Use DescribeVpnConnections to query IPsec-VPN connections - VPN Gateway - Alibaba Cloud - VPN Gateway

Queries information about IPsec-VPN connections.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

vpc:DescribeVpnConnections

list

VpnConnection

acs:vpc:{#regionId}:{#accountId}:vpnconnection/*

VpnConnection

acs:vpc:{#regionId}:{#accountId}:vpnconnection/{#VpnConnectionId}

None

Request parameters

Parameter	Type	Required	Description	Example
RegionId	string	Yes	The region ID of the IPsec-VPN connection.	cn-hangzhou
VpnGatewayId	string	No	The instance ID of the VPN gateway.	vpn-bp1q8bgx4xnkx****
CustomerGatewayId	string	No	The ID of the customer gateway.	cgw-bp1mvj4g9kogw****
PageNumber	integer	No	The page number of the list. Default value: 1.	1
PageSize	integer	No	The number of entries per page in a paging query. Default value: 10. Valid values: 1 to 50.	10
VpnConnectionId	string	No	The ID of the IPsec-VPN connection.	vco-bp10lz7aejumd****
Tag	array<object>	No	The list of tags bound to the IPsec-VPN connection.
	object	No	The tag information.
Key	string	No	The tag key. This value cannot be an empty string. The tag key can be up to 64 characters in length. It cannot start with `aliyun` or `acs:`, and cannot contain `http://` or `https://`. You can specify up to 20 tag keys at a time.	TagKey
Value	string	No	The tag value.	TagValue
ResourceGroupId	string	No	The ID of the resource group to which the IPsec-VPN connection belongs.	rg-acfmzs372yg****

