IPSec is what you must use, and it does not require IPv6 in any way.
Juniper SSGs have very flexible logic when it comes to tunnels. This is good, because you can solve for many use cases, but also bad, because the configuration process is more complicated.
Juniper IPSEC tunnels come in two flavors: route-based and policy-based. Common between the two are the attributes used to establish the tunnel: peer IP address, encryption algorithms, security associations, etc - you need these with any type of tunnel. What's different is the process that allows the firewall to decide if the specific packet flow must be encrypted and placed into the tunnel. With route-based tunnels, you have routes that forward the flow into the tunnel; with policy-based tunnels, you create policies that select the flows for encryption.
Slightly overgeneralizing, I can say that policy-based tunnels are considered obsolete. Therefore, the further discussion will be focused on route-based firewalls. And everything described here must be done on both sides, using different names and IP addresses.
The first building block is the gateway. That's the firewall on the other side. Here we will call that gateway "Paris", specify its public IP address, negotiation mode, our external interface used to connect to it, preshared key, and predefined "standard" proposals:
fw-> set ike gateway "Paris" address 220.127.116.11 main outgoing-interface "ethernet0/0" preshare "verysecretkey" sec-level standard
Next, we configure the Phase-2 proposal, where we create the actual tunnel, specifying the gateway to use for the tunnel, our local IP block, and the remote IP block.
fw-> set vpn vpn_to_paris gateway Paris no-replay tunnel idletime 0 sec-level standard
fw-> set vpn vpn_to_paris proxy-id local-ip 192.168.0.0/24 remote-ip 192.168.1.0/24 "ANY"
This completes the IPSec-related part of the tunnel. Now we just need to make sure that we use it for the relevant traffic. Create a tunnel interface. It is a virtual interface that can be configured almost like a real one, but in most situations it is sufficient to create an unnumbered interface dependent on the real outside interface and assign it to a security zone used for your future policies that will control access between the two sites. It will usually look like this:
fw-> set interface tunnel.1 zone vpn
fw-> set interface tunnel.1 ip unnumbered interface eth0/0
Bind the tunnel to the interface and create a route that would send the traffic there:
fw-> set vpn vpn_to_paris bind interface tunnel.1
fw-> set route 192.168.1.0/24 interface tunnel.1
Now, all that's left to do is configure policies, if necessary. To control outbound traffic, create policies between "Trust" and "VPN" zones, to control traffic from the other site, create policies between "VPN" and "Trust" zones.
Recommended reading: ScreenOS Cookbook from O'Reilly.