Use DescribeVpnConnection to query detailed IPsec-VPN connection information - VPN Gateway - Alibaba Cloud - VPN Gateway

Queries the information about a specified IPsec-VPN connection.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

vpc:DescribeVpnConnection

get

*VpnConnection

acs:vpc:{#regionId}:{#accountId}:vpnconnection/{#VpnConnectionId}

None

Request parameters

Parameter	Type	Required	Description	Example
RegionId	string	Yes	The region ID of the IPsec-VPN connection. You can call the DescribeRegions operation to query region IDs.	cn-hangzhou
VpnConnectionId	string	Yes	The ID of the IPsec-VPN connection.	vco-bp1bbi27hojx80nck****

Response elements

Element	Type	Description	Example
	object	The response parameters.
Status	string	The status of the IPsec-VPN connection. ike_sa_not_established: Phase 1 negotiation failed. ike_sa_established: Phase 1 negotiation succeeded. ipsec_sa_not_established: Phase 2 negotiation failed. ipsec_sa_established: Phase 2 negotiation succeeded.	ike_sa_not_established
RemoteCaCertificate	string	The CA certificate of the peer.	-----BEGIN CERTIFICATE----- MIIB7zCCAZW****
EnableNatTraversal	boolean	Indicates whether NAT traversal is enabled for the IPsec-VPN connection.	true
CreateTime	integer	The timestamp when the IPsec-VPN connection was created. Unit: milliseconds. The timestamp is in the UNIX timestamp format, which represents the total number of milliseconds that have elapsed since January 1, 1970, 00:00:00 (UTC) to the time when the IPsec-VPN connection was created.	1492753817000
EffectImmediately	boolean	Indicates whether the IPsec-VPN connection configurations take effect immediately. true: The configurations take effect immediately. A reconnection is triggered after the configuration change is complete. false: The configurations do not take effect immediately. A reconnection is triggered when traffic is detected.	true
VpnGatewayId	string	The instance ID of the VPN gateway.	vpn-bp1q8bgx4xnkm2ogj****
LocalSubnet	string	The CIDR block on the Alibaba Cloud side of the IPsec-VPN connection.	10.0.0.0/8
RequestId	string	The request ID.	F2310D45-BCF6-4E2E-9082-B4503844BA4C
VpnConnectionId	string	The ID of the IPsec-VPN connection.	vco-bp1bbi27hojx80nck****
RemoteSubnet	string	The CIDR block on the on-premises data center side.	192.168.0.0/16
CustomerGatewayId	string	The ID of the customer gateway associated with the IPsec-VPN connection.	cgw-bp1mvj4g9kogwwcxk****
Name	string	The name of the IPsec-VPN connection.	ipsec1
EnableDpd	boolean	Indicates whether Dead Peer Detection (DPD) is enabled for the IPsec-VPN connection.	true
IkeConfig	object	The configuration of Phase 1 negotiation.
RemoteId	string	The identifier on the on-premises data center side of the IPsec-VPN connection.	139.34.XX.XX
IkeLifetime	integer	The IKE phase lifetime. Unit: seconds.	86400
IkeEncAlg	string	The encryption algorithm in the IKE phase.	aes
LocalId	string	The identifier on the Alibaba Cloud side of the IPsec-VPN connection.	116.28.XX.XX
IkeMode	string	The IKE negotiation mode.	main
IkeVersion	string	The IKE protocol version. ikev1 ikev2 Compared with IKEv1, IKEv2 simplifies the SA negotiation process and provides better support for multi-CIDR-block scenarios.	ikev1