Response elements

Element	Type	Description	Example
	object	The response parameters.
PageSize	integer	The number of entries per page in a paging query.	10
RequestId	string	The request ID.	238752DC-0693-49BE-9C85-711D5691D3E5
PageNumber	integer	The page number.	1
TotalCount	integer	The total number of entries returned.	2
VpnConnections	object
VpnConnection	array<object>	The list of IPsec-VPN connection configurations.
	array<object>	The configuration of an IPsec-VPN connection.
Status	string	The status of the IPsec-VPN connection. ike_sa_not_established: Phase 1 negotiation failed. ike_sa_established: Phase 1 negotiation succeeded. ipsec_sa_not_established: Phase 2 negotiation failed. ipsec_sa_established: Phase 2 negotiation succeeded.	ipsec_sa_established
EnableNatTraversal	boolean	Indicates whether NAT traversal is enabled for the IPsec-VPN connection. true: NAT traversal is enabled. After NAT traversal is enabled, the IKE negotiation process removes the verification of the UDP port number and can discover NAT gateway devices along the VPN tunnel. false: NAT traversal is disabled.	true
RemoteCaCertificate	string	The CA certificate of the peer.	-----BEGIN CERTIFICATE----- MIIB7zCCAZW**** -----END CERTIFICATE-----
CreateTime	integer	The timestamp when the IPsec-VPN connection was created. Unit: milliseconds. The timestamp is in the UNIX format and represents the number of milliseconds that have elapsed since January 1, 1970, 00:00:00 UTC.	1492753817000
EffectImmediately	boolean	Indicates whether the IPsec-VPN connection configuration takes effect immediately. true: A reconnection is triggered after the configuration is changed. false: A reconnection is triggered when traffic is detected.	true
VpnGatewayId	string	The instance ID of the VPN gateway.	vpn-bp1q8bgx4xnkm****
LocalSubnet	string	The CIDR block on the Alibaba Cloud side of the IPsec-VPN connection. Multiple CIDR blocks are separated by commas (,).	192.168.0.0/16,172.17.0.0/16
VpnConnectionId	string	The ID of the IPsec-VPN connection.	vco-bp10lz7aejumd****
RemoteSubnet	string	The CIDR block on the on-premises data center side. Multiple CIDR blocks are separated by commas (,).	10.0.0.0/8,172.16.0.0/16
CustomerGatewayId	string	The instance ID of the customer gateway associated with the IPsec-VPN connection.	cgw-bp1mvj4g9kogw****
Name	string	The name of the IPsec-VPN connection.	nametest
EnableDpd	boolean	Indicates whether Dead Peer Detection (DPD) is enabled for the IPsec-VPN connection. true: DPD is enabled. The IPsec initiator sends DPD packets to check whether the peer is alive. If no correct response is received within the specified period of time, the peer is considered disconnected. The ISAKMP SA and the corresponding IPsec SA are deleted, and the security tunnel is also deleted. false: DPD is disabled. The IPsec initiator does not send DPD packets.	true
IkeConfig	object	The Phase 1 negotiation configuration.
RemoteId	string	The identifier on the Alibaba Cloud side of the IPsec-VPN connection.	139.17.XX.XX
IkeLifetime	integer	The IKE phase lifetime. Unit: seconds.	86400
IkeEncAlg	string	The encryption algorithm in the IKE phase.	aes
LocalId	string	The identifier on the on-premises data center side of the IPsec-VPN connection.	116.64.XX.XX
IkeMode	string	The IKE negotiation mode. main: Main mode. The negotiation process is highly secure. aggressive: Aggressive mode. The negotiation is fast and has a high success rate.	main
IkeVersion	string	The IKE protocol version. ikev1 ikev2 Compared with IKEv1, IKEv2 simplifies the SA negotiation process and provides better support for multi-CIDR-block scenarios.	ikev1
IkePfs	string	The DH group in the IKE phase.	group2
Psk	string	The pre-shared key.	pgw6dy7****
IkeAuthAlg	string	The authentication algorithm in the IKE phase.	sha1
IpsecConfig	object	The Phase 2 negotiation configuration.
IpsecAuthAlg	string	The authentication algorithm in the IPsec phase.	sha1
