config vpn ipsec phase1-interface
 edit "HQ-BRANCH"
  set interface "port1"
  set ike-version 2
  set peertype any
  set remote-gw 198.51.100.2
  set proposal aes256-sha256
  set dhgrp 14
  set psksecret ENC CHANGE_ME
 next
end

config vpn ipsec phase2-interface
 edit "HQ-BRANCH-P2"
  set phase1name "HQ-BRANCH"
  set proposal aes256-sha256
  set src-subnet 192.168.10.0 255.255.255.0
  set dst-subnet 192.168.20.0 255.255.255.0
 next
end

config router static
 edit 0
  set dst 192.168.20.0 255.255.255.0
  set device "HQ-BRANCH"
 next
end

config firewall policy
 edit 0
  set name "HQ-to-Branch"
  set srcintf "port2"
  set dstintf "HQ-BRANCH"
  set srcaddr "all"
  set dstaddr "all"
  set action accept
  set schedule "always"
  set service "ALL"
  set nat disable
 next
end

# Terapkan kebalikan konfigurasinya di sisi cabang.
# Ganti PSK, proposal, dan subnet sesuai desain aktual Anda.
