-IP: 10.5.0.1     DST-IP: 10.5.0.2
          Routing Instance: default
          Type: SINGLE-HOP
              IFL Name: ge-0/0/3.0
          State: INSTALLED


        Interface Monitoring:
          Status: UP

          IF Name: ge-0/0/4     State: Up

          IF Name: ge-0/0/3     State: Up


IP SRGID Table:
        SRGID    IP Prefix                                   Routing Table
        2        10.12.0.0/24                                default

user@srx-02> show bgp summary
Threading mode: BGP I/O
Default eBGP mode: advertise - accept, receive - accept
Groups: 2 Peers: 2 Down peers: 0
Table          Tot Paths  Act Paths Suppressed    History Damp State    Pending
inet.0
                       0          0          0          0          0          0
Peer                     AS      InPkt     OutPkt    OutQ   Flaps Last Up/Dwn St                                                                             ate|#Active/Received/Accepted/Damped...
10.2.0.1                100        842        846       0       0     6:18:40 Es                                                                             tabl
  inet.0: 0/0/0/0
10.4.0.2                100        842        846       0       0     6:18:42 Es                                                                             tabl
  inet.0: 0/0/0/0