IpsecLifetime	integer	The IPsec phase lifetime. Unit: seconds.	86400
IpsecEncAlg	string	The encryption algorithm in the IPsec phase.	aes
IpsecPfs	string	The DH group in the IPsec phase.	group2
VcoHealthCheck	object	The health check configuration of the IPsec-VPN connection.
Status	string	The health check status. success: Normal. failed: Abnormal.	success
Dip	string	The destination IP address.	192.168.0.1
Interval	integer	The health check interval. Unit: seconds.	2
Retry	integer	The number of retries for the health check.	3
Sip	string	The source IP address.	192.168.0.50
Enable	string	The enabling status of the health check. true: Enabled. false: Disabled.	true
Policy	string	Indicates whether published routes are withdrawn when the health check fails. revoke_route: Routes are withdrawn. reserve_route: Routes are not withdrawn.	revoke_route
VpnBgpConfig	object	The BGP routing protocol configuration of the IPsec-VPN connection.
Status	string	The BGP routing protocol negotiation status. success: Normal. false: Abnormal.	success
PeerBgpIp	string	The BGP IP address of the peer.	169.254.10.1
TunnelCidr	string	The BGP CIDR block of the IPsec-VPN connection. The CIDR block is a subnet of 169.254.0.0/16 with a subnet mask length of 30.	169.254.10.0/30
LocalBgpIp	string	The BGP IP address on the Alibaba Cloud side.	169.254.10.2
PeerAsn	integer	The autonomous system number of the peer.	65530
LocalAsn	integer	The autonomous system number on the Alibaba Cloud side.	65531
AuthKey	string	The authentication key of the BGP routing protocol.	AuthKey****
AttachType	string	The type of resource bound to the IPsec-VPN connection. CEN: The IPsec-VPN connection is bound to a transit router instance under a Cloud Enterprise Network (CEN) instance. NO_ASSOCIATED: The IPsec-VPN connection is not bound to any resource. VPNGW: The IPsec-VPN connection is bound to a VPN gateway instance.	CEN
NetworkType	string	The network type of the IPsec-VPN connection. public: The IPsec-VPN connection establishes an encrypted communication channel over the Internet. private: The IPsec-VPN connection establishes an encrypted communication channel over a private network.	public
AttachInstanceId	string	The ID of the Cloud Enterprise Network (CEN) instance to which the transit routing instance belongs.	cen-lxxpbpalc776qz****
Spec	string	The bandwidth specification of the IPsec-VPN connection. Unit: Mbps.	1000M
State	string	The binding status of the IPsec-VPN connection and the transit router instance. active: The IPsec-VPN connection is bound to a VPN gateway instance and the status is normal. init: The IPsec-VPN connection is not bound to any resource and is in the initialization state. attaching: The IPsec-VPN connection is being bound to a transit router instance. attached: The IPsec-VPN connection is bound to a transit router instance. detaching: The IPsec-VPN connection is being unbound from a transit router instance. financialLocked: Locked due to overdue payment. provisioning: Resources are being prepared. updating: The connection is being updated. upgrading: The connection is being upgraded. deleted: The connection is deleted.	attached
TransitRouterId	string	The ID of the transit router instance bound to the IPsec-VPN connection.	tr-p0we2edef9qr44a85****
TransitRouterName	string	The name of the transit router instance.	nametest
CrossAccountAuthorized	boolean	Indicates whether the IPsec-VPN connection is bound to a transit router instance under a different Alibaba Cloud account. true: Yes. false: No.	false
InternetIp	string	The gateway IP address of the IPsec-VPN connection. Note This parameter is returned only when the IPsec-VPN connection is bound to a transit router instance.	10.XX.XX.10
Tag	object
Tag	array<object>	The list of tags bound to the IPsec-VPN connection.
	object	The tag information.
Key	string	The tag key.	TagKey
Value	string	The tag value.	TagValue
TunnelOptionsSpecification	object
