Modify the configuration of an IPsec-VPN connection by using ModifyVpnAttachmentAttribute - VPN Gateway - Alibaba Cloud - VPN Gateway

Modifies the configuration of an IPsec-VPN connection.

Operation description

When you modify a dual-tunnel IPsec-VPN connection, in addition to the required parameters, the following request parameters are supported: ClientToken, Name, LocalSubnet, RemoteSubnet, EffectImmediately, the TunnelOptionsSpecification array, and EnableTunnelsBgp.
When you modify a single-tunnel IPsec-VPN connection, in addition to the required parameters, the following request parameters are supported: ClientToken, Name, LocalSubnet, RemoteSubnet, EffectImmediately, IkeConfig, IpsecConfig, HealthCheckConfig, EnableDpd, EnableNatTraversal, BgpConfig, and CustomerGatewayId.
The ModifyVpnAttachmentAttribute operation is asynchronous. After a request is sent, the system returns a request ID. However, the IPsec-VPN connection configuration has not been modified. The modification task is still running in the background. You can call DescribeVpnConnection to query the modification status of the IPsec-VPN connection configuration:
- If the IPsec-VPN connection is in the updating state, the configuration is being modified.
- If the IPsec-VPN connection is in the attached state, the configuration has been modified.
The ModifyVpnAttachmentAttribute operation does not support concurrent modifications to the IPsec-VPN connection configuration.
When you call the ModifyVpnAttachmentAttribute operation, you cannot modify the gateway type of the IPsec-VPN connection.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

