What problem does it solve? Configuring Juniper SRX static route-based IPsec hub-and-spoke VPNs is error-prone: missing anti-recursion routes black-hole tunnels, management-default ECMP leaks traffic out fxp0, and absent VPN-zone policies silently drop backhauled traffic. This Skill pins the agent to a validated design covering per-spoke IKE gateways, st0 allocation, static routing, source NAT, and security policies. ## Core Features & Use Cases - Design and configuration: Produces Junos set-format config skeletons for hub and spokes, including IKEv2/IPsec proposals, per-spoke gateways, unnumbered st0 units, and static routes. - Full-tunnel backhaul: Implements centralized egress with hub source NAT (VPN-to-untrust), VPN-to-VPN hairpin policies for spoke-to-spoke traffic, and anti-recursion host routes. - Troubleshooting and verification: Provides a stage-by-stage troubleshooting matrix (underlay, IKE, IPsec, routing, NAT, recursion) plus verification commands and a checklist. - Use Case: A network engineer needs to backhaul three branch offices' internet traffic through a central SRX hub for inspection. The Skill generates the hub config with three st0 units, per-spoke static routes, the SNAT-INTERNET rule-set, and spoke configs with the critical anti-recursion route. ## Quick Start Use the srx-ipsec-hub-spoke skill to design a static route-based IPsec hub-and-spoke VPN with full-tunnel backhaul for my SRX hub and three spokes.