TunnelOptions	array<object>	The tunnel configuration of the IPsec-VPN connection. The parameters under TunnelOptionsSpecification are returned only when you query an IPsec-VPN connection in dual-tunnel mode.
	array<object>	The tunnel configuration.
TunnelId	string	The tunnel ID.	tun-opsqc4d97wni27****
CustomerGatewayId	string	The ID of the customer gateway associated with the tunnel.	cgw-p0wy363lucf1uyae8****
EnableDpd	string	Indicates whether Dead Peer Detection (DPD) is enabled for the tunnel. false: Disabled. true: Enabled.	true
EnableNatTraversal	string	Indicates whether NAT traversal is enabled for the tunnel. false: Disabled. true: Enabled.	true
InternetIp	string	The IP address of the tunnel.	47.21.XX.XX
RemoteCaCertificate	string	The CA certificate of the tunnel peer. This parameter is returned only when the VPN gateway instance uses the China Cryptographic Algorithm (SM).	-----BEGIN CERTIFICATE----- MIIB7zCCAZW**** -----END CERTIFICATE-----
Role	string	The role of the tunnel. master: The tunnel is the active tunnel. slave: The tunnel is the standby tunnel.	master
TunnelIndex	integer	The creation order of the tunnel. 1: The first tunnel. 2: The second tunnel. Note This parameter is returned only when the IPsec-VPN connection is bound to a transit router instance.	1
State	string	The status of the tunnel. active: Normal. updating: Being updated. deleting: Being deleted.	active
Status	string	The status of the IPsec-VPN connection. ike_sa_not_established: Phase 1 negotiation failed. ike_sa_established: Phase 1 negotiation succeeded. ipsec_sa_not_established: Phase 2 negotiation failed. ipsec_sa_established: Phase 2 negotiation succeeded.	ipsec_sa_established
TunnelBgpConfig	object	The BGP configuration of the tunnel.
BgpStatus	string	The BGP negotiation status. success: Normal. failed: Abnormal.	success
LocalAsn	string	The autonomous system number on the local end (Alibaba Cloud side) of the tunnel.	65530
LocalBgpIp	string	The BGP IP address on the local end (Alibaba Cloud side) of the tunnel.	169.254.10.1
PeerAsn	string	The autonomous system number of the tunnel peer.	65531
PeerBgpIp	string	The BGP IP address of the tunnel peer.	169.254.10.2
TunnelCidr	string	The BGP CIDR block of the tunnel.	169.254.10.0/30
TunnelIkeConfig	object	The Phase 1 negotiation configuration.
IkeAuthAlg	string	The authentication algorithm in the IKE phase.	sha1
IkeEncAlg	string	The encryption algorithm in the IKE phase.	aes
IkeLifetime	string	The IKE phase lifetime. Unit: seconds.	86400
IkeMode	string	The IKE negotiation mode. main: Main mode. The negotiation process is highly secure. aggressive: Aggressive mode. The negotiation is fast and has a high success rate.	main
IkePfs	string	The DH group in the IKE phase.	group2
IkeVersion	string	The IKE protocol version.	ikev1
LocalId	string	The identifier on the local end (Alibaba Cloud side) of the tunnel.	47.21.XX.XX
Psk	string	The pre-shared key.	123456****
RemoteId	string	The identifier of the tunnel peer.	47.42.XX.XX
TunnelIpsecConfig	object	The Phase 2 negotiation configuration.
IpsecAuthAlg	string	The authentication algorithm in the IPsec phase.	sha1
IpsecEncAlg	string	The encryption algorithm in the IPsec phase.	aes
IpsecLifetime	string	The IPsec phase lifetime. Unit: seconds.	86400
IpsecPfs	string	The DH group in the IPsec phase.	group2
ZoneNo	string	The zone in which the tunnel is deployed.	ap-southeast-5a
EnableTunnelsBgp	boolean	The enabling status of BGP for the tunnels. true: Enabled. false: Disabled.	true
ResourceGroupId	string	The ID of the resource group to which the IPsec-VPN connection belongs. You can call ListResourceGroups to query resource group information.	rg-acfmzs372yg****
TunnelBandwidth	string	The bandwidth specification of a single VPN tunnel. Valid values: Standard (default): Standard type with a default bandwidth of 1 Gbps. Large: Large type with a default bandwidth of 3 Gbps.	Standard

