Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


group (Security Group VPN)


Hierarchy Level


Configure group VPN on the group server. Group VPNv2 is supported on SRX300, SRX320, SRX340, SRX345, SRX550HM, SRX1500, SRX4100, SRX4200, and SRX4600 devices and vSRX Virtual Firewall instances.


name—Name of the group.

  • anti-replay-time-window milliseconds—Configure antireplay time in milliseconds. Specify a value from 1 to 60,000.

    We recommend that NTP be configured on Group VPNv2 devices to ensure proper antireplay operation.

    Group members that are running on vSRX Virtual Firewall instances on a host machine where the hypervisor is running under a heavy load may experience issues that can be corrected by reconfiguring the anti-replay-time-window value. If data that matches the IPsec policy on the group member is not being transferred, check the show security group-vpn member ipsec statistics output for D3P errors. Make sure that NTP is operating correctly. If there are errors, adjust the anti-replay-time-window value.

  • description description—Description of the group.

  • group-id number—Identifier for this group VPN. Specify a value from 1 to 4,294,967,295.

  • ike-gateway gateway-name—Define the group member for Phase 1 negotiation. There can be multiple instances of this option configured. When a group member sends its registration request to the server, the server checks to see that the member is configured for the group.

  • ipsec-sa name—Configure the group SAs to be downloaded to members. There can be multiple group SAs downloaded to group members.

  • member-threshold number—Specify the maximum number of group VPN members that can be accepted in the group. The same member-threshold value must be configured on the root-server and all sub-servers in a group server cluster.

    The maximum number you can configure for a group is dependent upon the group server platform. Also, the sum of the member-threshold numbers for all groups configured on the group server must not exceed the capacity of the group server platform.

  • server-cluster—Configure the Group Domain of Interpretation (GDOI) group controller/key server (GCKS) cluster for the specified group. All servers in a group VPN server cluster must be SRX Series Firewalls.

  • server-member-communication—Enable and configure server to member communication. When these options are configured, group members receive new keys before current keys expire.

Required Privilege Level

security—To view this statement in the configuration.

security-control—To add this statement to the configuration.

Release Information

Statement introduced in Junos OS Release 10.2

member-threshold option introduced in Junos OS Release 15.1X49-D30 for vSRX Virtual Firewall.