security {
    log {
        mode event;
    }
    ike {
        proposal ike-prop-myipsec {
            authentication-method pre-shared-keys;
            dh-group group2;
            authentication-algorithm sha1;
            encryption-algorithm aes-256-cbc;
            lifetime-seconds 28800;
        }
        policy ike-pol-myipsec {
            mode main;
            proposals ike-prop-myipsec;
            pre-shared-key ascii-text "$9$tGyXuRcevLNVYN-aUDimPIEhcK8s2oGjkZUpOREKvoJZDi.69p1EcwYGik.TQn/CA1hSyeMXN4a.f5Q6/0O1REyxNbsgJx7kmP5/9IEcr87YgoUjqmfQn"; ## SECRET-DATA
        }
        gateway gw-myipsec {
            ike-policy ike-pol-myipsec;
            address 3.213.233.93;  ------------> Aviatrix Gateway Public IP
            dead-peer-detection threshold 3;
            no-nat-traversal;
            remote-identity inet 10.1.1.153; ---------> Aviatrix Gateway Private IP
            external-interface ge-0/0/0.0;--------> WAN interface of Juniper SRX
        }
    }
    ipsec {
        proposal ipsec-prop-myipsec {
            protocol esp;
            authentication-algorithm hmac-sha1-96;
            encryption-algorithm aes-256-cbc;
            lifetime-seconds 28800;
        }
        policy ipsec-pol-myipsec {
            perfect-forward-secrecy {
                keys group2;
            }
            proposals ipsec-prop-myipsec;
        }
        vpn myipsec {
            bind-interface st0.1;
            df-bit clear;
            ike {
                gateway gw-myipsec;
                proxy-identity {
                    local 10.0.2.0/24; -----> Local Private Network of Juniper SRX 
                    remote 10.1.2.0/24; -----> Remote Private Network 
                    service any;
                }                       
                ipsec-policy ipsec-pol-myipsec;
            }
            establish-tunnels immediately;
        }
    }
    flow {
        tcp-mss {
            ipsec-vpn {
                mss 1387;
            }
        }
    }
    policies {
        from-zone trust to-zone untrust {
            policy any-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }                       
            }
        }
    }
    zones {
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                    ping;
                    ssh;
                    ike;
                }
                protocols {
                    bgp;
                }
            }
            interfaces {
                st0.1;
            }
        }
        security-zone untrust {
            host-inbound-traffic {
                system-services {       
                    ike;
                    ping;
                    ssh;
                    https;
                }
            }
            interfaces {
                ge-0/0/0.0; 
            }
        }
    }
}
interfaces {
    ge-0/0/0 {
        unit 0 {
            family inet {
                address 10.0.3.90/24; --------> Private IP of Juniper WAN interface.
            }
        }
    }
    st0 {
        unit 1 {
            family inet;              
        }
    }
}