Call the PublishVpnRouteEntry API to advertise a VPN route to a VPC - VPN Gateway - Alibaba Cloud - VPN Gateway

Calls the PublishVpnRouteEntry operation to publish destination routes or policy routes to the system route table of a VPC, or withdraw published destination routes or policy routes from the VPC system route table.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

vpc:PublishVpnRouteEntry

update

*VpnGateway

acs:vpc:{#regionId}:{#accountId}:vpngateway/{#VpnGatewayId}

None

Request parameters

Parameter	Type	Required	Description	Example
RegionId	string	Yes	The region ID of the VPN gateway instance. You can call the DescribeRegions operation to query region IDs.	cn-hangzhou
ClientToken	string	No	The client token that is used to ensure the idempotence of the request. The value of this parameter is generated by the client. Make sure that the value is unique among different requests. The maximum length is 64 ASCII characters. Note If you do not specify this parameter, the system uses the RequestId of the API request as the ClientToken. The RequestId of each API request is different.	d7d24a21-f4ba-4454-9173-b382****
VpnGatewayId	string	Yes	The ID of the VPN gateway instance.	vpn-bp1a3kqjiiq9legfx****
RouteDest	string	Yes	The destination CIDR block of the VPN gateway route entry.	10.0.0.0/24
NextHop	string	Yes	The next hop of the VPN gateway route entry.	vco-bp15oes1py4i66rmd****
RouteType	string	Yes	The type of the VPN gateway route entry. Valid values: pbr: policy-based route. dbr: destination-based route.	pbr
PublishVpc	boolean	Yes	Specifies whether to publish or withdraw the route. Valid values: true: publishes the route. If this parameter is set to true, the destination route or policy route is published to the system route table of the VPC. false: withdraws the route. If this parameter is set to false, the published destination route or policy route is withdrawn from the VPC system route table. Note If the policy route table and destination route table contain route entries with the same destination CIDR block, and both route entries are published to the same VPC, when you withdraw the route entry from the policy route table, the route entry in the destination route table is also withdrawn. When you withdraw the route entry from the destination route table, the route entry in the policy route table is also withdrawn.	true

Response elements

Element	Type	Description	Example
	object	The response parameters.
RequestId	string	The request ID.	5BE01CD7-5A50-472D-AC14-CA181C5C03BE

