All Products
Search

This Product

    VPN Gateway:ModifyVpnGatewayAttribute

    Document Center

    VPN Gateway:ModifyVpnGatewayAttribute

    Last Updated:Oct 08, 2026

    Modifies the name, description, or automatic route propagation feature of a VPN gateway.

    Operation description

    • The ModifyVpnGatewayAttribute operation is asynchronous. The system returns the information of the VPN gateway before the configuration is modified. The modification task is still running in the background. You can call the DescribeVpnGateway operation to query the modification status of the VPN gateway configuration:

      • If the VPN gateway is in the updating state, the configuration of the VPN gateway is being modified.

      • If the VPN gateway is in the active state, the configuration of the VPN gateway is modified.

    • The ModifyVpnGatewayAttribute operation does not support concurrent modifications to the configuration of the same VPN gateway.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    vpc:ModifyVpnGatewayAttribute

    update

    *VpnGateway

    acs:vpc:{#regionId}:{#accountId}:vpngateway/{#VpnGatewayId}

    		 None None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    RegionId

    string

    Yes

    The region ID of the VPN gateway. You can call the DescribeRegions operation to obtain the region ID.

    cn-hangzhou
    ClientToken

    string

    No

    The client token that is used to ensure the idempotence of the request.

    You can generate the parameter value on your client to ensure that the value is unique among different requests. The client token supports only ASCII characters.

    Note

    If you do not specify this parameter, the system automatically uses the RequestId of the API request as the client token. The RequestId of each API request is unique.

    123e4567-e89b-12d3-a456-4266****
    VpnGatewayId

    string

    Yes

    The ID of the VPN gateway.

    vpn-bp1q8bgx4xnkm2ogj****
    Name

    string

    No

    The new name of the VPN gateway.

    The name must be 2 to 100 characters in length, and cannot start with http:// or https://. It must start with a letter, and can contain letters, digits, underscores (_), hyphens (-), and periods (.). Other special characters are not supported.

    myvpn
    Description

    string

    No

    The new description of the VPN gateway.

    The description must be 1 to 100 characters in length.

    test
    AutoPropagate

    boolean

    No

    Specifies whether to enable the automatic route propagation feature for the VPN gateway. Valid values:

    • true: enables the feature.

      After automatic route propagation is enabled, the VPN gateway automatically learns system routes in the system route table of the VPC and automatically propagates routes of the on-premises data center to the system route table of the VPC.

    • false: disables the feature.

      Before you disable automatic route propagation, make sure that the BGP dynamic route feature is disabled for all IPsec-VPN connections under the VPN gateway.

    true

    Response elements

    Element

    Type

    Description

    Example

    object

    The response.

    VpcId

    string

    The ID of the VPC to which the VPN gateway belongs.

    vpc-bp1ub1yt9cvakoel****
    Status

    string

    The status of the VPN gateway. Valid values:

    • init: initializing.

    • provisioning: preparing.

    • active: normal.

    • updating: updating.

    • deleting: deleting.

    active
    InternetIp

    string

    • If the VPN gateway supports single-tunnel IPsec-VPN connections, this parameter indicates the IP address of the VPN gateway, which can be used to create an IPsec-VPN connection or an SSL-VPN connection.

    • If the VPN gateway supports dual-tunnel IPsec-VPN connections, this parameter indicates the first IP address used to create an IPsec-VPN connection. It cannot be used to create an SSL-VPN connection.

      If the VPN gateway supports dual-tunnel IPsec-VPN connections, the system assigns two IPsec addresses to the VPN gateway for creating dual-tunnel IPsec-VPN connections.

    116.62.XX.XX
    Spec

    string

    The bandwidth specification of the VPN gateway. Unit: Mbit/s.

    5M
    CreateTime

    integer

    The timestamp of when the VPN gateway was created. Unit: milliseconds.

    The timestamp follows the UNIX time format. It is the total number of milliseconds that have elapsed since 00:00:00 Thursday, January 1, 1970 (UTC).

    1492753580000
    AutoPropagate

    boolean

    Specifies whether BGP routes are automatically propagated to the VPC. Valid values:

    • true: automatically propagated.

    • false: not automatically propagated.

    true
    VpnGatewayId

    string

    The ID of the VPN gateway.

    vpn-bp1q8bgx4xnkm2ogj****
    IntranetIp

    string

    The private IP address of the vSwitch that is occupied when the system deploys the VPN gateway.

    This parameter is returned only for VPN gateways that support only single-tunnel IPsec-VPN connections and have the IPsec-VPN feature enabled.

    172.16.10.46
    EndTime

    integer

    The expiration UNIX timestamp of the VPN gateway. Unit: milliseconds.

    The UNIX timestamp follows the UNIX time format. It is the total number of milliseconds that have elapsed since 00:00:00 Thursday, January 1, 1970 (UTC) until the VPN gateway expires.

    1495382400000
    VSwitchId

    string

    The ID of the vSwitch associated with the VPN gateway.

    vsw-bp1y9ovl1cu9ou4tv****
    RequestId

    string

    The request ID.

