Use DescribeVpnConnections to query IPsec-VPN connections - VPN Gateway - Alibaba Cloud - VPN Gateway

Queries information about IPsec-VPN connections.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

vpc:DescribeVpnConnections

list

VpnConnection

acs:vpc:{#regionId}:{#accountId}:vpnconnection/*

VpnConnection

acs:vpc:{#regionId}:{#accountId}:vpnconnection/{#VpnConnectionId}

None

Request parameters

Parameter	Type	Required	Description	Example
RegionId	string	Yes	The region ID of the IPsec-VPN connection. You can call the DescribeRegions operation to query the region ID.	cn-hangzhou
VpnGatewayId	string	No	The instance ID of the VPN gateway.	vpn-bp1q8bgx4xnkx****
CustomerGatewayId	string	No	The ID of the customer gateway.	cgw-bp1mvj4g9kogw****
PageNumber	integer	No	The page number. Default value: 1.	1
PageSize	integer	No	The number of entries per page for paging queries. Default value: 10. Valid values: 1 to 50.	10
VpnConnectionId	string	No	The ID of the IPsec-VPN connection.	vco-bp10lz7aejumd****
Tag	array<object>	No	The list of tags bound to the IPsec-VPN connection. You can specify up to 20 tags at a time.
	object	No	The tag information.
Key	string	No	The tag key. If you specify this parameter, the value cannot be an empty string. The tag key can be up to 64 characters in length and cannot start with `aliyun` or `acs:`. It cannot contain `http://` or `https://`. You can specify up to 20 tag keys at a time.	TagKey
Value	string	No	The tag value. The tag value can be up to 128 characters in length and can be an empty string. It cannot start with `aliyun` or `acs:` and cannot contain `http://` or `https://`. Each tag key corresponds to one tag value. You can specify up to 20 tag values at a time.	TagValue
ResourceGroupId	string	No	The ID of the resource group to which the IPsec-VPN connection belongs. You can call the ListResourceGroups operation to query the resource group ID.	rg-acfmzs372yg****

