Modify VPN Gateway Attributes & Automate Routes via OpenAPI - VPN Gateway - Alibaba Cloud - VPN Gateway

Invokes the ModifyVpnGatewayAttribute operation to modify the name, description, or routing automatic propagation feature of a VPN gateway.

Operation description

ModifyVpnGatewayAttribute is an asynchronous operation. After you call this operation, the system returns the VPN gateway information, but the configuration has not been modified yet. The modification task is still running in the background. You can call DescribeVpnGateway to query the modification status of the VPN gateway configuration:
- If the VPN gateway is in the updating state, the configuration is being modified.
- If the VPN gateway is in the active state, the configuration has been modified.
ModifyVpnGatewayAttribute does not support concurrent modifications to the configuration of the same VPN gateway.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

vpc:ModifyVpnGatewayAttribute

update

*VpnGateway

acs:vpc:{#regionId}:{#accountId}:vpngateway/{#VpnGatewayId}

None

Request parameters

Parameter	Type	Required	Description	Example
RegionId	string	Yes	The region ID of the VPN gateway instance. You can call DescribeRegions to query the most recent region list.	cn-hangzhou
ClientToken	string	No	The client token that is used to ensure the idempotence of the request. You can use the client to generate the token, but you must make sure that the token is unique among different requests. The client token can contain only ASCII characters. Note If you do not specify this parameter, the system automatically uses the RequestId of the API request as the ClientToken. The RequestId may be different for each API request.	123e4567-e89b-12d3-a456-4266****
VpnGatewayId	string	Yes	The ID of the VPN gateway instance.	vpn-bp1q8bgx4xnkm2ogj****
Name	string	No	The new name of the VPN gateway. The name must be 2 to 100 characters in length and cannot start with `http://` or `https://`. It must start with an uppercase or lowercase letter and can contain uppercase and lowercase letters, digits, underscores (_), hyphens (-), and periods (.). Other special characters are not supported.	myvpn
Description	string	No	The new description of the VPN gateway. The description must be 1 to 100 characters in length.	test
AutoPropagate	boolean	No	Specifies whether to enable routing automatic propagation for the VPN gateway. Valid values: true: enabled. After routing automatic propagation is enabled, the VPN gateway instance performs automatic learning of system routes from the system route table of the VPC-connected instance and automatically propagates routes of the on-premises data center to the system route table of the VPC-connected instance. false: disabled. Before you disable routing automatic propagation, make sure that the BGP dynamic route feature is disabled for all IPsec-VPN connections under the VPN gateway.	true