    54B48E3D-DF70-471B-AA93-08E683A1B457
    Description

    string

    The description of the VPN gateway.

    test
    EnableBgp

    boolean

    Specifies whether the BGP feature is enabled for the VPN gateway. Valid values:

    • true: enabled.

    • false: disabled.

    true
    BusinessStatus

    string

    The billing status of the VPN gateway. Valid values:

    • Normal: normal.

    • FinancialLocked: locked due to overdue payments.

    Normal
    Name

    string

    The name of the VPN gateway.

    test
    DisasterRecoveryInternetIp

    string

    The second IP address assigned by the system to the VPN gateway for creating an IPsec-VPN connection.

    This parameter is returned only for VPN gateways that support dual-tunnel IPsec-VPN connections.

    116.11.XX.XX
    DisasterRecoveryVSwitchId

    string

    The ID of the second vSwitch associated with the VPN gateway.

    This parameter is returned only for VPN gateways that support dual-tunnel IPsec-VPN connections.

    vsw-p0w95ql6tmr2ludkt****
    SslVpnInternetIp

    string

    The IP address of the SSL-VPN connection.

    This parameter is returned only after the SSL-VPN feature is enabled for a VPN gateway of the public network type that supports dual-tunnel IPsec-VPN connections.

    116.33.XX.XX
    ResourceGroupId

    string

    The ID of the resource group to which the VPN gateway belongs.

    You can call the ListResourceGroups operation to query resource group information.

    rg-acfmzs372yg****

    Examples

    Success response

    JSON format

    {
  "VpcId": "vpc-bp1ub1yt9cvakoel****",
  "Status": "active",
  "InternetIp": "116.62.XX.XX",
  "Spec": "5M",
  "CreateTime": 1492753580000,
  "AutoPropagate": true,
  "VpnGatewayId": "vpn-bp1q8bgx4xnkm2ogj****",
  "IntranetIp": "172.16.10.46",
  "EndTime": 1495382400000,
  "VSwitchId": "vsw-bp1y9ovl1cu9ou4tv****",
  "RequestId": "54B48E3D-DF70-471B-AA93-08E683A1B457",
  "Description": "test",
  "EnableBgp": true,
  "BusinessStatus": "Normal",
  "Name": "test",
  "DisasterRecoveryInternetIp": "116.11.XX.XX",
  "DisasterRecoveryVSwitchId": "vsw-p0w95ql6tmr2ludkt****",
  "SslVpnInternetIp": "116.33.XX.XX",
  "ResourceGroupId": "rg-acfmzs372yg****"
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 InvalidName The name is not valid
    400 InvalidDescription The description is not valid
    400 OperationUnsupported.EnableBgp Current version of the VPN does not support enable BGP. The current version of the VPN gateway does not support BGP.
    400 OperationFailed.VpnConnectionExist Auto propagate cannot be closed when VPN connections with BGP enabled exist. Auto propagation cannot be closed when VPN connections with BGP enabled exist.
    400 InvalidVpnGatewayInstanceId.NotFound The specified vpn gateway instance id does not exist. The specified VPN gateway does not exist. Check whether the specified VPN gateway is valid.
    400 VpnGateway.Configuring The specified service is configuring.
    400 OperationFailed.CenLevelNotSupport When the VPC to which the VPN gateway belongs is attached to a FULL-mode CEN, the VPN gateway cannot enable BGP. When the VPC to which the VPN gateway belongs is attached to a FULL-mode CEN, the VPN gateway cannot enable BGP.
    400 OperationFailed.VpcRoutePropagationDisable The VPC system routing table does not enable the acceptance of propagated routes. The VPC system route table is not enabled to accept the propagation route.
    400 OperationFailed.VpcRoutePublishEnabledInTR A VPC supports at most one dynamic route learning source. In the forwarding router, disable route synchronization for the VPC. A VPC supports at most one dynamic route learning source. In the forwarding router, disable route synchronization for the VPC.
    400 OperationFailed.VpcRoutePublishEnabledInECR VPC supports only one dynamic route learning source at most. Please remove the VPC from ECR. A VPC supports at most one dynamic route learning source. Remove the VPC from ECR
    400 OperationFailed.BondingVpnNotSupportBGP The architecture does not support BGP capabilities (single tunnel bonding architecture VPN gateway). the architecture does not support the bgp capability (single-tunnel bonding vpn gateway)
    400 OperationFailed.StaleBGPRoutes BGP routes are still there and automatic route propagation cannot be disabled. Automatic route propagation cannot be disabled because a BGP route is left.
    403 Forbidden.SubUser User not authorized to operate on the specified resource as your account is created by another user. The error message returned because you are unauthorized to perform this operation on the specified resource. Acquire the required permissions and try again.
    403 Forbidden User not authorized to operate on the specified resource. You do not have the permissions to manage the specified resource. Apply for the permissions and try again.
    404 InvalidVpnGatewayInstanceId.NotFound The specified vpn gateway instance id does not exist.

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.