Response elements

Element	Type	Description	Example
	object	The response parameters.
PageSize	integer	The number of entries per page for paging queries.	10
RequestId	string	The request ID.	238752DC-0693-49BE-9C85-711D5691D3E5
PageNumber	integer	The page number.	1
TotalCount	integer	The total number of entries returned.	2
VpnConnections	object
VpnConnection	array<object>	The list of IPsec-VPN connection configurations.
	array<object>	The configuration of the IPsec-VPN connection.
Status	string	The status of the IPsec-VPN connection. ike_sa_not_established: Phase 1 negotiation failed. ike_sa_established: Phase 1 negotiation succeeded. ipsec_sa_not_established: Phase 2 negotiation failed. ipsec_sa_established: Phase 2 negotiation succeeded.	ipsec_sa_established
EnableNatTraversal	boolean	Indicates whether NAT traversal is enabled for the IPsec-VPN connection. true: NAT traversal is enabled. After enabling NAT traversal, the IKE negotiation procedure skips UDP port verification and enables discovery of NAT Gateway devices in the VPN tunnel. false: NAT traversal is disabled.	true
RemoteCaCertificate	string	The CA certificate of the peer.	-----BEGIN CERTIFICATE----- MIIB7zCCAZW**** -----END CERTIFICATE-----
CreateTime	integer	The UNIX timestamp indicating when the IPsec-VPN connection was created. Unit: milliseconds. The timestamp follows the Unix time format, representing the total number of milliseconds elapsed since 00:00:00 UTC on January 1, 1970, until the creation time of the IPsec-VPN connection.	1492753817000
EffectImmediately	boolean	Indicates whether the configuration of the IPsec-VPN connection takes effect immediately. true: Yes. Reconnection is triggered after the configuration change is completed. false: No. Reconnection is triggered when traffic is detected.	true
VpnGatewayId	string	The instance ID of the VPN Gateway.	vpn-bp1q8bgx4xnkm****
LocalSubnet	string	The CIDR block on the Alibaba Cloud side of the IPsec-VPN connection. When multiple CIDR blocks are present, they are separated by commas (,).	192.168.0.0/16,172.17.0.0/16
VpnConnectionId	string	The ID of the IPsec-VPN connection.	vco-bp10lz7aejumd****
RemoteSubnet	string	The CIDR blocks on the data center side. When multiple CIDR blocks are specified, separate them with commas (,).	10.0.0.0/8,172.16.0.0/16
CustomerGatewayId	string	The instance ID of the customer gateway associated with the IPsec-VPN connection.	cgw-bp1mvj4g9kogw****
Name	string	The name of the IPsec-VPN connection.	nametest
EnableDpd	boolean	Indicates whether the DPD (Dead Peer Detection) feature is enabled for the IPsec-VPN connection. true: DPD is enabled. The requester VPC sends DPD probe packets to detect whether the peer device is alive. If no valid response is received within the specified time, the peer is considered disconnected. The IPsec-VPN connection deletes the ISAKMP SA and corresponding IPsec SA, and the security tunnel is also deleted. false: DPD is disabled. The requester VPC does not send DPD probe packets.	true
IkeConfig	object	The configuration for the first-phase negotiation.
RemoteId	string	The identity on the Alibaba Cloud side of the IPsec-VPN connection.	139.17.XX.XX
IkeLifetime	integer	The IKE phase lifetime. Unit: seconds.	86400
IkeEncAlg	string	The IKE phase encryption algorithm.	aes
LocalId	string	The identity of the local data center side of the IPsec-VPN connection peer.	116.64.XX.XX
IkeMode	string	The IKE phase negotiation mode. main: Main mode offers high security during the negotiation procedure. aggressive: Aggressive mode enables faster negotiation and a higher success rate.	main
IkeVersion	string	The IKE protocol version. ikev1 ikev2 Compared with IKEv1, IKEv2 simplifies the SA negotiation procedure and provides better support for scenarios involving multiple segments.	ikev1
IkePfs	string	The Diffie-Hellman (DH) group used in IKE phase 1.	group2
Psk	string	The pre-shared key.	pgw6dy7****
IkeAuthAlg	string	The IKE phase authentication algorithm.	sha1
IpsecConfig	object	The configuration for Phase 2 negotiation.
IpsecAuthAlg	string	The IPsec authentication algorithm.	sha1