vpc:ModifyVpnAttachmentAttribute

update

*VpnConnections

acs:vpc:{#regionId}:{#accountId}:vpnconnection/{#VpnConnectionId}

None

Request parameters

Parameter	Type	Required	Description	Example
RegionId	string	Yes	The region ID of the IPsec-VPN connection. You can call the DescribeRegions operation to query region IDs.	cn-hangzhou
VpnConnectionId	string	Yes	The ID of the IPsec-VPN connection.	vco-p0w5112fgnl2ihlmf****
Name	string	No	The name of the IPsec-VPN connection. The name must be 1 to 100 characters in length and cannot start with `http://` or `https://`.	nametest
LocalSubnet	string	No	The CIDR block on the VPC side that needs to communicate with the on-premises data center. This is used for Phase 2 negotiation. Separate multiple CIDR blocks with commas (,). Example: 192.168.1.0/24,192.168.2.0/24. Description of the IPsec-VPN connection routing mode: If both LocalSubnet and RemoteSubnet are set to 0.0.0.0/0, the destination routing mode is used. If both LocalSubnet and RemoteSubnet are set to specific CIDR blocks, the protected data flow mode is used.	10.1.1.0/24,10.1.2.0/24
RemoteSubnet	string	No	The CIDR block on the on-premises data center side that needs to communicate with the VPC. This parameter is used for Phase 2 negotiation.	10.1.3.0/24,10.1.4.0/24
EffectImmediately	boolean	No	Specifies whether the configuration of the IPsec-VPN connection takes effect immediately. Valid values:	false
IkeConfig	string	No	This parameter is supported when you modify a single-tunnel IPsec-VPN connection.	{"Psk":"1234****","IkeVersion":"ikev1","IkeMode":"main","IkeEncAlg":"aes","IkeAuthAlg":"sha1","IkePfs":"group2","IkeLifetime":86400,"LocalId":"47.XX.XX.1","RemoteId":"47.XX.XX.2"}
IpsecConfig	string	No	This parameter is supported when you modify an IPsec-VPN connection in single-tunnel mode. The configuration of Phase 2 negotiation: IpsecConfig.IpsecEncAlg: The encryption algorithm used in Phase 2 negotiation. Valid values: aes, aes192, aes256, des, or 3des. IpsecConfig.IpsecAuthAlg: The authentication algorithm used in Phase 2 negotiation. Valid values: md5, sha1, sha256, sha384, or sha512. IpsecConfig.IpsecPfs: The Diffie-Hellman key exchange algorithm used in Phase 2 negotiation. Valid values: disabled, group1, group2, group5, or group14. IpsecConfig.IpsecLifetime: The lifetime of the SA negotiated in Phase 2. Unit: seconds. Valid values: 0 to 86400.	{"IpsecEncAlg":"aes","IpsecAuthAlg":"sha1","IpsecPfs":"group2","IpsecLifetime":86400}
BgpConfig	string	No	This parameter is supported when you modify an IPsec-VPN connection in single-tunnel mode. BGP configuration: BgpConfig.EnableBgp: specifies whether to enable BGP. Valid values: true: Enable BGP. false: Disable BGP. BgpConfig.LocalAsn: the autonomous system number (ASN) on the Alibaba Cloud side. Valid values: 1 to 4294967295. You can enter the ASN in the two-segment notation: the first 16 bits.the last 16 bits. Each segment is entered in decimal format. For example, if you enter 123.456, the ASN is 123 × 65536 + 456 = 8061384. BgpConfig.TunnelCidr: the CIDR block of the IPsec tunnel. The CIDR block must be a /30 CIDR block within 169.254.0.0/16 and cannot be 169.254.0.0/30, 169.254.1.0/30, 169.254.2.0/30, 169.254.3.0/30, 169.254.4.0/30, 169.254.5.0/30, 169.254.6.0/30, or 169.254.169.252/30. LocalBgpIp: the BGP IP address on the Alibaba Cloud side. This address must be an IP address within the CIDR block of the IPsec tunnel. Note Before you configure BGP, we recommend that you learn about how BGP dynamic routing works and its limits. For more information, see Configure BGP dynamic routing. We recommend that you use a private ASN to establish a BGP connection with Alibaba Cloud. For the range of private ASNs, refer to the relevant documentation.	{"EnableBgp":"true","LocalAsn":"45104","TunnelCidr":"169.254.11.0/30","LocalBgpIp":"169.254.11.1"}
