Deploy an IPsec Server Using the CreateIpsecServer API - VPN Gateway - Alibaba Cloud - VPN Gateway

Creates an IPsec server by calling the CreateIpsecServer operation.

Operation description

Before you create an IPsec server, create a VPN gateway and make sure that the SSL-VPN feature is enabled for the VPN gateway. For more information, see CreateVpnGateway.
Before you create an IPsec server, make sure that no IPsec-VPN connections exist on the VPN gateway instance. For more information, see DeleteVpnConnection.
CreateIpsecServer is an asynchronous operation. After you send a request, the system returns an instance ID but the IPsec server is not yet created. The creation task is still running in the background. You can call DescribeVpnGateway to query the status of the VPN gateway instance to determine the creation status of the IPsec server:
- If the VPN gateway instance is in the updating state, the IPsec server is being created.
- If the VPN gateway instance is in the active state, the IPsec server is created.
CreateIpsecServer does not support concurrent creation of IPsec servers on the same VPN gateway.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

vpc:CreateIpsecServer

create

*All Resource

*

None

Request parameters

Parameter	Type	Required	Description	Example
RegionId	string	Yes	The region ID of the VPN gateway.	cn-hangzhou
VpnGatewayId	string	Yes	The instance ID of the VPN gateway.	vpn-bp17lofy9fd0dnvzv****
LocalSubnet	string	Yes	The local CIDR block, which is the VPC-side CIDR block that needs to communicate with the client CIDR block. Separate multiple CIDR blocks with commas (,). Example: 192.168.1.0/24,192.168.2.0/24.	192.168.0.0/24
ClientIpPool	string	Yes	The client CIDR block, which is the address range used to assign IP addresses to virtual network interface controllers (NICs) of clients. Note The client CIDR block cannot conflict with the VPC-side CIDR block.	10.0.0.0/24
IpSecServerName	string	No	The name of the IPsec server. The name must be 1 to 100 characters in length.	test
EffectImmediately	boolean	No	Specifies whether the configuration takes effect immediately. Valid values: true: Negotiation starts immediately after the configuration is complete. false (default): Negotiation starts when inbound traffic is detected.	true
IkeConfig	string	No	The parameter settings of Phase 1 negotiations. Valid values: IkeVersion: The version of the IKE protocol. Valid values: ikev1 and ikev2. Default value: ikev2. IkeMode: The negotiation pattern of the IKE version. Default value: main. IkeEncAlg: The encryption algorithm used in Phase 1 negotiations. Default value: aes. IkeAuthAlg: The authentication algorithm used in Phase 1 negotiations. Default value: sha1. IkePfs: The Diffie-Hellman key exchange algorithm used in Phase 1 negotiations. Default value: group2. IkeLifetime: The epoch of the security association (SA) negotiated in Phase 1. Unit: seconds. Valid values: 0 to 86400. Default value: 86400. LocalId: The identity of the IPsec server. The FQDN and IP address formats are supported. Default value: the public IP address of the VPN gateway. RemoteId: The identity of the peer. The FQDN and IP address formats are supported. Default value: empty.	{"IkeVersion":"ikev2","IkeMode":"main","IkeEncAlg":"aes","IkeAuthAlg":"sha1","IkePfs":"group2","IkeLifetime":86400}
IpsecConfig	string	No	The parameter settings of Phase 2 negotiations. Valid values: IpsecEncAlg: The encryption algorithm used in Phase 2 negotiations. Default value: aes. IpsecAuthAlg: The authentication algorithm used in Phase 2 negotiations. Default value: sha1. IpsecPfs: Forward all protocol packets. The Diffie-Hellman key exchange algorithm used in Phase 2 negotiations. Default value: group2. IpsecLifetime: The epoch of the SA negotiated in Phase 2. Unit: seconds. Valid values: 0 to 86400. Default value: 86400.	{"IpsecEncAlg":"aes","IpsecAuthAlg":"sha1","IpsecPfs":"group2","IpsecLifetime":86400}
PskEnabled	boolean	No	Specifies whether to enable pre-shared key authentication. Valid values: true, which indicates that pre-shared key authentication is enabled. Note This parameter is required.	true
Psk	string	No	The pre-shared key. The pre-shared key is used for identity authentication between the IPsec server and the client. The key must be 1 to 100 characters in length. If you do not specify a pre-shared key, the system randomly generates a 16-character string as the pre-shared key. You can call the ListIpsecServers operation to query the pre-shared key generated by the system. Note The pre-shared key of the IPsec server must be the same as the authentication key of the client. Otherwise, a connection cannot be established between the IPsec server and the client.	Cfd123****
ClientToken	string	No	The client token that is used to ensure the idempotence of the request. You can use the client to generate the token, but you must make sure that the token is unique among different requests. The token can contain only ASCII characters. Note If you do not specify this parameter, the system automatically uses the RequestId of the API request as the ClientToken. The RequestId may be different for each API request.	d7d24a21-f4ba-4454-9173-b38****
DryRun	string	No	Specifies whether to perform a dry run. Valid values: true: performs a dry run without creating the IPsec server. The system checks the required parameters, request format, and service limits. If the check fails, the corresponding error message is returned. If the check succeeds, `DryRunOperation` is returned. false (default): sends the request. After the request passes the check, the IPsec server is created.	false

