All Products
Search
Document Center

VPN Gateway:UpdateIpsecServer

Last Updated:Feb 26, 2024

Modifies the configuration of an IPsec server.

Operation description

  • If you modify only the IpsecServerName parameter, this operation is synchronous. If you modify parameters other than IpsecServerName, this operation is asynchronous.

  • When the UpdateIpsecServer operation is asynchronous, the system returns a request ID after you send a request to call this operation and the IPsec server is being modified in the backend. You can call DescribeVpnGateway to query the status of a VPN gateway.

    • If the VPN gateway is in the updating state, the configuration of the IPsec server is being modified.
    • If the VPN gateway is in the active state, the configuration of the IPsec server is modified.
  • You cannot repeatedly call the UpdateIpsecServer operation for the same VPN gateway within the specified period of time.

Debugging

OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer.

Authorization information

The following table shows the authorization information corresponding to the API. The authorization information can be used in the Action policy element to grant a RAM user or RAM role the permissions to call this API operation. Description:

  • Operation: the value that you can use in the Action element to specify the operation on a resource.
  • Access level: the access level of each operation. The levels are read, write, and list.
  • Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
    • The required resource types are displayed in bold characters.
    • If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
  • Condition Key: the condition key that is defined by the cloud service.
  • Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.
OperationAccess levelResource typeCondition keyAssociated operation
vpc:UpdateIpsecServerWrite
  • All Resources
    *
    none
none

Request parameters

ParameterTypeRequiredDescriptionExample
RegionIdstringYes

The ID of the region where the IPsec server is created.

You can call the DescribeRegions operation to query the most recent region list.

cn-shanghai
IpsecServerIdstringYes

The IPsec server ID.

iss-bp1bo3xuvcxo7ixll****
LocalSubnetstringNo

The local CIDR blocks, which are the CIDR blocks of the virtual private cloud (VPC) for the client to access.

Multiple CIDR blocks are separated with commas (,). Example: 192.168.1.0/24,192.168.2.0/24.

192.168.0.0/24,172.17.0.0/16
ClientIpPoolstringNo

The client CIDR block from which an IP address is allocated to the virtual network interface controller (NIC) of the client.

Note The client CIDR block must not overlap with the CIDR blocks of the VPC.
10.0.0.0/24
IpsecServerNamestringNo

The IPsec server name.

The name must be 1 to 100 characters in length and cannot start with http:// or https://.

test
EffectImmediatelybooleanNo

Specifies whether to delete the current IPsec tunnel and initiate negotiations again. Valid values:

  • true: immediately initiates negotiations after the configuration is complete.
  • false: initiates negotiations when inbound traffic is detected. This is the default value.
false
IkeConfigstringNo

The configuration of Phase 1 negotiation. Valid values:

  • IkeVersion: the IKE version. Valid values: ikev1 and ikev2. Default value: ikev2.
  • IkeMode: the IKE negotiation mode. Default value: main.
  • IkeEncAlg: the encryption algorithm that is used in Phase 1 negotiation. Default value: aes.
  • IkeAuthAlg: the authentication algorithm that is used in Phase 1 negotiation. Default value: sha1.
  • IkePfs: the Diffie-Hellman key exchange algorithm that is used in Phase 1 negotiation. Default value: group2.
  • IkeLifetime: the security association (SA) lifetime determined by Phase 1 negotiation. Unit: seconds. Valid values: 0 to 86400. Default value: 86400.
  • LocalId: the identifier of the IPsec server. The value can be a fully qualified domain name (FQDN) or an IP address. The default value is the public IP address of the VPN gateway.
  • RemoteId: the peer identifier. The value can be an FQDN or an IP address. The default value is empty.
{"IkeVersion":"ikev2","IkeMode":"main","IkeEncAlg":"aes","IkeAuthAlg":"sha1","IkePfs":"group2","IkeLifetime":86400}
IpsecConfigstringNo

The configuration of Phase 2 negotiation. Valid values:

  • IpsecEncAlg: the encryption algorithm that is used in Phase 2 negotiation. Default value: aes.
  • IpsecAuthAlg: the authentication algorithm that is used in Phase 2 negotiation. Default value: sha1.
  • IpsecPfs: forwards packets of all protocols. The Diffie-Hellman key exchange algorithm that is used in Phase 2 negotiation. Default value: group2.
  • IpsecLifetime: the SA lifetime determined by Phase 2 negotiation. Unit: seconds. Valid values: 0 to 86400. Default value: 86400.
{"IpsecEncAlg":"aes","IpsecAuthAlg":"sha1","IpsecPfs":"group2","IpsecLifetime":86400}
PskEnabledbooleanNo

Specifies whether to enable pre-shared key authentication. If you set the value to true, pre-shared key authentication is enabled.

true
PskstringNo

The pre-shared key.