HealthCheckConfig	string	No	This parameter is supported when you modify a single-tunnel IPsec-VPN connection.	{"enable":"true","dip":"192.168.1.1","sip":"10.1.1.1","interval":"3","retry":"3","Policy": "revoke_route"}
AutoConfigRoute	boolean	No	Specifies whether to automatically configure routes. Valid values: true: automatically configures routes. false: does not automatically configure routes.	true
EnableDpd	boolean	No	This parameter is supported when you modify a single-tunnel IPsec-VPN connection. Specifies whether to enable the Dead Peer Detection (DPD) feature. Valid values: true: Enables the DPD feature. The IPsec initiator sends DPD packets to check whether the peer device is alive. If no correct response is received within the specified period of time, the peer is considered disconnected. The ISAKMP SA and the corresponding IPsec SA are deleted, and the security tunnel is also deleted. false: Disables the DPD feature. The IPsec initiator does not send DPD probe packets.	true
EnableNatTraversal	boolean	No	This parameter is supported when you modify an IPsec-VPN connection in single-tunnel mode. Specifies whether to enable NAT traversal. Valid values: true: Enable NAT traversal. After NAT traversal is enabled, the IKE negotiation process skips UDP port number verification and can discover NAT gateway devices in the VPN tunnel. false: Disable NAT traversal.	true
RemoteCaCert	string	No	The CA certificate of the peer.	-----BEGIN CERTIFICATE----- MIIB7zCCAZW**** -----END CERTIFICATE-----
ClientToken	string	No	The client token that is used to ensure the idempotence of the request. You can use the client to generate the token, but you must make sure that the token is unique among different requests. The token can contain only ASCII characters. Note If you do not specify this parameter, the system automatically uses the RequestId of the API request as the ClientToken. The RequestId of each API request is different.	123e4567-e89b-12d3-a456-4266****
NetworkType	string	No	The network type of the IPsec-VPN connection. Valid values: public: The IPsec-VPN connection establishes an encrypted communication channel over the Internet. private: The IPsec-VPN connection establishes an encrypted communication channel over a private network.	public
CustomerGatewayId	string	No	The customer gateway instance associated with the IPsec-VPN connection.	cgw-p0w2jemrcj5u61un8****
TunnelOptionsSpecification	array<object>	No	The tunnel configurations. The parameters in the TunnelOptionsSpecification array are supported only when you modify an IPsec-VPN connection in dual-tunnel mode. You can modify the configurations of both tunnels of the IPsec-VPN connection at the same time.
	array<object>	No	The tunnel configuration information.
TunnelId	string	No	The tunnel ID.	tun-0jod7plwf2a0o9lvu****
CustomerGatewayId	string	No	The ID of the customer gateway associated with the tunnel.	cgw-p0w2jemrcj5u61un8****
TunnelIndex	integer	No	The creation order of the tunnel.	1
EnableDpd	boolean	No	Specifies whether to enable the Dead Peer Detection (DPD) feature for the tunnel. Valid values:	true
EnableNatTraversal	boolean	No	Specifies whether to enable NAT traversal for the tunnel. Valid values: true: Enables NAT traversal. After NAT traversal is enabled, the IKE negotiation process skips UDP port number verification and can discover NAT gateway devices along the tunnel. false: Disables NAT traversal.	true
TunnelBgpConfig	object	No	Adds BGP configurations for the tunnel. Note Configure this parameter after you enable BGP for the IPsec-VPN connection (that is, set EnableTunnelsBgp to true).
