Use DownloadVpnConnectionConfig to query IPsec-VPN connection configuration - VPN Gateway - Alibaba Cloud - VPN Gateway

Retrieves the configuration of an IPsec-VPN connection by calling the DownloadVpnConnectionConfig operation.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

vpc:DownloadVpnConnectionConfig

get

*VpnConnection

acs:vpc:{#regionId}:{#accountId}:vpnconnection/{#VpnConnectionId}

None

Request parameters

Parameter	Type	Required	Description	Example
RegionId	string	Yes	The region ID of the IPsec-VPN connection. You can call DescribeRegions to query the region ID.	cn-shanghai
VpnConnectionId	string	Yes	The ID of the IPsec-VPN connection.	vco-bp1bbi27hojx80nck****

Response elements

Element	Type	Description	Example
	object	The response parameters.
RequestId	string	The request ID.	0C68048B-0F70-40DA-B8AE-1B79B5CF62E3
VpnConnectionConfig	object	The configuration of the peer gateway device of the IPsec-VPN connection.
Remote	string	The identifier of the VPN gateway.	116.62.XX.XX
Local	string	The identifier of the customer gateway.	139.196.XX.XX
RemoteSubnet	string	The CIDR block on the VPC side.	192.168.0.0/16
LocalSubnet	string	The CIDR block on the on-premises data center side.	10.0.0.0/8
IkeConfig	object	The configuration of Phase 1 negotiation.
RemoteId	string	The identifier of the VPN gateway. FQDN and IP formats are supported. The default value is the IP address of the VPN gateway.	116.62.XX.XX
IkeLifetime	integer	The IKE phase lifetime. Unit: seconds.	86400
IkeEncAlg	string	The encryption algorithm in the IKE phase.	aes
LocalId	string	The identifier of the customer gateway. FQDN and IP formats are supported. The default value is the IP address of the customer gateway.	139.196.XX.XX
IkeMode	string	The IKE negotiation mode. main: Main mode. The negotiation process is highly secure. aggressive: Aggressive mode. The negotiation is fast and has a high success rate.	main
IkeVersion	string	The version of the IKE protocol.	ikev2
IkePfs	string	The DH group in the IKE phase.	group2
Psk	string	The pre-shared key.	pgw6dy7d1i8i****
IkeAuthAlg	string	The authentication algorithm in the IKE phase.	sha1
IpsecConfig	object	The configuration of Phase 2 negotiation.
IpsecAuthAlg	string	The authentication algorithm in the IPsec phase.	sha1
IpsecEncAlg	string	The encryption algorithm in the IPsec phase.	aes
IpsecLifetime	integer	The IPsec phase lifetime. Unit: seconds.	86400
IpsecPfs	string	The DH group in the IPsec phase.	group2
TunnelsConfig	object
TunnelConfig	array<object>	The tunnel configuration of the peer gateway device of the IPsec-VPN connection. The parameters in the TunnelsConfig array are returned only for dual-tunnel IPsec-VPN connections.
	array<object>	The tunnel configuration.
TunnelId	string	The tunnel ID.	tun-opsqc4d97wni27****
Local	string	The identifier of the tunnel on the on-premises data center side.	47.21.XX.XX
Remote	string	The identifier of the tunnel on the Alibaba Cloud side.	47.24.XX.XX
IkeConfig	object	The configuration of Phase 1 negotiations.
Psk	string	The pre-shared key.	pgw6dy7d1i8i****
IkeVersion	string	The version of the IKE protocol.	ikev2
IkeMode	string	The IKE negotiation mode. main: Main mode. The negotiation process is highly secure. aggressive: Aggressive mode. The negotiation is fast and has a high success rate.	main
IkeEncAlg	string	The encryption algorithm in the IKE phase.	aes
IkeAuthAlg	string	The authentication algorithm in the IKE phase.	sha1
IkePfs	string	The DH group in the IKE phase.	group2
IkeLifetime	integer	The IKE phase lifetime. Unit: seconds.	86400
LocalId	string	The identifier of the tunnel on the on-premises data center side.	47.21.XX.XX
RemoteId	string	The identifier of the tunnel on the Alibaba Cloud side.	47.24.XX.XX
IpsecConfig	object	The configuration of Phase 2 negotiations.
IpsecAuthAlg	string	The authentication algorithm in the IPsec phase.	sha1
IpsecEncAlg	string	The encryption algorithm in the IPsec phase.	aes
IpsecPfs	string	The DH group in the IPsec phase.	group2
IpsecLifetime	integer	The IPsec phase lifetime. Unit: seconds.	86400
BgpConfigs	object
BgpConfig	array<object>	The BGP configuration.
	object	The BGP configuration.
LocalAsn	string	The autonomous system number of the on-premises data center.	1219002
LocalBgpIp	string	The BGP address on the on-premises data center side.	169.254.20.2
PeerAsn	string	The autonomous system number on the Alibaba Cloud side.	1219001
PeerBgpIp	string	The BGP address on the Alibaba Cloud side.	169.254.20.1
TunnelCidr	string	The BGP CIDR block of the tunnel.	169.254.20.0/30
TunnelId	string	The tunnel ID.	tun-900ghtunmhp75r14wh

