Most enterprises today are not pure on-prem. The hub-and-spoke VPN topology is the simplest way to bring all of this together.

1. Why Hub-and-Spoke

For ten to fifty sites, full-mesh means a quadratic explosion of tunnels. Hub-and-spoke is n tunnels at the hub and one per spoke. The cost is every spoke-to-spoke flow traverses the hub.

The hub SRX must be sized accordingly — encrypt-bound. Pick SRX5400 / SRX5600 for large hub deployments, or a pair of SRX4600s in chassis-cluster for redundancy.

2. Topology and Naming

  • Hub SRX5400 in DC1 — public IP 203.0.113.10, internal 192.168.0.0/16.
  • Azure vWAN — public IP 20.62.x.x, VNet 10.10.0.0/16.
  • AWS TGW — public IP 3.10.x.x, VPCs 10.20.0.0/16.
  • Branch SRX340 — public IP 198.51.100.42, LAN 10.40.0.0/24.

3. IKE Proposal and Policy — IKEv2 Strictly

set security ike proposal IKE-PROPOSAL dh-group group19
set security ike proposal IKE-PROPOSAL authentication-algorithm sha-384
set security ike proposal IKE-PROPOSAL encryption-algorithm aes-256-gcm
set security ike proposal IKE-PROPOSAL lifetime-seconds 86400

set security ike policy IKE-POLICY mode main
set security ike policy IKE-POLICY proposals IKE-PROPOSAL
set security ike policy IKE-POLICY pre-shared-key ascii-text "$9$ABCDEFGHIJKLMN"
set security ike gateway GW-AZURE  address 20.62.1.4     ike-policy IKE-POLICY external-interface ge-0/0/0 version v2-only
set security ike gateway GW-AWS    address 3.10.0.10    ike-policy IKE-POLICY external-interface ge-0/0/0 version v2-only
set security ike gateway GW-BRANCH address 198.51.100.42 ike-policy IKE-POLICY external-interface ge-0/0/0 version v2-only

4. ESP Proposal

set security ipsec proposal ESP-PROPOSAL protocol esp
set security ipsec proposal ESP-PROPOSAL encryption-algorithm aes-128-gcm
set security ipsec proposal ESP-PROPOSAL lifetime-seconds 3600
set security ipsec policy ESP-POLICY proposals ESP-PROPOSAL
set security ipsec policy ESP-POLICY pfs-group-group19

set security ipsec vpn VPN-AZURE  ike-gateway GW-AZURE  ipsec-policy ESP-POLICY bind-interface st0.10
set security ipsec vpn VPN-AWS    ike-gateway GW-AWS    ipsec-policy ESP-POLICY bind-interface st0.20
set security ipsec vpn VPN-BRANCH ike-gateway GW-BRANCH ipsec-policy ESP-POLICY bind-interface st0.30
Bind each cloud to its own st0.X interface — this lets you isolate routing-instances.

5. Routing Instances Per Cloud

set routing-instances AZURE-VPN instance-type vrf
set routing-instances AZURE-VPN interface st0.10
set routing-instances AZURE-VPN route-distinguisher 192.168.0.1:10
set routing-instances AZURE-VPN vrf-target target:64512:10
set routing-instances AZURE-VPN protocols bgp group AZURE type external peer-as 65515 neighbor 10.10.0.4

set routing-instances AWS-VPN instance-type vrf
set routing-instances AWS-VPN interface st0.20 route-distinguisher 192.168.0.1:20
set routing-instances AWS-VPN vrf-target target:64512:20
set routing-instances AWS-VPN protocols bgp group AWS type external peer-as 64512 neighbor 10.20.0.4

set routing-instances BRANCH-VPN instance-type vrf interface st0.30
set routing-instances BRANCH-VPN route-distinguisher 192.168.0.1:30
set routing-instances BRANCH-VPN vrf-target target:64512:30
set routing-instances BRANCH-VPN protocols bgp group BRANCH type external peer-as 64700 neighbor 10.40.0.1

6. NAT-Traversal Selectively

set security ike gateway GW-AZURE  nat-traversal disable
set security ike gateway GW-AWS    nat-traversal disable
set security ike gateway GW-BRANCH nat-traversal enable

7. Security Zones

set security zones security-zone UNTRUST interfaces ge-0/0/0.0 host-inbound-traffic system-services ike
set security zones security-zone VPN-AZURE interfaces st0.10
set security zones security-zone VPN-AWS   interfaces st0.20
set security zones security-zone VPN-BRANCH interfaces st0.30
set security policies from-zone TRUST to-zone VPN-AZURE policy ANY match source-address any destination-address any application any then permit
set security policies from-zone VPN-AZURE to-zone TRUST policy ANY match source-address any destination-address any application any then permit

8. Verification

show security ike security-associations
show security ipsec security-associations
show bgp summary
show route table AZURE-VPN
show route table AWS-VPN

9. Common Failures

9.1 IPSec up but no BGP — st0.X is missing MTU. Set set interfaces st0 unit X family inet mtu 1400.
9.2 Phase 1 OK, Phase 2 fails — ESP proposal mismatch.
9.3 Re-keys every 30 minutes — lifetime mismatch.
9.4 Spoke-to-spoke black-holed — RTs wrong.

10. Closing

Hub-and-spoke is forgiving of partial failures. For the SRX-zone basics every hub uses, see SRX zone firewall. For BGP behavior when an Azure tunnel flaps, see BGP flap field method.