LocalAsn	integer	No	The autonomous system number (ASN) on the Alibaba Cloud side of the tunnel. Valid values: 1 to 4294967295. Default value: 45104. Note Use a private ASN to establish a BGP connection with Alibaba Cloud. For the range of private ASNs, refer to the relevant documentation.	65530
LocalBgpIp	string	No	The BGP address on the Alibaba Cloud side. This address is an IP address within the BGP CIDR block.	169.254.10.1
TunnelCidr	string	No	The BGP CIDR block of the tunnel. The CIDR block must be a CIDR block with a mask length of 30 within 169.254.0.0/16 and cannot be 169.254.0.0/30, 169.254.1.0/30, 169.254.2.0/30, 169.254.3.0/30, 169.254.4.0/30, 169.254.5.0/30, 169.254.6.0/30, or 169.254.169.252/30.	169.254.10.0/30
TunnelIkeConfig	object	No	The Phase 1 negotiation configuration.
IkeAuthAlg	string	No	The authentication algorithm for Phase 1 negotiation. Valid values: md5, sha1, sha256, sha384, and sha512.	sha1
IkeEncAlg	string	No	The encryption algorithm for Phase 1 negotiation. Valid values: aes, aes192, aes256, des, and 3des.	aes
IkeLifetime	integer	No	The lifetime of the SA generated by Phase 1 negotiation. Unit: seconds.	86400
IkeMode	string	No	The negotiation mode of the IKE version. Valid values: main and aggressive. main: Main mode. The negotiation process is highly secure. aggressive: Aggressive mode. The negotiation is fast and has a high success rate.	main
IkePfs	string	No	The Diffie-Hellman key exchange algorithm used in the first-phase negotiation. Valid values: group1, group2, group5, group14.	group2
IkeVersion	string	No	The version of the IKE protocol. Valid values: ikev1 and ikev2.	ikev2
LocalId	string	No	The identifier on the Alibaba Cloud side for the tunnel, used for Phase 1 negotiation. The value can be up to 100 characters in length and cannot contain spaces.	47.XX.XX.1
Psk	string	No	The pre-shared key, which is used for identity authentication between the tunnel and the tunnel peer. The key must be 1 to 100 characters in length and can contain digits, uppercase letters, lowercase letters, and the following characters. It cannot contain spaces. ~!\`@#$%^&()_-+={}[]\|;:',.<>/? If you do not specify a pre-shared key, the system randomly generates a 16-character string as the pre-shared key. You can call the DescribeVpnAttachments operation to query the pre-shared key automatically generated by the system. Note* The pre-shared keys of the tunnel and the tunnel peer must be the same. Otherwise, the tunnel cannot be established.	123456****
RemoteId	string	No	The identifier of the tunnel peer, used for Phase 1 negotiation. The value can be up to 100 characters in length and cannot contain spaces.	47.XX.XX.2
TunnelIpsecConfig	object	No	The Phase 2 negotiation configuration.
IpsecAuthAlg	string	No	The authentication algorithm used in Phase 2 negotiations. Valid values: md5, sha1, sha256, sha384, sha512.	sha1
IpsecEncAlg	string	No	The encryption algorithm for Phase 2 negotiation. Valid values: aes, aes192, aes256, des, and 3des.	aes
IpsecLifetime	integer	No	The lifetime of the SA generated by Phase 2 negotiation. Unit: seconds.	86400
IpsecPfs	string	No	The Diffie-Hellman key exchange algorithm used in the second phase of negotiation. Valid values: disabled, group1, group2, group5, group14.	group2
EnableTunnelsBgp	boolean	No	This parameter is supported when you modify an IPsec-VPN connection in dual-tunnel mode. Specifies whether to enable BGP for the tunnel. Valid values: true or false. Note Before you add BGP configurations, we recommend that you understand the working mechanism and limits of BGP dynamic routing. For more information, see Configure BGP dynamic routing.	false