The pre-shared key is used for identity authentication between the IPsec server and the client. The key must be 1 to 100 characters in length.

If you do not specify a pre-shared key, the system randomly generates a 16-character string as the pre-shared key. You can call the ListIpsecServers operation to query the pre-shared keys that are generated by the system.

Note The pre-shared key of the IPsec server must be the same as the client key. Otherwise, the IPsec server cannot be connected to the client.
Cfd123****
ClientTokenstringNo

The client token that is used to ensure the idempotence of the request.

You can use the client to generate a value, and you must make sure that each request has a unique token value. The client token can contain only ASCII characters.

Note If you do not specify this parameter, the system automatically uses the value of RequestId as the value of ClientToken. The request ID may be different for each request.
e4567-e89b-12d3-a456-42665544****
DryRunstringNo

Specifies whether to only precheck this request. Valid values:

  • true: prechecks the request without modifying the configurations of the IPsec server. The system checks the required parameters, request format, and service limits. If the request fails to pass the precheck, an error code is returned. If the request passes the precheck, the DryRunOperation error code is returned.
  • false: sends the request. This is the default value. If the request passes the precheck, the system modifies the configurations of the IPsec server.
false

Response parameters

ParameterTypeDescriptionExample
object

The returned results.

RequestIdstring

The request ID.

B61C08E5-403A-46A2-96C1-F7B1216DB10C

Examples

Sample success responses

JSONformat

{
  "RequestId": "B61C08E5-403A-46A2-96C1-F7B1216DB10C"
}

Error codes

HTTP status codeError codeError messageDescription
400VpnGateway.ConfiguringThe specified service is configuring.The service is being configured. Try again later.
400VpnGateway.FinancialLockedThe specified service is financial locked.The service is suspended due to overdue payments. Top up your account first.
400OperationUnsupported.IpsecPfsThe specified IPsec Pfs is unsupported.The specified IPsec PFS property is not supported.
400IllegalParam.AuthMethodOne authentication method (Psk or IDaaS) should be specified at least.You must specify at least one authentication method, such as PSK or IDaaS.
400IllegalParam.LocalSubnetThe specified "LocalSubnet" (%s) is invalid.The specified "LocalSubnet" (%s) is invalid.
400IllegalParam.ClientIpPoolThe specified "ClientIpPool" (%s) is invalid.-
400MissingParam.IDaaSInstanceIdThe input parameter IDaaSInstanceId is mandatory when enable multi-factor authentication.You must specify the IDaaS instance ID when two-factor authentication is enabled.
400OperationFailed.NoRamPermissionVpn Service has no permission to operate your IDaaS instances.The VPN service does not have the permissions to manage your IDaaS instance.
400OperationFailed.AddVpcRouteIt's failed to add VPC route after this operation.-
400ClientIpPool.NetmaskInvalidThe netmask length of client IP pool must be greater than or equal to 16 and less than or equal to 29.The subnet mask of the client IP pool must range from 16 to 29.
400VpnRouteEntry.ConflictThe specified client IP pool conflicts with VPN connection or SSL server.The specified client IP pool conflicts with the VPN connection or the SSL server.
400ClientIpPool.SubnetInvalidThe specified client IP pool cannot be used.The client CIDR block is unavailable.
400InvalidClientIpPool.ConflictThe specified client IP pool conflicts with other resources in the same VPC.The client CIDR block conflicts with resources in the VPC.
400SystemBusyThe system is busy. Please try again later.The system is busy. Please try again later.
403ForbiddenUser not authorized to operate on the specified resource.You do not have the permissions to manage the specified resource. Apply for the permissions and try again.
404InvalidIpsecServerId.NotFoundThe specified IPsec server ID (%s) does not exist.-
404InvalidIDaaSInstanceId.NotFoundThe specified IDaaS instance ID does not exist.The specified IDaaS instance does not exist.
409OperationConflictThe operation against this instance is too frequent, please try again later.Operations are too frequently performed on the instance. Try again later.

For a list of error codes, visit the Service error codes.

Change history

Change timeSummary of changesOperation
2023-10-19API Description Update. The Error code has changedsee changesets
Change itemChange content
API DescriptionAPI Description Update.
Error CodesThe Error code has changed.
    delete Error Codes: 400
    delete Error Codes: 403
    delete Error Codes: 404
    delete Error Codes: 409
2023-08-08API Description Update. The Error code has changedsee changesets
Change itemChange content
API DescriptionAPI Description Update.
Error CodesThe Error code has changed.
    delete Error Codes: 400
    delete Error Codes: 403
    delete Error Codes: 404
    delete Error Codes: 409