• Preshared secrets
• Policy Based VPN
• Static IP Addresses on' one one gateway
• Dynamically assigned IP address on one gateway

This example assumes static IP address is assigned to site A, and site B gets its IP address dynamically via DHCP. Assume the preshared secret used is netscreen. The matrix below will show the proposals we will use for this example:

Site A:

1. Click VPNs > AutoKey Advanced > Gateway
2. Click New
   1. Gateway Name: Site B GW
   2. Security Level: Custom
   3. Remote Gateway: Click Dynamic IP Address, and enter peer id siteb.netscreen.com
   4. Preshared Key: netscreen
   5. Outgoing Interface: untrust (or whichever interface goes out to the Internet)
   6. Click Advanced
      1. Phase 1 Proposal: pre-g2-3des-sha
      2. Mode (Initiator): Aggressive
      3. Click Return
   7. Click OK
3. Click Autokey IKE
4. Click New
   1. VPN Name: Site B VPN
   2. Security Level: Custom
   3. Remote Gateway: Click Predefined, and select Site B GW from the pulldown menu
   4. Click Advanced
      1. Phase 2 Proposal: g2-esp-3des-sha
      2. Click Return
   5. Click OK
5. Click Policy
6. Select From Trust to Untrust Zone, and click New
   1. Source Address: Click New Address, and enter 10.1.1.0/24
   2. Destination Address: Click New Address, and enter 172.16.10.0/24
   3. Service: Any
   4. Action: Tunnel
   5. Tunnel: Site B VPN
   6. Modify matching bidirectional VPN policy: Enabled
   7. Click Ok
   8. Position at Top: Enabled

Site B:

1. Click VPNs > AutoKey Advanced > Gateway
2. Click New
   1. Gateway Name: Site A GW
   2. Security Level: Custom
   3. Remote Gateway: Click Static, and enter IP address 1.1.1.1
   4. Preshared Key: netscreen
   5. Local ID: siteb.netscreen.com
   6. Outgoing Interface: untrust (or whichever interface goes out to the Internet)
   7. Click Advanced
      1. Phase 1 Proposal: pre-g2-3des-sha
      2. Mode (Initiator): Aggressive
      3. Click Return
   8. Click OK
3. Click Autokey IKE
4. Click New
   1. VPN Name: Site A VPN
   2. Security Level: Custom
   3. Remote Gateway: Click Predefined, and select Site A GW from the pulldown menu
   4. Click Advanced
      1. Phase 2 Proposal: g2-esp-3des-sha
      2. Click Return
   5. Click OK
5. Click Policy
6. Select From Trust to Untrust Zone, and click New
   1. Source Address: Click New Address, and enter 172.16.10.0/24
   2. Destination Address: Click New Address, and enter 10.1.1.0/24
   3. Service: Any
   4. Action: Tunnel
   5. Tunnel: Site A VPN
   6. Modify matching bidirectional VPN policy: Enabled
   7. Click Ok
   8. Position at Top: Enabled

NOTE:
The VPN tunnel must be initiated from a host behind the gateway with the dynamically assigned IP address. This requires sending any traffic from a host behind the Juniper firewall that has its IP address assigned dynamically. Otherwise, the VPN tunnel will not be built.