Juniper_ipsec--Cli 基于策略的ipsec

基于策略的 SITE TO SITE IPSEC
基于策略的 IPSec 与基于路由的 ipsec 相比，无需创建 TUNNEL 接口，也不用创建到对端的路由，ipsec 是绑定到策略上的
在 CLI 管理方式中的相关配置
在 SRX210A 上的配置：
set security ike policy aike mode main
set security ike policy aike proposal-set standard
set security ike policy aike pre-shared-key ascii-text juniper
set security ike gateway gw1 ike-policy aike
set security ike gateway gw1 address 192.168.1.239
set security ike gateway gw1 external-interface ge-0/0/0.0
set security ipsec policy ap2 proposal-set standard
set security ipsec vpn vpn1 ike gateway gw1
set security ipsec vpn vpn1 ike ipsec-policy ap2
set security ipsec vpn vpn1 establish-tunnels immediately
set security policies from-zone trust to-zone untrust policy vpn-policy match source-address LanA
set security policies from-zone trust to-zone untrust policy vpn-policy match destination-address LanB
set security policies from-zone trust to-zone untrust policy vpn-policy match application any
set security policies from-zone trust to-zone untrust policy vpn-policy then permit tunnel ipsec-vpn vpn1
set security policies from-zone trust to-zone untrust policy vpn-policy then permit tunnel pair-policy vpn-policy
set security policies from-zone untrust to-zone trust policy vpn-policy match source-address LanB
set security policies from-zone untrust to-zone trust policy vpn-policy match destination-address LanA
set security policies from-zone untrust to-zone trust policy vpn-policy match application any
set security policies from-zone untrust to-zone trust policy vpn-policy then permit tunnel ipsec-vpn vpn1
set security policies from-zone untrust to-zone trust policy vpn-policy then permit tunnel pair-policy vpn-policy
set security zones security-zone trust address-book address LanA 172.16.1.0/24
set security zones security-zone untrust address-book address LanB 172.17.1.0/24