# basic configuration
config setup
    charondebug="dmn 2, mgr 2, ike 2, chd 2, job 2, cfg 2, knl 2, net 2, enc 2, lib 2"
    uniqueids=yes
    strictcrlpolicy=no

# connection to srx1
conn to-srx1
  keyexchange=ikev1
  authby=psk
  left=%defaultroute
  leftsubnet=0.0.0.0/0
  right=*.*.*.*
  rightsubnet=10.30.0.0/16
  auto=start
  keyingtries=0
  ikelifetime=8h
  lifetime=1h
  esp=aes256-sha256-ecp256
  ike=aes256-sha256-ecp256
  type=tunnel
  #dpddelay=30   
  #dpdtimeout=120
  #dpdaction=restart

#ipsec.secrets
%any : PSK "***********"

security {
    ike {
        proposal staging-vpn {
            authentication-method pre-shared-keys;
            dh-group group19;
            authentication-algorithm sha-256;
            encryption-algorithm aes-256-cbc;
            lifetime-seconds 28800;
        }
        policy staging-vpn {
            mode aggressive;
            proposals staging-vpn;
            pre-shared-key ascii-text "**********"; ## SECRET-DATA
        }
        gateway staging-vpn {
            ike-policy staging-vpn;
            dynamic {
                user-at-hostname "***@*****.*****";
                ike-user-type shared-ike-id;
            }
            dead-peer-detection {
                optimized;
                interval 10;
                threshold 5;
            }
            external-interface reth0.15;
            local-address *.*.*.*;
            aaa {
                access-profile default;
            }
            version v1-only;
            tcp-encap-profile default;
        }                               
    }                                   
    ipsec {                             
        proposal staging-vpn {          
            protocol esp;               
            encryption-algorithm aes-256-gcm;
            lifetime-seconds 3600;      
        }                               
        policy staging-vpn {            
            perfect-forward-secrecy {   
                keys group19;           
            }                           
            proposals staging-vpn;      
        }                               
        vpn staging-vpn {               
            bind-interface st0.0;       
            df-bit clear;               
            copy-outer-dscp;            
            ike {                       
                gateway staging-vpn;    
                ipsec-policy staging-vpn;
            }                           
            traffic-selector ts-1 {     
                local-ip 10.30.0.0/16;  
                remote-ip 0.0.0.0/0;    
            }                           
            traffic-selector ts-2 {     
                local-ip 10.20.0.0/24;  
                remote-ip 0.0.0.0/0;    
            }