skills.rest
fastrevmd-lab
fastrevmd-labCOMMUNITY
Explore all skills by this author →
GitHub

srx-autovpn-full-tunnel

Designs and troubleshoots Juniper SRX AutoVPN full-tunnel hub backhaul configurations.

9|Updated Mar 7, 2026
Search Tags:#junos#ipsec#vpn troubleshooting#juniper srx#autovpn#full-tunnel#traffic selectors
One-click install
npx skills add https://github.com/fastrevmd-lab/fwskillsshare --skill srx-autovpn-full-tunnel-fastrevmd-lab
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: srx-autovpn-full-tunnel
Source: https://github.com/fastrevmd-lab/fwskillsshare/tree/main/skills/srx-autovpn-full-tunnel
Command: npx skills add https://github.com/fastrevmd-lab/fwskillsshare --skill srx-autovpn-full-tunnel-fastrevmd-lab

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Configuring Juniper SRX AutoVPN with full-tunnel backhaul is error-prone: traffic-selector wildcards fail to commit on Junos 24.4R1+, missing anti-recursion routes black-hole tunnels, and management-default ECMP silently leaks traffic out fxp0. This Skill pins the agent to field-verified Junos syntax and design rules so hub-and-spoke backhaul designs actually commit and pass traffic. ## Core Features & Use Cases - Full-tunnel design and config generation: Produces set-format hub and spoke configuration covering group-ike-id dynamic gateways, traffic selectors, ARI, source NAT, and security policies. - Version-aware troubleshooting: Diagnoses known commit blockers (ike-user-type + PSK on 24.4R1+, literal 0.0.0.0/0 selectors with static gateway addresses) and NAT-T failures such as double-NAT and missing host-inbound IKE. - Routing and NAT guardrails: Handles anti-recursion host routes, management-default ECMP traps, and VPN-to-untrust source NAT scoping for centralized egress. - Use Case: A network engineer needs to backhaul all internet traffic from 12 branch SRX spokes through a central hub for inspection. The Skill produces the hub dynamic gateway, split 0.0.0.0/1 + 128.0.0.0/1 spoke selectors, anti-recursion routes, and a verification checklist. ## Quick Start Use the srx-autovpn-full-tunnel skill to design a full-tunnel AutoVPN backhaul for my SRX hub and three spokes on Junos 24.4R1.

Frequently Asked Questions about srx-autovpn-full-tunnel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure SRX AutoVPN full-tunnel backhaul?▼

Set the hub traffic selector to local-ip 0.0.0.0/0 with remote-ip covering the spoke summary, point each spoke's default route into st0.0, and add a hub source-NAT rule-set scoped VPN to untrust. Keep an anti-recursion host route to the hub WAN IP via the underlay on every spoke.

Why does remote-ip 0.0.0.0/0 fail to commit on Junos 24.4R1?▼

On Junos 24.4R1 and 25.4R1, a literal 0.0.0.0/0 traffic-selector remote-ip is rejected when the IKE gateway has a static address. Split the default into two selectors using 0.0.0.0/1 and 128.0.0.0/1, which commit cleanly and bring up two child SAs per spoke.

Can I use group-ike-id with pre-shared keys on current Junos?▼

No. On vSRX3 24.4R1.9 and 25.4R1.12, combining dynamic ike-user-type with IKEv2 pre-shared-keys fails commit. Use per-spoke IKEv2 gateways pinned by remote-identity for PSK, or switch to certificate-based PKI authentication to keep zero-touch group-ike-id.

When should I use AutoVPN instead of static hub-and-spoke IPsec?▼

Use AutoVPN when spoke count grows or churns, since one dynamic gateway and a single shared st0.0 accept all spokes with zero hub changes. Use static per-spoke gateways for a small, stable estate where every tunnel should be explicit in configuration.

Why does my spoke tunnel come up but no internet traffic passes?▼

The most common cause is the vSRX management default route via fxp0 forming ECMP with your new default, leaking traffic out the management interface. Put fxp0 in a dedicated routing-instance, and confirm the source-NAT rule-set is scoped VPN to untrust with hit counts incrementing.

What causes IKE_AUTH retransmits with NAT-T on SRX spokes?▼

Two field-verified causes are double NAT on the underlay dropping fragmented UDP-4500 returns, and the spoke's untrust zone missing host-inbound-traffic system-services ike. Collapse to a single NAT hop and permit IKE host-inbound on the spoke WAN zone.

Related Skills

Explore More Software Engineering Skills→
daemon-blockint-techdaemon-blockint-tech
7

sd-wan-engineer

Plan and implement SD-WAN overlay topologies with policy models and SASE integration.

Community
Advanced
mfcollins3mfcollins3

azure-nat-gateway

Plan, deploy, and configure Azure NAT Gateway for outbound connectivity.

Community
Advanced
dgethingsdgethings

paloalto-panorama

Audit Palo Alto Panorama device groups, templates, and policies for compliance.

Community
Intermediate
cyoteecyotee

Aave V4 Architecture

Explain Aave V4's hub-and-spoke model and dynamic risk configuration.

Community
Advanced