DescribeVpnConnection - API Reference| Alibaba Cloud Documentation Center

Debugging

OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer. OpenAPI Explorer dynamically generates the sample code of the operation for different SDKs.

Request parameters


Parameter	Type	Required	Example	Description
Action	String	Yes	DescribeVpnConnection	The operation that you want to perform. Set the value to DescribeVpnConnection.
RegionId	String	Yes	cn-hangzhou	The ID of the region where the IPsec-VPN connection is established. You can call the DescribeRegions operation to query the most recent region list.
VpnConnectionId	String	Yes	vco-bp1bbi27hojx80nck****	The ID of the IPsec-VPN connection.

Response parameters


Parameter	Type	Example	Description
VpnConnectionId	String	vco-bp1bbi27hojx80nck****	The ID of the IPsec-VPN connection.
CustomerGatewayId	String	cgw-bp1mvj4g9kogwwcxk****	The ID of the customer gateway.
VpnGatewayId	String	vpn-bp1q8bgx4xnkm2ogj****	The ID of the VPN gateway.
Name	String	ipsec1	The name of the IPsec-VPN connection.
LocalSubnet	String	10.0.0.0/8	The CIDR block of the VPC. CIDR blocks are separated with commas (,).
RemoteSubnet	String	192.168.0.0/16	The CIDR block of the data center. CIDR blocks are separated with commas (,).
CreateTime	Long	1492753817000	The timestamp generated when the IPsec-VPN connection was established.
Status	String	ike_sa_not_established	The status of the IPsec-VPN connection. Valid values: ike_sa_not_established: Phase 1 negotiations failed. ike_sa_established: Phase 1 negotiations were successful. ipsec_sa_not_established: Phase 2 negotiations failed. ipsec_sa_established: Phase 2 negotiations were successful.
EffectImmediately	Boolean	true	Indicates whether the IPsec-VPN connection immediately takes effect. Valid values: true: Negotiations are reinitiated when the configuration is changed. false: Negotiations are reinitiated when traffic is detected. When negotiations are reinitiated, transient connections may occur.
EnableDpd	Boolean	true	Indicates whether dead peer detection (DPD) is enabled. Valid values: false: disabled true: enabled After you enable DPD, the initiator of the IPsec-VPN connection sends DPD packets to check the existence and availability of the peer. If no response is received from the peer within a specified period of time, the connection fails. Then, the ISAKMP SA, IPsec SA, and IPsec tunnel are deleted.
EnableNatTraversal	Boolean	true	Indicates whether NAT traversal is enabled. Valid values: true: NAT traversal is enabled. false: NAT traversal is disabled. After NAT traversal is enabled, the initiator does not check the UDP ports during IKE negotiations and can automatically discover NAT gateway devices along the VPN tunnel.
IkeConfig	Struct		The configurations of Phase 1 negotiations.
IkeAuthAlg	String	sha1	The IKE authentication algorithm.
IkeEncAlg	String	aes	The IKE encryption algorithm.
IkeLifetime	Long	86400	The IKE lifetime. Unit: seconds.
IkeMode	String	main	The IKE negotiation mode.
IkePfs	String	group2	The DH group.
IkeVersion	String	ikev1	The version of the IKE protocol.
LocalId	String	116.XX.XX.6	The identifier of the local side. The default value is the IP address of the VPN gateway. The value can be a fully qualified domain name (FQDN) or an IP address.
Psk	String	pgw6dy****	The pre-shared key.
RemoteId	String	139.XX.XX.6	The ID of the customer gateway. By default, it is the IP address of the customer gateway. The value can be an FQDN or an IP address.
IpsecConfig	Struct		The configuration of Phase 2 negotiations.
IpsecAuthAlg	String	sha1	The IPsec authentication algorithm.
IpsecEncAlg	String	aes	The IPsec encryption algorithm.
IpsecLifetime	Long	86400	The IPsec lifetime. Unit: seconds.
IpsecPfs	String	group2	The DH group.
RemoteCaCertificate	String	-----BEGIN CERTIFICATE----- MIIB7zCCAZW****	The CA certificate of the peer.
RequestId	String	F2310D45-BCF6-4E2E-9082-B4503844BA4C	The ID of the request.
VcoHealthCheck	Struct		The information about health checks.
Dip	String	10.0.0.1	The destination IP address.
Enable	String	true	Indicates whether health checks are enabled. Valid values: false: disabled true: enabled
Interval	Integer	3	The interval of health check retries. Unit: seconds.
Retry	Integer	3	The number of times that health check packets are resent.
Sip	String	192.168.1.1	The source IP address.
Status	String	failed	The status of the health check. Valid values: failed: abnormal success: normal
VpnBgpConfig	Struct		The configurations of the BGP routing protocol.
AuthKey	String	AuthKey****	The authentication key of the BGP routing protocol.
EnableBgp	String	true	The negotiation status of the BGP routing protocol. Valid values: true: enabled false: disabled
LocalAsn	Long	45014	The autonomous system number (ASN) on the Alibaba Cloud side.
LocalBgpIp	String	169.XX.XX.32	The BGP IP address on the Alibaba Cloud side.
PeerAsn	Long	65530	The ASN of the peer.
PeerBgpIp	String	169.XX.XX.30	The BGP IP address of the peer.
Status	String	true	The negotiation status of the BGP routing protocol. success: normal false: abnormal
TunnelCidr	String	169.254.11.0/30	The CIDR block of the IPsec tunnel. The CIDR block belongs to 169.254.0.0/16. The mask of the CIDR block is 30 bits in length.