IkePfs	string	The DH group in the IKE phase.	group2
Psk	string	The pre-shared key.	pgw6dy****
IkeAuthAlg	string	The authentication algorithm in the IKE phase.	sha1
IpsecConfig	object	The configuration of Phase 2 negotiation.
IpsecAuthAlg	string	The authentication algorithm in the IPsec phase.	sha1
IpsecLifetime	integer	The IPsec phase lifetime. Unit: seconds.	86400
IpsecEncAlg	string	The encryption algorithm in the IPsec phase.	aes
IpsecPfs	string	The DH group in the IPsec phase.	group2
VcoHealthCheck	object	The health check information of the IPsec-VPN connection.
Status	string	The health check status.	failed
Dip	string	The destination IP address.	10.0.0.1
Interval	integer	The retry interval of the health check. Unit: seconds.	3
Retry	integer	The number of health check retries.	3
Sip	string	The source IP address.	192.168.1.1
Enable	string	Indicates whether health check is enabled for the IPsec-VPN connection. false: Not enabled. true: Enabled.	true
Policy	string	Indicates whether published routes are withdrawn when the health check fails.	revoke_route
VpnBgpConfig	object	The BGP routing protocol configuration of the IPsec-VPN connection.
Status	string	The negotiation status of the BGP routing protocol.	success
PeerBgpIp	string	The BGP IP address of the peer.	169.254.11.1
TunnelCidr	string	The BGP CIDR block of the IPsec-VPN connection. The CIDR block is a subnet with a subnet mask of 30 bits in mask length within 169.254.0.0/16.	169.254.11.0/30
EnableBgp	string	The enabling status of the BGP routing protocol.	true
LocalBgpIp	string	The BGP IP address on the Alibaba Cloud side.	169.254.11.2
PeerAsn	integer	The autonomous system number of the peer.	65530
LocalAsn	integer	The autonomous system number on the Alibaba Cloud side.	65531
AuthKey	string	The authentication key of the BGP routing protocol.	AuthKey****
AttachType	string	The type of resource attached to the IPsec-VPN connection. CEN: The IPsec-VPN connection is attached to a transit router of a Cloud Enterprise Network (CEN) instance. NO_ASSOCIATED: The IPsec-VPN connection is not attached to any resource. VPNGW: The IPsec-VPN connection is attached to a VPN gateway instance.	CEN
NetworkType	string	The network type of the IPsec-VPN connection. public: public network. The IPsec-VPN connection establishes an encrypted communication channel over the Internet. private: private network. The IPsec-VPN connection establishes an encrypted communication channel over a private network.	public
AttachInstanceId	string	The instance ID of the Cloud Enterprise Network (CEN) instance to which the transit router instance belongs.	cen-lxxpbpalc776qz****
Spec	string	The bandwidth specification of the IPsec-VPN connection. Unit: Mbps.	1000M
State	string	The binding status between the IPsec-VPN connection and the transit router instance.	attached
ZoneNo	string	The zone ID where the IPsec-VPN connection is deployed. You can call the DescribeZones operation to query the mapping between zone IDs and zones.	cn-hangzhou-h
InternetIp	string	The gateway IP address of the IPsec-VPN connection.	47.XX.XX.162
TransitRouterId	string	The instance ID of the transit router instance attached to the IPsec-VPN connection.	tr-p0we2edef9qr44a85****
TransitRouterName	string	The name of the transit router instance.	nametest
