Just finished configuring IKEv2 with certificate auth on our SRX345. It's a clean setup, especially for remote team members—no shared PSKs to manage!
Here's my quick walkthrough:
**What You'll Need:**
* A running internal PKI (we used a Windows Server CA) or a public CA.
* Client certificates for each user/machine.
* SRX set as the VPN concentrator.
**Key Steps:**
1. Import your CA certificate and server certificate onto the SRX.
2. Define the IKE proposal and policy, specifying certificate authentication.
3. Configure the IKE gateway, pointing to your certificates.
4. Set up the IPsec policy and VPN client access.
5. Export the CA cert and a client cert (with private key) for each device.
The trickiest part was getting the certificate identity settings right in the IKE policy. Make sure your `local-certificate` and `peer-certificate-ca` statements are solid.
Big win: clients auto-connect when off-site. Team loves it. Anyone else running this setup? Curious if you've tweaked any rekey or dead peer detection settings for mobile users.
— Jason
Let's build better workflows.