Examples

Sample requests

https://vpc.aliyuncs.com/?Action=DescribeVpnConnection
&RegionId=cn-hangzhou
&VpnConnectionId=vco-bp1bbi27hojx80nck****
&<Common request parameters>

Sample success responses

XML format

<DescribeVpnConnectionResponse>
  <LocalSubnet>10.0.0.0/8</LocalSubnet>
  <Status>ipsec_sa_established</Status>
  <RequestId>6FBAE985-A938-49CB-9129-621AA3A88728</RequestId>
  <CustomerGatewayId>cgw-gw8usu4zsk23pf69f****</CustomerGatewayId>
  <CreateTime>1590495160000</CreateTime>
  <Name>VPN1-CGW22</Name>
  <EffectImmediately>false</EffectImmediately>
  <RemoteSubnet>192.168.0.0/16</RemoteSubnet>
  <VcoHealthCheck>
        <Status>success</Status>
        <Enable>false</Enable>
        <Dip></Dip>
        <Sip></Sip>
        <Retry>0</Retry>
        <Interval>0</Interval>
  </VcoHealthCheck>
  <VpnGatewayId>vpn-gw8bvv722zwjht7ia****</VpnGatewayId>
  <IpsecConfig>
        <IpsecPfs>group2</IpsecPfs>
        <IpsecEncAlg>aes</IpsecEncAlg>
        <IpsecAuthAlg>sha1</IpsecAuthAlg>
        <IpsecLifetime>86400</IpsecLifetime>
  </IpsecConfig>
  <VpnConnectionId>vco-gw8tylx7hvwhl7tu8****</VpnConnectionId>
  <EnableNatTraversal>true</EnableNatTraversal>
  <EnableDpd>true</EnableDpd>
  <IkeConfig>
        <IkeAuthAlg>sha1</IkeAuthAlg>
        <LocalId>8.XX.XX.192</LocalId>
        <IkeEncAlg>aes</IkeEncAlg>
        <IkeVersion>ikev1</IkeVersion>
        <IkeMode>main</IkeMode>
        <IkeLifetime>86400</IkeLifetime>
        <Psk>123456</Psk>
        <RemoteId>8.XX.XX.146</RemoteId>
        <IkePfs>group2</IkePfs>
  </IkeConfig>
  <VpnBgpConfig>
        <Status>success</Status>
        <EnableBgp>true</EnableBgp>
        <LocalAsn>45104</LocalAsn>
        <TunnelCidr>169.254.10.0/30</TunnelCidr>
        <PeerBgpIp>169.XX.XX.30</PeerBgpIp>
        <PeerAsn>65530</PeerAsn>
        <LocalBgpIp>169.XX.XX.32</LocalBgpIp>
  </VpnBgpConfig>
</DescribeVpnConnectionResponse>

JSON format

{
    "LocalSubnet": "10.0.0.0/8",
    "Status": "ipsec_sa_established",
    "RequestId": "6FBAE985-A938-49CB-9129-621AA3A88728",
    "CustomerGatewayId": "cgw-gw8usu4zsk23pf69f****",
    "CreateTime": 1590495160000,
    "Name": "VPN1-CGW22",
    "EffectImmediately": false,
    "RemoteSubnet": "192.168.0.0/16",
    "VcoHealthCheck": {
        "Status": "success",
        "Enable": "false",
        "Dip": "",
        "Sip": "",
        "Retry": 0,
        "Interval": 0
    },
    "VpnGatewayId": "vpn-gw8bvv722zwjht7ia****",
    "IpsecConfig": {
        "IpsecPfs": "group2",
        "IpsecEncAlg": "aes",
        "IpsecAuthAlg": "sha1",
        "IpsecLifetime": 86400
    },
    "VpnConnectionId": "vco-gw8tylx7hvwhl7tu8****",
    "EnableNatTraversal": true,
    "EnableDpd": true,
    "IkeConfig": {
        "IkeAuthAlg": "sha1",
        "LocalId": "8.XX.XX.192",
        "IkeEncAlg": "aes",
        "IkeVersion": "ikev1",
        "IkeMode": "main",
        "IkeLifetime": 86400,
        "Psk": "123456",
        "RemoteId": "8.XX.XX.146",
        "IkePfs": "group2"
    },
    "VpnBgpConfig": {
        "Status": "success",
        "EnableBgp": "true",
        "LocalAsn": 45104,
        "TunnelCidr": "169.254.10.0/30",
        "PeerBgpIp": "169.XX.XX.30",
        "PeerAsn": 65530,
        "LocalBgpIp": "169.XX.XX.32"
    }
}

Error codes


HttpCode	Error code	Error message	Description
403	Forbbiden.SubUser	User not authorized to operate on the specified resource as your account is created by another user.	The error message returned because you are unauthorized to perform this operation on the specified resource. You can apply for the required permissions and try again.
403	Forbidden	User not authorized to operate on the specified resource.	The error message returned because you are unauthorized to perform this operation on the specified resource. To acquire the required permissions, submit a ticket.
404	InvalidVpnConnectionInstanceId.NotFound	The specified vpn connection instance id does not exist.	The error message returned because the specified IPsec-VPN connection does not exist. Check whether the ID of the IPsec-VPN connection is valid.

For a list of error codes, visit the API Error Center.