CrossAccountAuthorized	boolean	Indicates whether the IPsec-VPN connection is bound to a transit router instance under a different account.	false
Tags	object
Tag	array<object>	The list of tags bound to the IPsec-VPN connection.
	object	The tag information.
Key	string	The tag key.	TagKey
Value	string	The tag value.	TagValue
TunnelOptionsSpecification	object
TunnelOptions	array<object>	The tunnel configuration of the IPsec-VPN connection.
	array<object>	The tunnel configuration.
TunnelId	string	The tunnel ID.	tun-opsqc4d97wni27****
CustomerGatewayId	string	The ID of the customer gateway associated with the tunnel.	cgw-p0wy363lucf1uyae8****
EnableDpd	string	Indicates whether Dead Peer Detection (DPD) is enabled for the tunnel.	true
EnableNatTraversal	string	Indicates whether NAT traversal is enabled for the tunnel.	true
InternetIp	string	The IP address of the tunnel.	47.21.XX.XX
RemoteCaCertificate	string	The CA certificate of the tunnel peer.	-----BEGIN CERTIFICATE----- MIIB7zCCAZW**** -----END CERTIFICATE-----
Role	string	The role of the tunnel.	master
TunnelIndex	integer	The creation order of the tunnel.	1
State	string	The status of the tunnel.	active
Status	string	The status of the IPsec-VPN connection.	ipsec_sa_established
TunnelBgpConfig	object	The BGP configuration of the tunnel.
BgpStatus	string	The BGP negotiation status.	success
LocalAsn	string	The autonomous system number on the local end (Alibaba Cloud side) of the tunnel.	65530
LocalBgpIp	string	The BGP IP address on the local end (Alibaba Cloud side) of the tunnel.	169.254.10.1
PeerAsn	string	The autonomous system number of the tunnel peer.	65531
PeerBgpIp	string	The BGP IP address of the tunnel peer.	169.254.10.2
TunnelCidr	string	The BGP CIDR block of the tunnel.	169.254.10.0/30
TunnelIkeConfig	object	The configuration of Phase 1 negotiations.
IkeAuthAlg	string	The authentication algorithm in the IKE phase.	sha1
IkeEncAlg	string	The encryption algorithm in the IKE phase.	aes
IkeLifetime	string	The IKE phase lifetime. Unit: seconds.	86400
IkeMode	string	The IKE negotiation mode.	main
IkePfs	string	The DH group in the IKE phase.	group2
IkeVersion	string	The IKE protocol version.	ikev1
LocalId	string	The identifier of the local end (Alibaba Cloud side) of the tunnel.	47.21.XX.XX
Psk	string	The pre-shared key.	123456****
RemoteId	string	The identifier of the peer end of the tunnel.	47.42.XX.XX
TunnelIpsecConfig	object	The configuration of Phase 2 negotiations.
IpsecAuthAlg	string	The authentication algorithm in the IPsec phase.	sha1
IpsecEncAlg	string	The encryption algorithm in the IPsec phase.	aes
IpsecLifetime	string	The IPsec phase lifetime. Unit: seconds.	86400
IpsecPfs	string	The DH group in the IPsec phase.	group2
ZoneNo	string	The zone where the tunnel is deployed. You can call the DescribeZones operation to query the mapping between zone IDs and zones.	cn-hangzhou-i
EnableTunnelsBgp	boolean	The enabling status of tunnel BGP.	true
ResourceGroupId	string	The ID of the resource group to which the IPsec-VPN connection belongs. You can call the ListResourceGroups operation to query resource group information.	rg-acfmzs372yg****
TunnelBandwidth	string	The bandwidth specification of a single VPN tunnel. Valid values:	Standard