Response elements

Element	Type	Description	Example
	object	The response parameters.
VpnConnectionId	string	The ID of the IPsec-VPN connection.	vco-p0w5112fgnl2ihlmf****
CustomerGatewayId	string	The ID of the customer gateway associated with the IPsec-VPN connection.	cgw-p0w2jemrcj5u61un8****
VpnGatewayId	string	The ID of the VPN gateway instance associated with the IPsec-VPN connection. vpn-not-exist: The IPsec-VPN connection is not associated with a VPN gateway instance.	vpn-not-exist
Name	string	The name of the IPsec-VPN connection.	nametest
Description	string	The description of the IPsec-VPN connection.	desctest
LocalSubnet	string	The CIDR block on the Alibaba Cloud side that needs to communicate with the on-premises data center, such as the VPC CIDR block.	10.1.1.0/24,10.1.2.0/24
RemoteSubnet	string	The CIDR block on the on-premises data center side that needs to communicate with Alibaba Cloud.	10.1.3.0/24,10.1.4.0/24
IkeConfig	object	The configuration of Phase 1 negotiations. Parameters in the IkeConfig array are returned only for IPsec-VPN connections in single-tunnel mode.
Psk	string	The pre-shared key, which is used for identity authentication between the Alibaba Cloud IPsec-VPN connection and the on-premises data center. Note The pre-shared key on the IPsec-VPN connection side must be the same as the authentication key on the on-premises data center side. Otherwise, a connection cannot be established between the on-premises data center and the VPN gateway.	1234***
IkeVersion	string	The IKE protocol version. ikev1 ikev2 Compared with IKEv1, IKEv2 simplifies the SA negotiation process and provides better support for multi-CIDR-block scenarios.	ikev1
IkeMode	string	The IKE negotiation mode. main: Main mode. The negotiation process provides high security. aggressive: Aggressive mode. Negotiations are fast and have a high success rate.	main
IkeEncAlg	string	The encryption algorithm for Phase 1 negotiation.	aes
IkeAuthAlg	string	The authentication algorithm for Phase 1 negotiation.	sha1
IkePfs	string	The Diffie-Hellman key exchange algorithm used in Phase 1 negotiation.	group2
IkeLifetime	integer	The lifetime of the SA generated by Phase 1 negotiation. Unit: seconds.	86400
LocalId	string	The identifier on the Alibaba Cloud side of the IPsec-VPN connection.	47.XX.XX.1
RemoteId	string	The identifier on the on-premises data center side of the IPsec-VPN connection.	47.XX.XX.2
IpsecConfig	object	The configuration of Phase 2 negotiations. Parameters in the IpsecConfig array are returned only for IPsec-VPN connections in single-tunnel mode.
IpsecEncAlg	string	The encryption algorithm for Phase 2 negotiation.	aes
IpsecAuthAlg	string	The authentication algorithm for Phase 2 negotiation.	md5
IpsecPfs	string	The Diffie-Hellman key exchange algorithm used in Phase 2 negotiation.	group2
IpsecLifetime	integer	The lifetime of the SA generated by Phase 2 negotiation. Unit: seconds.	86400
CreateTime	integer	The timestamp when the IPsec-VPN connection was created. Unit: milliseconds. The timestamp is in the Unix timestamp format, which represents the total number of milliseconds that have elapsed since January 1, 1970, 00:00:00 (UTC) to the time when the IPsec-VPN connection was created.	1658201810000
EffectImmediately	boolean	Indicates whether the IPsec-VPN connection configuration takes effect immediately.	false
Status	string	The status of the IPsec-VPN connection. ike_sa_not_established: Phase 1 negotiation failed. ike_sa_established: Phase 1 negotiation succeeded. ipsec_sa_not_established: Phase 2 negotiation failed. ipsec_sa_established: Phase 2 negotiation succeeded.	ike_sa_not_established
VcoHealthCheck	object	The health check configuration of the IPsec-VPN connection. The parameters in the VcoHealthCheck array are returned only for IPsec-VPN connections in single-tunnel mode.
Enable	string	Indicates whether the health check feature is enabled for the IPsec-VPN connection.	true
Sip	string	The source IP address of the health check.	10.1.1.1
Dip	string	The destination IP address of the health check.	192.168.1.1
Interval	integer	The retry interval of the health check. Unit: seconds.	3
Retry	integer	The number of retry packets sent for the health check.	3
Policy	string	Specifies whether to withdraw published routes when the health check fails. revoke_route: Withdraws published routes. reserve_route: Does not withdraw published routes.	revoke_route