IpsecLifetime	integer	The IPsec lifetime. Unit: seconds.	86400
IpsecEncAlg	string	The IPsec encryption algorithm.	aes
IpsecPfs	string	The Diffie-Hellman (DH) group used in the IPsec phase.	group2
VcoHealthCheck	object	Health check configuration for the IPsec-VPN connection.
Status	string	Health check status. success: Normal. failed: Abnormal.	success
Dip	string	The destination IP address.	192.168.0.1
Interval	integer	The time interval for the health check. Unit: seconds.	2
Retry	integer	The number of retry packets for the health check.	3
Sip	string	The source IP address.	192.168.0.50
Enable	string	Enabling status of the health check. true: Enabled. false: Disabled.	true
Policy	string	Whether to revoke published routes when a health check fails. revoke_route: Revoke routes. reserve_route: Do not revoke routes.	revoke_route
VpnBgpConfig	object	The configuration of the BGP routable protocol for the IPsec-VPN connection.
Status	string	The negotiation status of the BGP routable protocol. success: Normal. false: Abnormal.	success
PeerBgpIp	string	The peer BGP IP address.	169.254.10.1
TunnelCidr	string	The BGP CIDR block for the IPsec-VPN connection. This CIDR block is a subnet within 169.254.0.0/16 with a subnet mask length of 30.	169.254.10.0/30
LocalBgpIp	string	The BGP IP address on the Alibaba Cloud side.	169.254.10.2
PeerAsn	integer	The peer autonomous system number.	65530
LocalAsn	integer	The autonomous system number (ASN) on the Alibaba Cloud side.	65531
AuthKey	string	The authentication key for the BGP routable protocol.	AuthKey****
AttachType	string	The resource type to which the IPsec-VPN connection is attached. CEN: Indicates that the IPsec-VPN connection is attached to a transit router instance under a Cloud Enterprise Network (CEN) instance. NO_ASSOCIATED: Indicates that the IPsec-VPN connection is not attached to any resource. VPNGW: Indicates that the IPsec-VPN connection is attached to a VPN Gateway instance.	CEN
NetworkType	string	The network type of the IPsec-VPN connection. public: Internet, indicating that the IPsec-VPN connection establishes an encrypted communication channel over the Internet. private: Private network, indicating that the IPsec-VPN connection establishes an encrypted communication channel over a private network.	public
AttachInstanceId	string	The instance ID of the Cloud Enterprise Network (CEN) instance to which the transit router instance belongs.	cen-lxxpbpalc776qz****
Spec	string	The bandwidth specification of the IPsec-VPN connection. Unit: Mbps.	1000M
State	string	The binding status of the IPsec-VPN connection to a transit router instance. active: The IPsec-VPN connection is bound to a VPN Gateway instance and is in Normal status. init: The IPsec-VPN connection is not bound to any resource and is undergoing initialization. attaching: The IPsec-VPN connection is being attached to a transit router instance. attached: The IPsec-VPN connection has been attached to a transit router instance. detaching: The IPsec-VPN connection is being detached from a transit router instance. financialLocked: The resource is under a financial lock due to overdue payment. provisioning: The resource is being prepared. updating: The resource is being updated. upgrading: The resource is being upgraded. deleted: The resource has been deleted.	attached
TransitRouterId	string	The instance ID of the transit router to which the IPsec-VPN connection is attached.	tr-p0we2edef9qr44a85****
TransitRouterName	string	The name of the transit router instance.	nametest
CrossAccountAuthorized	boolean	Indicates whether the IPsec-VPN connection is attached to a transit router instance under a different account. true: Yes. false: No.	false
InternetIp	string	The gateway IP address of the IPsec-VPN connection. Note This parameter is returned only when the IPsec-VPN connection is attached to a transit router instance.	10.XX.XX.10
Tag	object
Tag	array<object>	The list of tags attached to the IPsec-VPN connection.
	object	Tag information.
Key	string	The tag key.	TagKey
Value	string	The tag value.	TagValue