Examples

Success response

JSON format

{
  "RequestId": "0C68048B-0F70-40DA-B8AE-1B79B5CF62E3",
  "VpnConnectionConfig": {
    "Remote": "116.62.XX.XX",
    "Local": "139.196.XX.XX",
    "RemoteSubnet": "192.168.0.0/16",
    "LocalSubnet": "10.0.0.0/8",
    "IkeConfig": {
      "RemoteId": "116.62.XX.XX",
      "IkeLifetime": 86400,
      "IkeEncAlg": "aes",
      "LocalId": "139.196.XX.XX",
      "IkeMode": "main",
      "IkeVersion": "ikev2",
      "IkePfs": "group2",
      "Psk": "pgw6dy7d1i8i****",
      "IkeAuthAlg": "sha1"
    },
    "IpsecConfig": {
      "IpsecAuthAlg": "sha1",
      "IpsecEncAlg": "aes",
      "IpsecLifetime": 86400,
      "IpsecPfs": "group2"
    },
    "TunnelsConfig": {
      "TunnelConfig": [
        {
          "TunnelId": "tun-opsqc4d97wni27****",
          "Local": "47.21.XX.XX",
          "Remote": "47.24.XX.XX",
          "IkeConfig": {
            "Psk": "pgw6dy7d1i8i****",
            "IkeVersion": "ikev2",
            "IkeMode": "main",
            "IkeEncAlg": "aes",
            "IkeAuthAlg": "sha1",
            "IkePfs": "group2",
            "IkeLifetime": 86400,
            "LocalId": "47.21.XX.XX",
            "RemoteId": "47.24.XX.XX"
          },
          "IpsecConfig": {
            "IpsecAuthAlg": "sha1",
            "IpsecEncAlg": "aes",
            "IpsecPfs": "group2",
            "IpsecLifetime": 86400
          }
        }
      ]
    },
    "BgpConfigs": {
      "BgpConfig": [
        {
          "LocalAsn": "1219002",
          "LocalBgpIp": "169.254.20.2",
          "PeerAsn": "1219001",
          "PeerBgpIp": "169.254.20.1",
          "TunnelCidr": "169.254.20.0/30",
          "TunnelId": "tun-900ghtunmhp75r14wh"
        }
      ]
    }
  }
}

Error codes

HTTP status code	Error code	Error message	Description
403	Forbbiden.SubUser	User not authorized to operate on the specified resource as your account is created by another user.
403	Forbidden	User not authorized to operate on the specified resource.	You do not have the permissions to manage the specified resource. Apply for the permissions and try again.
404	InvalidVpnConnectionInstanceId.NotFound	The specified vpn connection instance id does not exist.	The specified vpn connection instance id does not exist.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.