EnableDpd	boolean	Indicates whether the Dead Peer Detection (DPD) feature is enabled for the IPsec-VPN connection. true: Enabled. false: Not enabled. This parameter is returned only for IPsec-VPN connections in single-tunnel mode.	true
EnableNatTraversal	boolean	Indicates whether NAT traversal is enabled for the IPsec-VPN connection. true: Enabled. false: Not enabled. This parameter is returned only for IPsec-VPN connections in single-tunnel mode.	true
VpnBgpConfig	object	The BGP configuration of the IPsec-VPN connection.
EnableBgp	string	Indicates whether the BGP feature is enabled for the IPsec-VPN connection.	true
TunnelCidr	string	The IPsec tunnel CIDR block.	169.254.11.0/30
LocalBgpIp	string	The BGP IP address on the Alibaba Cloud side.	169.254.11.1
PeerBgpIp	string	The BGP IP address on the on-premises data center side.	169.254.11.2
LocalAsn	integer	The autonomous system number on the Alibaba Cloud side.	45104
PeerAsn	integer	The autonomous system number on the on-premises data center side.	65535
Status	string	The BGP negotiation status.	false
AttachType	string	The type of resource associated with the IPsec-VPN connection.	CEN
NetworkType	string	The network type of the IPsec-VPN connection.	public
AttachInstanceId	string	The instance ID of the Cloud Enterprise Network (CEN) instance to which the forward routing vRouter instance attached to the IPsec-VPN connection belongs.	cen-c2r3m3zxkumoqz****
Spec	string	The bandwidth specification of the IPsec-VPN connection.	1000M
ResourceGroupId	string	The ID of the resource group to which the IPsec-VPN connection belongs. You can call the ListResourceGroups operation to query resource group information.	rg-acfmzs372yg****
TunnelOptionsSpecification	array<object>	The tunnel configuration of the IPsec-VPN connection.
	array<object>	The tunnel configuration information.
CustomerGatewayId	string	The ID of the customer gateway associated with the tunnel.	cgw-p0w2jemrcj5u61un8****
EnableDpd	boolean	Indicates whether the DPD feature is enabled for the tunnel.	true
EnableNatTraversal	boolean	Indicates whether the NAT traversal feature is enabled for the tunnel.	true
InternetIp	string	The gateway IP address on the Alibaba Cloud side of the tunnel.	47.XX.XX.66
Role	string	The role of the tunnel.	master
TunnelId	string	The tunnel ID.	tun-0jod7plwf2a0o9lvu****
TunnelIndex	integer	The creation order of the tunnel.	1
State	string	The status of the tunnel. active: Normal. updating: Being updated. deleting: Being deleted.	active
TunnelBgpConfig	object	The BGP configuration of the tunnel.
LocalAsn	integer	The autonomous system number on the local end (Alibaba Cloud side) of the tunnel.	65530
LocalBgpIp	string	The BGP address on the local end (Alibaba Cloud side) of the tunnel.	169.254.10.1
PeerAsn	integer	The autonomous system number on the peer end of the tunnel.	65531
PeerBgpIp	string	The BGP address on the peer end of the tunnel.	169.254.10.2
TunnelCidr	string	The BGP CIDR block of the tunnel.	169.254.10.0/30
TunnelIkeConfig	object	The Phase 1 negotiation configuration.
IkeAuthAlg	string	The authentication algorithm for the IKE phase.	sha1
IkeEncAlg	string	The encryption algorithm for the IKE phase.	aes
IkeLifetime	integer	The lifetime for the IKE phase. Unit: seconds.	86400
IkeMode	string	The negotiation mode of the IKE version. Valid values: main: Main mode. The negotiation process is highly secure. aggressive: Aggressive mode. The negotiation is fast and has a high success rate.	main
IkePfs	string	The DH group for the IKE phase.	group2
IkeVersion	string	The IKE protocol version.	ikev2
LocalId	string	The identifier on the local end (Alibaba Cloud side) of the tunnel.	47.XX.XX.1
Psk	string	The pre-shared key.	123456****
RemoteId	string	The identifier on the peer end of the tunnel.	47.XX.XX.2
TunnelIpsecConfig	object	The Phase 2 negotiation configuration.
IpsecAuthAlg	string	The authentication algorithm for the IPsec phase.	sha1
IpsecEncAlg	string	The encryption algorithm for the IPsec phase.	aes
IpsecLifetime	integer	The lifetime for the IPsec phase. Unit: seconds.	86400
IpsecPfs	string	The DH group for the IPsec phase.	group2
EnableTunnelsBgp	boolean	The BGP status of the tunnel. true: enabled. false: disabled. This parameter is returned only for IPsec-VPN connections in dual-tunnel mode.	false
RequestId	string	The request ID.	35822A84-867F-3936-A2E6-A4C4E3ED11C0