TunnelOptionsSpecification	object
TunnelOptions	array<object>	The tunnel configuration information of the IPsec-VPN connection. Parameters under the TunnelOptionsSpecification array are returned only when querying an IPsec-VPN connection in dual-tunnel mode.
	array<object>	The configuration information of the tunnel.
TunnelId	string	The tunnel ID.	tun-opsqc4d97wni27****
CustomerGatewayId	string	The ID of the customer gateway associated with the tunnel.	cgw-p0wy363lucf1uyae8****
EnableDpd	string	Whether the DPD (Dead Peer Detection) feature is enabled for the tunnel. false: Disabled. true: Enabled.	true
EnableNatTraversal	string	Indicates whether NAT traversal is enabled for the tunnel. false: Disabled. true: Enabled.	true
InternetIp	string	The IP address of the tunnel.	47.21.XX.XX
RemoteCaCertificate	string	The CA certificate of the remote end of the tunnel. This parameter is returned only when the Type of the VPN Gateway instance is SM (State Encryption).	-----BEGIN CERTIFICATE----- MIIB7zCCAZW**** -----END CERTIFICATE-----
Role	string	The role of the tunnel. master: indicates that the current tunnel is the primary tunnel. slave: indicates that the current tunnel is the backup tunnel.	master
TunnelIndex	integer	The creation order of the tunnel. 1: The first tunnel. 2: The second tunnel. Note This parameter is returned only when the IPsec-VPN connection is attached to a transit router.	1
State	string	The status of the tunnel. active: The status is Normal. updating: Updating. deleting: Deleting.	active
Status	string	The status of the IPsec-VPN connection. ike_sa_not_established: Phase 1 negotiation failed. ike_sa_established: Phase 1 negotiation succeeded. ipsec_sa_not_established: Phase 2 negotiation failed. ipsec_sa_established: Phase 2 negotiation succeeded.	ipsec_sa_established
TunnelBgpConfig	object	The Border Gateway Protocol (BGP) configuration information of the tunnel.
BgpStatus	string	The Border Gateway Protocol (BGP) negotiation status. success: Normal. failed: abnormal.	success
LocalAsn	string	The autonomous system number (ASN) of the local end (Alibaba Cloud side) of the tunnel.	65530
LocalBgpIp	string	The BGP IP address on the local end (Alibaba Cloud side) of the tunnel.	169.254.10.1
PeerAsn	string	The autonomous system number of the tunnel peer.	65531
PeerBgpIp	string	The BGP IP address of the tunnel peer.	169.254.10.2
TunnelCidr	string	The BGP segment of the tunnel.	169.254.10.0/30
TunnelIkeConfig	object	The configuration for Phase 1 negotiation.
IkeAuthAlg	string	The IKE authentication algorithm.	sha1
IkeEncAlg	string	The IKE encryption algorithm.	aes
IkeLifetime	string	IKE phase lifetime. Unit: seconds.	86400
IkeMode	string	IKE negotiation mode. main: main mode, which provides high security during the negotiation procedure. aggressive: aggressive mode, which enables fast negotiation and a high negotiation success rate.	main
IkePfs	string	The Diffie-Hellman (DH) group used in IKE phase 1.	group2
IkeVersion	string	IKE protocol version.	ikev1
LocalId	string	The identity of the local end (Alibaba Cloud side) of the tunnel.	47.21.XX.XX
Psk	string	Pre-shared key.	123456****
RemoteId	string	The identity of the tunnel peer.	47.42.XX.XX
TunnelIpsecConfig	object	Configuration for phase two negotiation.
IpsecAuthAlg	string	IPsec phase authentication algorithm.	sha1
IpsecEncAlg	string	IPsec phase encryption algorithm.	aes
IpsecLifetime	string	IPsec phase lifetime. Unit: seconds.	86400
IpsecPfs	string	IPsec phase Diffie-Hellman (DH) group.	group2
ZoneNo	string	The zone where the tunnel is deployed.	ap-southeast-5a
EnableTunnelsBgp	boolean	The enabling status of tunnel BGP. true: Enabled. false: Disabled.	true
ResourceGroupId	string	The ID of the resource group to which the IPsec-VPN connection belongs. You can invoke the ListResourceGroups API to query resource group information.	rg-acfmzs372yg****
TunnelBandwidth	string	Specifies the bandwidth specification for a single VPN tunnel. Valid values: Standard (Default Value): medium, with a default bandwidth of 1 Gbps Large: large, with a default bandwidth of 3 Gbps	Standard

