Hello,
this is not a new topic but I still have some doubts about the proxy-identity setting for an SRX VPN :
According to URL : http://kb.juniper.net/InfoCenter/index?page=content&id=KB29364&actp=RSS
when the proxy-identity is not set for a route-based VPN, the local and remote proxy IDs are defaulted to 0.0.0.0/0
in my case, I have several local IP addresses that should be able to reach several remote IP addresses and those IPs are not part of any subnet;
so, the different options (described on the web) to define all those combinations of source/dest IPs in the proxy-identity would be too long ;
the option based on the 'traffic-selector" parameter described in the below URL is not feasible in my case (due to an old JunOS version) :
http://kb.juniper.net/InfoCenter/index?page=content&id=KB28820&actp=search
So, I was wondering whether it would not be OK not to code proxy-identity local and remote at all so that they default to 0.0.0.0 as written in my 1st URL above ;
since there are static route defined to reach the remote IPs via the VPN st0.x interface, the flow would be encrypted into the right tunnel
Well, I still have some doubt that 0.0.0.0 proxys would be accepted by the other side : here is my rationale that tends to explain it might work :
As mentionned in the 1st URL above :
"Proxy IDs are a validated item during VPN tunnel establishment with the proxy IDs of the VPN peers needing to be an inverse match of each other"
but, by experience, I have noticed that, even, if there is not an exact inverse Proxy match of each other, VPN can work as far as the proxy IDs on 1 side is a superset of the proxy IDs defined on the other side
In my case, the other side is an IOS router that will use Policy-based VPN, so a crypto-map ACL is mandatory and the Source/Dest addresses fields of this ACL automatically become the local/remote proxy entities send by the IOS during the VPN negociation
With my Juniper side proxies being defaulted to 0.0.0.0, it might work since it is a superset of any IPs range ...
This is just an assumption for now
If you have an idea, please let me know
thanks in advance