All Products
Search

This Product

    VPN Gateway:GetVpnGatewayDiagnoseResult

    Document Center

    VPN Gateway:GetVpnGatewayDiagnoseResult

    Last Updated:Aug 07, 2026

    Queries the one-click diagnosis result of a VPN gateway instance.

    Operation description

    When you call the GetVpnGatewayDiagnoseResult operation, in addition to the required parameters, you must specify at least one of the DiagnoseId and VpnGatewayId parameters.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    vpc:GetVpnGatewayDiagnoseResult

    get

    *VpnGateway

    acs:vpc:{#regionId}:{#accountId}:vpngateway/{#VpnInstanceId}

    		 None None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    RegionId

    string

    Yes

    The region ID of the VPN gateway instance.

    You can call the DescribeRegions operation to query the region ID.

    cn-qingdao
    DiagnoseId

    string

    No

    The diagnosis ID.

    When you call the DiagnoseVpnGateway operation, the system returns the corresponding diagnosis ID.

    vpndgn-uf6kuxbe3iv028k3s****
    VpnGatewayId

    string

    No

    The VPN gateway instance ID.

    vpn-uf6fzwp0ck3frwtbk****
    ClientToken

    string

    No

    The client token that is used to ensure the idempotence of the request.

    You can use the client to generate the token, but you must make sure that the token is unique among different requests. The client token can contain only ASCII characters.

    Note

    If you do not specify this parameter, the system uses the RequestId of the API request as the ClientToken. The RequestId may be different for each API request.

    02fb3da4-130e-11e9-8e44-001****

    Response elements

    Element

    Type

    Description

    Example

    object

    The response parameters.

    BeginTime

    string

    The time when the diagnosis started.

    The time is displayed in UTC in the YYYY-MM-DDThh:mm:ssZ format.

    2022-12-15T05:28:57Z
    DiagnoseId

    string

    The diagnosis ID.

    vpndgn-uf6sgneym02lxyuv4****
    DiagnoseResult

    array<object>

    The list of diagnosis items.

    object

    The diagnosis item information.

    DiagnoseName

    string

    The diagnosis item.

    • RouteEntryConflict: route conflict.

    • VpnRouteQuota: VPN gateway destination route quota.

    • VpnIPsecQuota: VPN gateway IPsec-VPN connection quota.

    • VpnPbrRouteQuota: VPN gateway policy-based route quota.

    • VcoConfigConsistency: IPsec configuration consistency.

    • VcoUserInternetIpConnectivity: public network connectivity of the customer gateway.

    • VcoPrivateConnectivity: private network connectivity.

    For more information about each diagnosis item, see Background information about one-click diagnosis.

    RouteEntryConflict
    DiagnoseResultDescription

    string

    The diagnosis result of the diagnosis item.

    The operation returns different information for each diagnosis item:

    • RouteEntryConflict: The system returns information about the route conflict.

    • VpnRouteQuota:

      • quotaName: The destination route quota ID.

      • quantity: The number of destination routes that the current VPN gateway instance supports.

      • used: The number of destination routes that have been created for the current VPN gateway instance.

    • VpnIPsecQuota:

      • quotaName: The IPsec-VPN connection quota ID.

      • quantity: The number of IPsec-VPN connections that the current VPN gateway instance supports.

      • used: The number of IPsec-VPN connections that have been created for the current VPN gateway instance.

    • VpnPbrRouteQuota:

      • quotaName: The policy-based route quota ID.

      • quantity: The number of policy-based routes that the current VPN gateway instance supports.

      • used: The number of policy-based routes that have been created for the current VPN gateway instance.

    • VcoConfigConsistency:

      • vcoLackConf: The system cannot obtain the configuration of the peer end of the IPsec-VPN connection.

      • vcoRunningConf: The configuration that has been added to the peer end of the IPsec-VPN connection.

      • vcoDiffConf: The list of configurations that are inconsistent between the local end and the peer end of the IPsec-VPN connection.