Examples

Success response

JSON format

{
  "PageSize": 10,
  "RequestId": "238752DC-0693-49BE-9C85-711D5691D3E5",
  "PageNumber": 1,
  "TotalCount": 2,
  "VpnConnections": {
    "VpnConnection": [
      {
        "Status": "ipsec_sa_established",
        "EnableNatTraversal": true,
        "RemoteCaCertificate": "-----BEGIN CERTIFICATE----- MIIB7zCCAZW**** -----END CERTIFICATE-----",
        "CreateTime": 1492753817000,
        "EffectImmediately": true,
        "VpnGatewayId": "vpn-bp1q8bgx4xnkm****",
        "LocalSubnet": "192.168.0.0/16,172.17.0.0/16",
        "VpnConnectionId": "vco-bp10lz7aejumd****",
        "RemoteSubnet": "10.0.0.0/8,172.16.0.0/16",
        "CustomerGatewayId": "cgw-bp1mvj4g9kogw****",
        "Name": "nametest",
        "EnableDpd": true,
        "IkeConfig": {
          "RemoteId": "139.17.XX.XX",
          "IkeLifetime": 86400,
          "IkeEncAlg": "aes",
          "LocalId": "116.64.XX.XX",
          "IkeMode": "main",
          "IkeVersion": "ikev1",
          "IkePfs": "group2",
          "Psk": "pgw6dy7****",
          "IkeAuthAlg": "sha1"
        },
        "IpsecConfig": {
          "IpsecAuthAlg": "sha1",
          "IpsecLifetime": 86400,
          "IpsecEncAlg": "aes",
          "IpsecPfs": "group2"
        },
        "VcoHealthCheck": {
          "Status": "success",
          "Dip": "192.168.0.1",
          "Interval": 2,
          "Retry": 3,
          "Sip": "192.168.0.50",
          "Enable": "true",
          "Policy": "revoke_route"
        },
        "VpnBgpConfig": {
          "Status": "success",
          "PeerBgpIp": "169.254.10.1",
          "TunnelCidr": "169.254.10.0/30",
          "LocalBgpIp": "169.254.10.2",
          "PeerAsn": 65530,
          "LocalAsn": 65531,
          "AuthKey": "AuthKey****"
        },
        "AttachType": "CEN",
        "NetworkType": "public",
        "AttachInstanceId": "cen-lxxpbpalc776qz****",
        "Spec": "1000M",
        "State": "attached",
        "TransitRouterId": "tr-p0we2edef9qr44a85****",
        "TransitRouterName": "nametest",
        "CrossAccountAuthorized": false,
        "InternetIp": "10.XX.XX.10",
        "Tag": {
          "Tag": [
            {
              "Key": "TagKey",
              "Value": "TagValue"
            }
          ]
        },
        "TunnelOptionsSpecification": {
          "TunnelOptions": [
            {
              "TunnelId": "tun-opsqc4d97wni27****",
              "CustomerGatewayId": "cgw-p0wy363lucf1uyae8****",
              "EnableDpd": "true",
              "EnableNatTraversal": "true",
              "InternetIp": "47.21.XX.XX",
              "RemoteCaCertificate": "-----BEGIN CERTIFICATE----- MIIB7zCCAZW**** -----END CERTIFICATE-----",
              "Role": "master",
              "TunnelIndex": 1,
              "State": "active",
              "Status": "ipsec_sa_established",
              "TunnelBgpConfig": {
                "BgpStatus": "success",
                "LocalAsn": "65530",
                "LocalBgpIp": "169.254.10.1",
                "PeerAsn": "65531",
                "PeerBgpIp": "169.254.10.2",
                "TunnelCidr": "169.254.10.0/30"
              },
              "TunnelIkeConfig": {
                "IkeAuthAlg": "sha1",
                "IkeEncAlg": "aes",
                "IkeLifetime": "86400",
                "IkeMode": "main",
                "IkePfs": "group2",
                "IkeVersion": "ikev1",
                "LocalId": "47.21.XX.XX",
                "Psk": "123456****",
                "RemoteId": "47.42.XX.XX"
              },
              "TunnelIpsecConfig": {
                "IpsecAuthAlg": "sha1",
                "IpsecEncAlg": "aes",
                "IpsecLifetime": "86400",
                "IpsecPfs": "group2"
              },
              "ZoneNo": "ap-southeast-5a"
            }
          ]
        },
        "EnableTunnelsBgp": true,
        "ResourceGroupId": "rg-acfmzs372yg****",
        "TunnelBandwidth": "Standard"
      }
    ]
  }
}

Error codes

HTTP status code	Error code	Error message	Description
400	Forbidden.TagKey.Duplicated	The specified tag key already exists.	The tag resources are duplicate.
400	SizeLimitExceeded.TagNum	The maximum number of tags is exceeded.	The number of tags has reached the upper limit.
400	InvalidParameter.TagValue	The specified parameter TagValue is invalid.	The error message returned because the specified tag value is invalid.
400	InvalidParameter.TagKey	The specified parameter TagKey is invalid.	The error message returned because the specified tag key is invalid.
400	Duplicated.TagKey	The specified parameter TagKey is duplicated.	The error message returned because the specified tag key already exists.
403	Forbbiden.SubUser	User not authorized to operate on the specified resource as your account is created by another user.
403	Forbidden	User not authorized to operate on the specified resource.	You do not have the permissions to manage the specified resource. Apply for the permissions and try again.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.