Examples

Success response

JSON format

{
  "VpnConnectionId": "vco-p0w5112fgnl2ihlmf****",
  "CustomerGatewayId": "cgw-p0w2jemrcj5u61un8****",
  "VpnGatewayId": "vpn-not-exist",
  "Name": "nametest",
  "Description": "desctest",
  "LocalSubnet": "10.1.1.0/24,10.1.2.0/24",
  "RemoteSubnet": "10.1.3.0/24,10.1.4.0/24",
  "IkeConfig": {
    "Psk": "1234***",
    "IkeVersion": "ikev1",
    "IkeMode": "main",
    "IkeEncAlg": "aes",
    "IkeAuthAlg": "sha1",
    "IkePfs": "group2",
    "IkeLifetime": 86400,
    "LocalId": "47.XX.XX.1",
    "RemoteId": "47.XX.XX.2"
  },
  "IpsecConfig": {
    "IpsecEncAlg": "aes",
    "IpsecAuthAlg": "md5",
    "IpsecPfs": "group2",
    "IpsecLifetime": 86400
  },
  "CreateTime": 1658201810000,
  "EffectImmediately": false,
  "Status": "ike_sa_not_established",
  "VcoHealthCheck": {
    "Enable": "true",
    "Sip": "10.1.1.1",
    "Dip": "192.168.1.1",
    "Interval": 3,
    "Retry": 3,
    "Policy": "revoke_route"
  },
  "EnableDpd": true,
  "EnableNatTraversal": true,
  "VpnBgpConfig": {
    "EnableBgp": "true",
    "TunnelCidr": "169.254.11.0/30",
    "LocalBgpIp": "169.254.11.1",
    "PeerBgpIp": "169.254.11.2",
    "LocalAsn": 45104,
    "PeerAsn": 65535,
    "Status": "false"
  },
  "AttachType": "CEN",
  "NetworkType": "public",
  "AttachInstanceId": "cen-c2r3m3zxkumoqz****",
  "Spec": "1000M",
  "ResourceGroupId": "rg-acfmzs372yg****",
  "TunnelOptionsSpecification": [
    {
      "CustomerGatewayId": "cgw-p0w2jemrcj5u61un8****",
      "EnableDpd": true,
      "EnableNatTraversal": true,
      "InternetIp": "47.XX.XX.66",
      "Role": "master",
      "TunnelId": "tun-0jod7plwf2a0o9lvu****",
      "TunnelIndex": 1,
      "State": "active",
      "TunnelBgpConfig": {
        "LocalAsn": 65530,
        "LocalBgpIp": "169.254.10.1",
        "PeerAsn": 65531,
        "PeerBgpIp": "169.254.10.2",
        "TunnelCidr": "169.254.10.0/30"
      },
      "TunnelIkeConfig": {
        "IkeAuthAlg": "sha1",
        "IkeEncAlg": "aes",
        "IkeLifetime": 86400,
        "IkeMode": "main",
        "IkePfs": "group2",
        "IkeVersion": "ikev2",
        "LocalId": "47.XX.XX.1",
        "Psk": "123456****",
        "RemoteId": "47.XX.XX.2"
      },
      "TunnelIpsecConfig": {
        "IpsecAuthAlg": "sha1",
        "IpsecEncAlg": "aes",
        "IpsecLifetime": 86400,
        "IpsecPfs": "group2"
      }
    }
  ],
  "EnableTunnelsBgp": false,
  "RequestId": "35822A84-867F-3936-A2E6-A4C4E3ED11C0"
}

