set vpn ipsec esp-group s2s-vpn lifetime 3600
set vpn ipsec esp-group s2s-vpn pfs enable
set vpn ipsec esp-group s2s-vpn proposal 1 encryption aes128
set vpn ipsec esp-group s2s-vpn proposal 1 hash sha1
set vpn ipsec site-to-site peer <host1> default-esp-group s2s-vpn
set vpn ipsec site-to-site peer <host1> tunnel 2 local prefix xx.xx.xx.xx/24
set vpn ipsec site-to-site peer <host1> tunnel 2 remote prefix xx.xx.xx.xx/24
show vpn ipsec sa