Examples

Success response

JSON format

{
  "PageSize": 10,
  "RequestId": "238752DC-0693-49BE-9C85-711D5691D3E5",
  "PageNumber": 1,
  "TotalCount": 2,
  "VpnConnections": {
    "VpnConnection": [
      {
        "Status": "ipsec_sa_established",
        "EnableNatTraversal": true,
        "RemoteCaCertificate": "-----BEGIN CERTIFICATE----- MIIB7zCCAZW**** -----END CERTIFICATE-----",
        "CreateTime": 1492753817000,
        "EffectImmediately": true,
        "VpnGatewayId": "vpn-bp1q8bgx4xnkm****",
        "LocalSubnet": "192.168.0.0/16,172.17.0.0/16",
        "VpnConnectionId": "vco-bp10lz7aejumd****",
        "RemoteSubnet": "10.0.0.0/8,172.16.0.0/16",
        "CustomerGatewayId": "cgw-bp1mvj4g9kogw****",
        "Name": "nametest",
        "EnableDpd": true,
        "IkeConfig": {
          "RemoteId": "139.17.XX.XX",
          "IkeLifetime": 86400,
          "IkeEncAlg": "aes",
          "LocalId": "116.64.XX.XX",
          "IkeMode": "main",
          "IkeVersion": "ikev1",
          "IkePfs": "group2",
          "Psk": "pgw6dy7****",
          "IkeAuthAlg": "sha1"
        },
        "IpsecConfig": {
          "IpsecAuthAlg": "sha1",
          "IpsecLifetime": 86400,
          "IpsecEncAlg": "aes",
          "IpsecPfs": "group2"
        },
        "VcoHealthCheck": {
          "Status": "success",
          "Dip": "192.168.0.1",
          "Interval": 2,
          "Retry": 3,
          "Sip": "192.168.0.50",
          "Enable": "true",
          "Policy": "revoke_route"
        },
        "VpnBgpConfig": {
          "Status": "success",
          "PeerBgpIp": "169.254.10.1",
          "TunnelCidr": "169.254.10.0/30",
          "LocalBgpIp": "169.254.10.2",
          "PeerAsn": 65530,
          "LocalAsn": 65531,
          "AuthKey": "AuthKey****"
        },
        "AttachType": "CEN",
        "NetworkType": "public",
        "AttachInstanceId": "cen-lxxpbpalc776qz****",
        "Spec": "1000M",
        "State": "attached",
        "TransitRouterId": "tr-p0we2edef9qr44a85****",
        "TransitRouterName": "nametest",
        "CrossAccountAuthorized": false,
        "InternetIp": "10.XX.XX.10",
        "Tag": {
          "Tag": [
            {
              "Key": "TagKey",
              "Value": "TagValue"
            }
          ]
        },
        "TunnelOptionsSpecification": {
          "TunnelOptions": [
            {
              "TunnelId": "tun-opsqc4d97wni27****",
              "CustomerGatewayId": "cgw-p0wy363lucf1uyae8****",
              "EnableDpd": "true",
              "EnableNatTraversal": "true",
              "InternetIp": "47.21.XX.XX",
              "RemoteCaCertificate": "-----BEGIN CERTIFICATE----- MIIB7zCCAZW**** -----END CERTIFICATE-----",
              "Role": "master",
              "TunnelIndex": 1,
              "State": "active",
              "Status": "ipsec_sa_established",
              "TunnelBgpConfig": {
                "BgpStatus": "success",
                "LocalAsn": "65530",
                "LocalBgpIp": "169.254.10.1",
                "PeerAsn": "65531",
                "PeerBgpIp": "169.254.10.2",
                "TunnelCidr": "169.254.10.0/30"
              },
              "TunnelIkeConfig": {
                "IkeAuthAlg": "sha1",
                "IkeEncAlg": "aes",
                "IkeLifetime": "86400",
                "IkeMode": "main",
                "IkePfs": "group2",
                "IkeVersion": "ikev1",
                "LocalId": "47.21.XX.XX",
                "Psk": "123456****",
                "RemoteId": "47.42.XX.XX"
              },
              "TunnelIpsecConfig": {
                "IpsecAuthAlg": "sha1",
                "IpsecEncAlg": "aes",
                "IpsecLifetime": "86400",
                "IpsecPfs": "group2"
              },
              "ZoneNo": "ap-southeast-5a"
            }
          ]
        },
        "EnableTunnelsBgp": true,
        "ResourceGroupId": "rg-acfmzs372yg****",
        "TunnelBandwidth": "Standard"
      }
    ]
  }
}

Error codes

HTTP status code	Error code	Error message	Description
400	Forbidden.TagKey.Duplicated	The specified tag key already exists.	The tag resources are duplicate.
400	SizeLimitExceeded.TagNum	The maximum number of tags is exceeded.	The number of tags has reached the upper limit.
400	InvalidParameter.TagValue	The specified parameter TagValue is invalid.	The error message returned because the specified tag value is invalid.
400	InvalidParameter.TagKey	The specified parameter TagKey is invalid.	The error message returned because the specified tag key is invalid.
400	Duplicated.TagKey	The specified parameter TagKey is duplicated.	The error message returned because the specified tag key already exists.
403	Forbbiden.SubUser	User not authorized to operate on the specified resource as your account is created by another user.
403	Forbidden	User not authorized to operate on the specified resource.	You do not have the permissions to manage the specified resource. Apply for the permissions and try again.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.