Error codes

HTTP status code	Error code	Error message	Description
400	VpnConnection.Configuring	The specified service is configuring.	The service is being configured. Try again later.
400	VpnConnection.FinancialLocked	The specified service is financial locked.	The error message returned because the service is locked due to overdue payments.
400	InvalidName	The name is not valid
400	VpnRouteEntry.AlreadyExists	The specified route entry is already exist.	The route already exists.
400	VpnRouteEntry.Conflict	The specified route entry has conflict.	Route conflicts exist.
400	NotSupportVpnConnectionParameter.IpsecPfs	The specified vpn connection ipsec Ipsec Pfs is not support.	The PFS parameter set for the IPsec-VPN connection is not supported.
400	NotSupportVpnConnectionParameter.IpsecAuthAlg	The specified vpn connection ipsec Auth Alg is not support.	The authentication algorithm specified for the IPsec-VPN connection is not supported.
400	VpnRouteEntry.BackupRoute	Validate backup route entry failed.	Active/standby routes failed authentication.
400	VpnRouteEntry.InvalidWeight	Invalid route entry weight value.	The weight specified for the route is invalid.
400	MissingParameter.TunnelCidr	The parameter TunnelCidr is mandatory when BGP is enabled.	You must specify the tunnel CIDR block when you enable BGP.
400	OperationUnsupported.EnableBgp	Current region does not support enable BGP.	The error message returned because the current region does not support BGP.
400	MissingParam.CustomerGatewayAsn	Asn of customer gateway is mandatory when BGP is enabled.	The ASN of the customer gateway cannot be empty when you enable BGP.
400	IllegalParam.LocalAsn	The specified LocalAsn is invalid.	The local ASN is invalid.
400	IllegalParam.BgpConfig	The specified BgpConfig is invalid.	The BGP configuration is invalid.
400	IllegalParam.EnableBgp	VPN connection must enable BGP when VPN gateway has enabled BGP.	The error message returned because the VPN connection must use BGP if BGP is enabled for the VPN gateway.
400	IllegalParam.TunnelCidr	The specified TunnelCidr is invalid.	The TunnelCidr parameter is set to an invalid value.
400	InvalidLocalBgpIp.Malformed	The specified LocalBgpIp is malformed.	The local BGP IP address is in an abnormal state.
400	IllegalParam.LocalBgpIp	The specified LocalBgpIp is invalid.	The local BGP IP address is invalid.
400	IllegalParam.LocalSubnet	The specified "LocalSubnet" (%s) is invalid.	The specified "LocalSubnet" (%s) is invalid.
400	IllegalParam.RemoteSubnet	The specified "RemoteSubnet" (%s) is invalid.	The specified "RemoteSubnet" (%s) is invalid.
400	CustomerGateway.ConflictRouteEntry	The specified customer gateway has conflict with route entry.	The customer gateway conflicts with the current routes.
400	IllegalParam.NetworkType	The specified NetworkType (%s) is invalid.	The network type is invalid.
400	InvalidTunnelCidr.Malformed	The specified TunnelCidr is malformed.	The specified tunnel CIDR block is invalid.
400	VpnGateway.Configuring	The specified service is configuring.
400	VpnTask.CONFLICT	Vpn task has conflict.	The VPN operation conflicts. Try again later.
400	ModifyIkeV1WithMultiRoutes.Invalid	Failed to modify VPN connection parameters. Multi-network is configured while using IkeV1 protocol.	Failed to modify VPN connection parameters. Multi-network is configured while using IkeV1 protocol.
400	InvalidVpnGatewayInstanceId.NotFound	The specified vpn gateway instance id does not exist.	The specified VPN gateway does not exist. Check whether the specified VPN gateway is valid.
400	Resource.QuotaFull	The resources you are operating have reached the upper limit of the quota. Please increase the quota or use other solutions to avoid it according to the VPN operation document.	The resources you are operating have reached the upper limit of the quota. Please refer to the VPN operation document to increase the quota or use other schemes to avoid it.
400	CreateDbrRoutesQuotaFull.QuotaFull	The number of created destination routes exceeds the quota limit.	The number of created destination routes exceeds the quota limit.
400	CreatePbrRoutesQuotaFull.QuotaFull	The number of policy routes exceeds the quota limit.	The number of policy routes exceeds the quota limit.
400	EncAlgInvalid.DesIncompatible	Des/3des in IkeEncAlg and IpsecEncAlg does not support multi algorithm.	Des/3des in IkeEncAlg and IpsecEncAlg does not support multi algorithm.
400	IkeVersionInvalid.GcmIncompatible	Ikev1 does not support IkeEncAlg of gcm16.	Ikev1 does not support IkeEncAlg of gcm16.
400	CustomerGateway.ConflictVpnIp	The specified customer gateway has conflict with vpn gateway ip.	The specified customer gateway has conflict with vpn gateway ip.
400	CustomerGateway.AsnNotConfigured	ASN of CustomerGateway is required when enabling BGP on an IPSec connection.	When BGP is enabled for IPSec connection, ASN needs to be configured on the customer gateway.
403	Forbbiden.SubUser	User not authorized to operate on the specified resource as your account is created by another user.
403	Forbidden	User not authorized to operate on the specified resource.	You do not have the permissions to manage the specified resource. Apply for the permissions and try again.
404	InvalidVpnConnectionInstanceId.NotFound	The specified vpn connection instance id does not exist.	The specified vpn connection instance id does not exist.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.