Examples

Success response

JSON format

{
  "RequestId": "5BE01CD7-5A50-472D-AC14-CA181C5C03BE\t"
}

Error codes

HTTP status code	Error code	Error message	Description
400	Resource.QuotaFull	The quota of resource is full
400	VpnGateway.Configuring	The specified service is configuring.
400	VpnGateway.FinancialLocked	The specified service is financial locked.
400	VpnRouteEntry.AlreadyExists	The specified route entry is already exist.	The route already exists.
400	VpnRouteEntry.Conflict	The specified route entry has conflict.	Route conflicts exist.
400	InvalidVpnRouteEntry.NotFound	The specified route entry does not exist.	The error message returned because the specified route does not exist.
400	OperationFailed.InvalidStatus	Route entry is not allowed to operate in current status.	You are not allowed to manage the route in the current state.
400	OperationFailed.RouteConflict	Operation failed because there is already a route in VPC route table to another VPN on the same network block.	Operation failed because there is already a route in VPC route table to another VPN on the same network block.
400	OperationFailed.InvalidCidrBlock	Operation failed because the specified network block is invalid.	The CIDR block is invalid.
400	QuotaExceeded.VpnRouteEntry	The number of route entries to the VPN gateway in the VPC routing table has reached the quota limit.	The number of route entries to the VPN gateway in the VPC routing table has reached the quota limit.
400	TaskConflict	The operation is too frequent, please wait a moment and try again.	Your requests are too frequent. Try again later.
400	IllegalParam.CidrBlock	The specified CidrBlock is illegal.	The operation failed because CidrBlock is set to an invalid value.
400	QuotaExceeded	Route entry quota exceeded in this route table.
400	MissingParameter	Miss mandatory parameter.
400	InvalidCidrBlock.Malformed	Specified CIDR block is not valid.
400	InvalidCIDRBlock.Duplicate	Specified CIDR block is already exists.
400	IncorrectVpcStatus	Current VPC status does not support this operation.
400	IncorrectInstanceStatus	Current instance status does not support this operation.
400	IncorrectRouteEntryStatus	Some route entry status blocked this operation.
400	IncorrectVSwitchStatus	The current virtual switch status does not support this operation.	The error message returned because the vSwitch is in the Pending state and cannot be deleted.
400	InvalidCidrBlock	Specified CIDR block is not valid.	Possible reasons for error reporting: 1. You are not in the whitelist of the 10.0.0.0/8 CIDR block and cannot use this CIDR block. 2. The target CIDR block of the added custom route cannot belong to the CIDR block of all vSwitches under the same VPC. 3. Because 100.64.0.0/10 is a cloud service address, you cannot add this CIDR block to point to the IDC under the cloud. 4. Except for 100.64.0.0/10, the detailed route network segments such as 100.64.0.0/11 and 100.96.0.0/11 cannot be used in the IDC under the cloud.
400	InvalidNextHopType	Specified parameter "NextHopType" is not valid
400	InvalidNextHop.NotFound	Specified next hop does not exist.
400	InvalidVRouter.NotFound	vRouter not exists.
400	InvalidVPC.NotFound	vpc not exists.
400	InvalidNexthopTypeAndList.BothNull	both nexthopType and nextHopList are null.
400	InvalidNexthopTypeAndList.BothNotNull	both nexthopType and nextHopList are not null.
400	InvalidRouterInterface	invalid router interface.
400	InvalidOppositeRouterType	nexthop list cannot only contain router interface whose opposite router interface is on vbr.
400	InvalidNexthopListSize	nexthop size is illegal. Must be between 2 and 4.	You must specify two to four router interfaces as next hops.
400	InvalidEntryRuleQuota.NotFound	Route entry quota rule not exists.
400	Forbidden.CheckEntryRuleQuota	Route entry quota rule check error.
400	InvalidVBRStatus	invalid virtual border router status.
400	InvalidPhysicalConnectionBusinessStatus	invalid physical connection business status.
400	IncorrectHaVipStatus	This operation is denied because satus of the specified HaVip is neither Available nor InUse.	You cannot perform the operation when the specified HAVIP is in the Available or InUse state.
400	CountLimitExceed.HaVipRouteEntry	There can be 5 route entry to HaVip at most in one route table.	The number of route entries that point to the HAVIP has reached the upper limit.
400	InvalidRouteEntry.Duplicate	The route entry already exist.
400	INVALID_WEIGHT_PARAM	Specified value of weight invalid
400	FORBIDDEN_USE_VPC_AS_INTERNET_GATEWAY	The Specified CIDR must be in vpc CIDR.
400	INVALID_VPC_ID	The Specified VpcId not match.	The specified VPC does not exist.
400	InvalidRouteEntrySize	The Specified routerEntry size not legal.	You must specify two to four router interfaces as next hops if you want to configure ECMP routing.
400	RouteConflict.AlreadyExist	Route conflict exists in routing table.	Route conflicts exist in the route table.
400	InvalidRouteEntryName.Malformed	Specified RouteEntry name is not valid.	The new name of the route is invalid.
400	Duplicated.VpcNextHop	Route entry nexthop duplicate.	Duplicate next hops are specified.
400	InvalidNexthop.DirectEni	The direct Eni cannot be nexthop.	An ENI in cut-through mode cannot be specified as a next hop.
400	InvalidAttachment.NotFound	The attachment is not found.	The specified transit router does not exist.
400	OperationFailed.ActiveNetworkInterfaceNotFound	No active network interface is found on the attachment.	No ENI is available on the specified transit router.
400	InvalidNetworkInterface.NotFound	The network interface is not found on the attachment.	No ENI is associated with the specified transit router.
400	OperationFailed.QueryAttachmentInfo	Failed to query attachment information.	The system fails to query the transit router.
400	IllegalParam.AttachmentId	The attachment is invalid.	The specified transit router is invalid.
400	OperationFailed.NotSupportIPV6	The specified next hop does not support IPv6.	The specified next hop does not support IPv6.
400	IncorrectStatus.Ipv6Address	The IPv6 address of the specified next hop is being assigned or deleted.	The IPv6 address that is specified as the next hop is being created or being deleted.
400	OperationUnsupported.Ipv6EntryOnPrimaryNetworkInterface	You cannot create IPv6 route entries on a primary network interface.	You cannot create an IPv6 route whose next hop is a primary ENI.
400	OperationUnsupported.SpecifyIpOnIpv6Entry	You cannot specify the private IP address when you create IPv6 route entries.	You cannot specify a private IPv6 address as the destination CIDR block.
400	OperationUnsupported.MutipleIpv6Address	You cannot specify a next hop that has bound multiple IPv6 addresses.	You cannot specify a next hop that is assigned multiple IPv6 addresses.
400	OperationDenied.Ipv6EntryOnCustomTable	You cannot create any IPv6 route entry on a custom route table.
403	Forbbiden.SubUser	User not authorized to operate on the specified resource as your account is created by another user.
403	Forbidden	User not authorized to operate on the specified resource.	You do not have the permissions to manage the specified resource. Apply for the permissions and try again.
404	InvalidVpnGatewayInstanceId.NotFound	The specified vpn gateway instance id does not exist.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.