Response elements

Element	Type	Description	Example
	object	The response parameters.
CreationTime	string	The time when the IPsec server was created. T is the separator and Z indicates UTC.	2021-02-22T03:24:28Z
IpsecServerId	string	The ID of the IPsec server.	iss-bp1jougp8cfsbo8y9****
RequestId	string	The request ID.	690A967E-D4CD-4B69-8C78-94FE828BA10B
IpsecServerName	string	The name of the IPsec server.	test
VpnGatewayId	string	The instance ID of the VPN gateway.	vpn-bp17lofy9fd0dnvzv****
RegionId	string	The region ID of the VPN gateway.	cn-hangzhou

Examples

Success response

JSON format

{
  "CreationTime": "2021-02-22T03:24:28Z",
  "IpsecServerId": "iss-bp1jougp8cfsbo8y9****",
  "RequestId": "690A967E-D4CD-4B69-8C78-94FE828BA10B",
  "IpsecServerName": "test",
  "VpnGatewayId": "vpn-bp17lofy9fd0dnvzv****",
  "RegionId": "cn-hangzhou"
}

Error codes

HTTP status code	Error code	Error message	Description
400	OperationUnsupported.IPsecServer	The current version of the VPN gateway does not support IPsec server.	The current version of the VPN gateway does not support IPsec server.
400	VpnGateway.SslVpnDisabled	The VPN gateway has not enabled SSL VPN.	The SSL-VPN feature is disabled for the VPN gateway.
400	VpnGateway.Configuring	The specified service is configuring.
400	VpnGateway.FinancialLocked	The specified service is financial locked.
400	OperationFailed.IPsecServerExist	An IPsec server already exists in the VPN gateway.	An IPsec server already exists in the VPN gateway.
400	OperationUnsupported.IpsecPfs	The specified IPsec Pfs is unsupported.	The specified IPsec PFS property is not supported.
400	IllegalParam.AuthMethod	One authentication method (Psk or IDaaS) should be specified at least.	You must specify at least one authentication method, such as PSK or IDaaS.
400	IllegalParam.LocalSubnet	The specified "LocalSubnet" (%s) is invalid.	The specified "LocalSubnet" (%s) is invalid.
400	IllegalParam.ClientIpPool	The specified ClientIpPool (%s) is invalid.	The client CIDR block (%s) is invalid.
400	MissingParam.IDaaSInstanceId	The input parameter IDaaSInstanceId is mandatory when enable multi-factor authentication.	You must specify the IDaaS instance ID when two-factor authentication is enabled.
400	OperationFailed.NoRamPermission	Vpn Service has no permission to operate your IDaaS instances.	The VPN service does not have the permissions to manage your IDaaS instance.
400	ClientIpPool.NetmaskInvalid	The netmask length of client IP pool must be greater than or equal to 16 and less than or equal to 29.	The subnet mask of the client IP pool must range from 16 to 29.
400	VpnRouteEntry.Conflict	The specified client IP pool conflicts with VPN connection or SSL server.	The specified client IP pool conflicts with the VPN connection or the SSL server.
400	ClientIpPool.SubnetInvalid	The specified client IP pool cannot be used.	The client CIDR block is unavailable.
400	InvalidClientIpPool.Conflict	The specified client IP pool conflicts with other resources in the same VPC.	The client CIDR block conflicts with resources in the VPC.
400	OperationFailed.AddVpcRoute	It is failed to add VPC route after this operation.	VPC routes failed to be added after the operation is performed.
400	QuotaExceeded.VpnRouteEntry	The number of route entries to the VPN gateway in the VPC routing table has reached the quota limit.	The number of route entries to the VPN gateway in the VPC routing table has reached the quota limit.
400	SystemBusy	The system is busy. Please try again later.
400	EnableHaCheck.IpsecServerCidrContainsVpcRouteDest	Ipsec server client cidr contains vpc route prefix. The vpc route prefix is %s.	The prefix %s in the VPC route table falls within the CIDR block of the IPsec client.
400	VpnGateway.IPsecServerAndVpnConnectionConflict	The IPSec connection and IPSec server cannot be configured on the same VPN gateway at the same time.	You cannot configure an IPsec server and an IPsec-VPN connection at the same time for one VPN gateway.
400	EnableHaCheck.SslVpnServerClientCidrContainsVpcRouteDest	Ssl vpn client cidr contains vpc route prefix. The vpc route prefix is %s.	The prefix %s in the VPC route table falls within the CIDR block of the SSL client.
403	Forbidden	User not authorized to operate on the specified resource.	You do not have the permissions to manage the specified resource. Apply for the permissions and try again.
404	InvalidVpnGatewayInstanceId.NotFound	The specified vpn gateway instance id does not exist.
404	InvalidIDaaSInstanceId.NotFound	The specified IDaaS instance ID does not exist.	The specified IDaaS instance does not exist.
409	OperationConflict	The operation against this instance is too frequent, please try again later.	Operations are too frequently performed on the instance. Try again later.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.