This article provides a configuration example to configure an IPSec VPN between a vSRX without static IPs and VMware which does not support aggressive mode.

vSRXs do not have a static IP to use for ike negotiations, and VMware does not support aggressive mode to use it with dynamic IPs.

To overcome this limitation, a local identity can be defined on the vSRX ike gateway using:

set security ike gateway <gateway-name> local-identity inet <IP-identity>

Note the IP identity does not need to match the dynamic IP address of the vSRX.

In addition, set the public IP address of the peer as follows:

set security ike gateway <gateway-name> address X.X.X.X

The rest of the parameters (encryption and authentication), external interfaces, ike proposals, ike policies, ipsec proposals, ipsec policies, and ipsec vpn can be configured as normal.