      • vcoConf: The configuration that has been added to the local end of the IPsec-VPN connection.

    • VcoUserInternetIpConnectivity:

      • targetIp: The public IP address of the customer gateway.

      • rtt: The latency when the system accesses the public IP address of the customer gateway. Unit: ms.

      • lossRate: The packet loss rate when the system accesses the public IP address of the customer gateway.

    • VcoPrivateConnectivity:

      • targetIp: The source IP address.

      • srcIp: The destination IP address.

      • rtt: The latency when the source IP address accesses the destination IP address. Unit: ms.

      • lossRate: The packet loss rate when the source IP address accesses the destination IP address.

    {\"targetIp\":\"192.168.0.1\",\"srcIp\":\"192.168.1.1\",\"rtt\":-1.0,\"lossRate\":100.0}
    DiagnoseResultLevel

    string

    The diagnosis result level of the diagnosis item.

    • normal: Normal.

    • warning: Warning.

    • error: Error.

    For more information about the diagnosis result levels of each diagnosis item, see Background information about one-click diagnosis.

    normal
    FinishTime

    string

    The time when the diagnosis ended.

    The time is displayed in UTC in the YYYY-MM-DDThh:mm:ssZ format.

    2022-12-15T05:29:08Z
    FinishedCount

    integer

    The number of diagnosis items that have been completed.

    7
    RequestId

    string

    The request ID.

    312C4D5A-6563-5FC6-8C6E-A43A5A316FEB
    ResourceInstanceId

    string

    The ID of the diagnosed resource.

    vco-uf6huqsu63azl7mdp****
    ResourceType

    string

    The type of the diagnosed resource.

    Valid values: IPsec, which indicates an IPsec-VPN connection.

    IPsec
    TotalCount

    integer

    The total number of diagnosis items.

    7
    VpnGatewayId

    string

    The VPN gateway instance ID.

    vpn-uf6fzwp0ck3frwtbk****

    Examples

    Success response

    JSON format

    {
  "BeginTime": "2022-12-15T05:28:57Z",
  "DiagnoseId": "vpndgn-uf6sgneym02lxyuv4****",
  "DiagnoseResult": [
    {
      "DiagnoseName": "RouteEntryConflict",
      "DiagnoseResultDescription": "{\\\"targetIp\\\":\\\"192.168.0.1\\\",\\\"srcIp\\\":\\\"192.168.1.1\\\",\\\"rtt\\\":-1.0,\\\"lossRate\\\":100.0}",
      "DiagnoseResultLevel": "normal"
    }
  ],
  "FinishTime": "2022-12-15T05:29:08Z",
  "FinishedCount": 7,
  "RequestId": "312C4D5A-6563-5FC6-8C6E-A43A5A316FEB",
  "ResourceInstanceId": "vco-uf6huqsu63azl7mdp****",
  "ResourceType": "IPsec",
  "TotalCount": 7,
  "VpnGatewayId": "vpn-uf6fzwp0ck3frwtbk****"
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 param_error The param is must be in ...
    400 MissingParam.DiagnoseInfo The VPN gateway ID and diagnose ID cannot be empty at the same time.
    400 VpnGateway.Configuring The specified service is configuring.
    400 IncorrectStatus.DiagnoseTimeout Diagnose failed because of timeout.
    400 IncorrectStatus.VpnConnectionDeleted Diagnose failed because the VPN connection has been deleted.
    403 Forbidden User not authorized to operate on the specified resource. You do not have the permissions to manage the specified resource. Apply for the permissions and try again.
    404 InvalidDiagnoseId.NotFound The specified diagnose ID [%s] does not exist.
    404 InvalidVpnGatewayId.NotFound The specified VPN gateway [%s] does not have any diagnoses.
    404 InvalidVpnGatewayInstanceId.NotFound The specified vpn gateway instance id does not exist.

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.