I just worked my way through how to route two different subnets to the far side of a single IPsec tunnel on a Juniper SRX unit. This configuration but isn’t clearly documented anywhere on Juniper’s website, so I’m sharing it here.

Say you have a VPN to a remote site like so:

security ipsec:
vpn Office2 {
  bind-interface st0.1;
  ike {
    gateway Office2-gw;
    proxy-identity {
      local 192.168.1.0/24;
      remote 192.168.2.0/24;
      service any;
    }
    ipsec-policy Office2-ipsec;
  }
  establish-tunnels immediately;
}

routing-options:
static {
  route 192.168.2.0/24 next-hop st0.1;
}

We are skipping the IKE and proposals setup here, but we assume you know how to do this and it is extensively well documented if you don’t. But let’s say the site calls you up and also wants to route 172.16.0.0/16 to their site. You could do this by creating a whole ‘nother tunnel with every element duplicated except the destination block. Or you can do something like the following, which re-uses most of your configuration and only duplicates the ipsec phase2 security associations:

security ipsec:
vpn Office2 {
  bind-interface st0.1;
  ike {
    gateway Office2-gw;
    proxy-identity {
      local 192.168.1.0/24;
      remote 192.168.2.0/24;
      service any;
    }
    ipsec-policy Office2-ipsec;
  }
  establish-tunnels immediately;
}
vpn Office2-172block {
  bind-interface st0.1;
  ike {
    gateway Office2-gw;
    proxy-identity {
      local 192.168.1.0/24;
      remote 172.16.0.0/16;
      service any;
    }
    ipsec-policy Office2-ipsec;
  }
  establish-tunnels immediately;
}

interfaces st0:
unit 1 {
  multipoint;
  family inet {
    address 192.168.255.1/24;
    next-hop-tunnel 192.168.255.2 ipsec-vpn Office2;
    next-hop-tunnel 192.168.255.3 ipsec-vpn Office2-172block;
  }
}

routing-options:
static {
  route 192.168.2.0/24 next-hop 192.168.255.2;
  route 172.16.0.0/16 next-hop 192.168.255.3;
}

This configuration works by routing the traffic using the assigned next-hop IP address to the correct IPsec security association. One thing that may surprise you: You do not share the 192.168.255 ip addresses with the far side. These IP addresses are not actually used during the VPN negotiation, but are just used for internal routing so that traffic is routed across the correct security association.