Examples

Success response

JSON format

{
  "Status": "ike_sa_not_established",
  "RemoteCaCertificate": "-----BEGIN CERTIFICATE----- MIIB7zCCAZW****",
  "EnableNatTraversal": true,
  "CreateTime": 1492753817000,
  "EffectImmediately": true,
  "VpnGatewayId": "vpn-bp1q8bgx4xnkm2ogj****",
  "LocalSubnet": "10.0.0.0/8",
  "RequestId": "F2310D45-BCF6-4E2E-9082-B4503844BA4C",
  "VpnConnectionId": "vco-bp1bbi27hojx80nck****",
  "RemoteSubnet": "192.168.0.0/16",
  "CustomerGatewayId": "cgw-bp1mvj4g9kogwwcxk****",
  "Name": "ipsec1",
  "EnableDpd": true,
  "IkeConfig": {
    "RemoteId": "139.34.XX.XX",
    "IkeLifetime": 86400,
    "IkeEncAlg": "aes",
    "LocalId": "116.28.XX.XX",
    "IkeMode": "main",
    "IkeVersion": "ikev1",
    "IkePfs": "group2",
    "Psk": "pgw6dy****",
    "IkeAuthAlg": "sha1"
  },
  "IpsecConfig": {
    "IpsecAuthAlg": "sha1",
    "IpsecLifetime": 86400,
    "IpsecEncAlg": "aes",
    "IpsecPfs": "group2"
  },
  "VcoHealthCheck": {
    "Status": "failed",
    "Dip": "10.0.0.1",
    "Interval": 3,
    "Retry": 3,
    "Sip": "192.168.1.1",
    "Enable": "true",
    "Policy": "revoke_route"
  },
  "VpnBgpConfig": {
    "Status": "success",
    "PeerBgpIp": "169.254.11.1",
    "TunnelCidr": "169.254.11.0/30",
    "EnableBgp": "true",
    "LocalBgpIp": "169.254.11.2",
    "PeerAsn": 65530,
    "LocalAsn": 65531,
    "AuthKey": "AuthKey****"
  },
  "AttachType": "CEN",
  "NetworkType": "public",
  "AttachInstanceId": "cen-lxxpbpalc776qz****",
  "Spec": "1000M",
  "State": "attached",
  "ZoneNo": "cn-hangzhou-h",
  "InternetIp": "47.XX.XX.162",
  "TransitRouterId": "tr-p0we2edef9qr44a85****",
  "TransitRouterName": "nametest",
  "CrossAccountAuthorized": false,
  "Tags": {
    "Tag": [
      {
        "Key": "TagKey",
        "Value": "TagValue"
      }
    ]
  },
  "TunnelOptionsSpecification": {
    "TunnelOptions": [
      {
        "TunnelId": "tun-opsqc4d97wni27****",
        "CustomerGatewayId": "cgw-p0wy363lucf1uyae8****",
        "EnableDpd": "true",
        "EnableNatTraversal": "true",
        "InternetIp": "47.21.XX.XX",
        "RemoteCaCertificate": "-----BEGIN CERTIFICATE----- MIIB7zCCAZW**** -----END CERTIFICATE-----",
        "Role": "master",
        "TunnelIndex": 1,
        "State": "active",
        "Status": "ipsec_sa_established",
        "TunnelBgpConfig": {
          "BgpStatus": "success",
          "LocalAsn": "65530",
          "LocalBgpIp": "169.254.10.1",
          "PeerAsn": "65531",
          "PeerBgpIp": "169.254.10.2",
          "TunnelCidr": "169.254.10.0/30"
        },
        "TunnelIkeConfig": {
          "IkeAuthAlg": "sha1",
          "IkeEncAlg": "aes",
          "IkeLifetime": "86400",
          "IkeMode": "main",
          "IkePfs": "group2",
          "IkeVersion": "ikev1",
          "LocalId": "47.21.XX.XX",
          "Psk": "123456****",
          "RemoteId": "47.42.XX.XX"
        },
        "TunnelIpsecConfig": {
          "IpsecAuthAlg": "sha1",
          "IpsecEncAlg": "aes",
          "IpsecLifetime": "86400",
          "IpsecPfs": "group2"
        },
        "ZoneNo": "cn-hangzhou-i"
      }
    ]
  },
  "EnableTunnelsBgp": true,
  "ResourceGroupId": "rg-acfmzs372yg****",
  "TunnelBandwidth": "Standard"
}

Error codes

HTTP status code	Error code	Error message	Description
403	Forbbiden.SubUser	User not authorized to operate on the specified resource as your account is created by another user.
403	Forbidden	User not authorized to operate on the specified resource.	You do not have the permissions to manage the specified resource. Apply for the permissions and try again.
404	InvalidVpnConnectionInstanceId.NotFound	The specified vpn connection instance id does not exist.	The specified vpn connection instance id does not exist.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.