Response elements

Element	Type	Description	Example
	object	The response parameters.
VpcId	string	The ID of the VPC to which the VPN gateway instance belongs.	vpc-bp1ub1yt9cvakoel****
Status	string	The status of the VPN gateway. Valid values: init: initializing. provisioning: preparing. active: Normal. updating: updating. deleting: deleting.	active
InternetIp	string	If the VPN gateway instance supports creating single-tunnel IPsec-VPN connections, this address is the IP address of the VPN gateway instance and can be used to create IPsec-VPN connections or SSL-VPN connections. If the VPN gateway instance supports creating dual-tunnel IPsec-VPN connections, this address is the first IP address used to create IPsec-VPN connections and cannot be used to create SSL-VPN connections. If the VPN gateway instance supports creating dual-tunnel IPsec-VPN connections, the system assigns two IPsec IP addresses to the VPN gateway instance for creating dual-tunnel IPsec-VPN connections.	116.62.XX.XX
Spec	string	The bandwidth specification of the VPN gateway instance. Unit: Mbit/s.	5M
CreateTime	integer	The timestamp when the VPN gateway instance was created. Unit: milliseconds. The timestamp follows the UNIX time format, which represents the total number of milliseconds that have elapsed since January 1, 1970, 00:00:00 UTC.	1492753580000
AutoPropagate	boolean	Indicates whether BGP routes are automatically propagated to the VPC. Valid values: true: Automatic propagation is enabled. false: Automatic propagation is not enabled.	true
VpnGatewayId	string	The ID of the VPN gateway instance.	vpn-bp1q8bgx4xnkm2ogj****
IntranetIp	string	The private IP address of the vSwitch occupied by the system when deploying the VPN gateway instance. This parameter is returned only for VPN gateway instances that support only single-tunnel IPsec-VPN connections and have the IPsec-VPN feature enabled.	172.16.10.46
EndTime	integer	The timestamp when the VPN gateway instance expires. Unit: milliseconds. The timestamp follows the UNIX time format, which represents the total number of milliseconds that have elapsed since January 1, 1970, 00:00:00 UTC.	1495382400000
VSwitchId	string	The ID of the vSwitch associated with the VPN gateway instance.	vsw-bp1y9ovl1cu9ou4tv****
RequestId	string	The request ID.	54B48E3D-DF70-471B-AA93-08E683A1B457
Description	string	The description of the VPN gateway instance.	test
EnableBgp	boolean	The enabling status of the BGP feature for the VPN gateway. Valid values: true: enabled. false: not enabled.	true
BusinessStatus	string	The billing status of the VPN gateway instance. Valid values: Normal: Normal. FinancialLocked: locked due to overdue payment.	Normal
Name	string	The name of the VPN gateway instance.	test
DisasterRecoveryInternetIp	string	The second IP address assigned by the system to the VPN gateway instance for creating IPsec-VPN connections. This parameter is returned only for VPN gateway instances that support creating dual-tunnel IPsec-VPN connections.	116.11.XX.XX
DisasterRecoveryVSwitchId	string	The ID of the second vSwitch associated with the VPN gateway instance. This parameter is returned only for VPN gateway instances that support creating dual-tunnel IPsec-VPN connections.	vsw-p0w95ql6tmr2ludkt****
SslVpnInternetIp	string	The IP address of the SSL-VPN connection. This parameter is returned only when the SSL-VPN feature is enabled for a VPN gateway instance that supports creating dual-tunnel IPsec-VPN connections and uses the public network type.	116.33.XX.XX
ResourceGroupId	string	The ID of the resource group to which the VPN gateway instance belongs. You can call ListResourceGroups to query resource group information.	rg-acfmzs372yg****

Examples

Success response

JSON format

{
  "VpcId": "vpc-bp1ub1yt9cvakoel****",
  "Status": "active",
  "InternetIp": "116.62.XX.XX",
  "Spec": "5M",
  "CreateTime": 1492753580000,
  "AutoPropagate": true,
  "VpnGatewayId": "vpn-bp1q8bgx4xnkm2ogj****",
  "IntranetIp": "172.16.10.46",
  "EndTime": 1495382400000,
  "VSwitchId": "vsw-bp1y9ovl1cu9ou4tv****",
  "RequestId": "54B48E3D-DF70-471B-AA93-08E683A1B457",
  "Description": "test",
  "EnableBgp": true,
  "BusinessStatus": "Normal",
  "Name": "test",
  "DisasterRecoveryInternetIp": "116.11.XX.XX",
  "DisasterRecoveryVSwitchId": "vsw-p0w95ql6tmr2ludkt****",
  "SslVpnInternetIp": "116.33.XX.XX",
  "ResourceGroupId": "rg-acfmzs372yg****"
}

Error codes

HTTP status code	Error code	Error message	Description
400	InvalidName	The name is not valid
400	InvalidDescription	The description is not valid
400	OperationUnsupported.EnableBgp	Current version of the VPN does not support enable BGP.	The current version of the VPN gateway does not support BGP.
400	OperationFailed.VpnConnectionExist	Auto propagate cannot be closed when VPN connections with BGP enabled exist.	Auto propagation cannot be closed when VPN connections with BGP enabled exist.
400	InvalidVpnGatewayInstanceId.NotFound	The specified vpn gateway instance id does not exist.	The specified VPN gateway does not exist. Check whether the specified VPN gateway is valid.
400	VpnGateway.Configuring	The specified service is configuring.
400	OperationFailed.CenLevelNotSupport	When the VPC to which the VPN gateway belongs is attached to a FULL-mode CEN, the VPN gateway cannot enable BGP.	When the VPC to which the VPN gateway belongs is attached to a FULL-mode CEN, the VPN gateway cannot enable BGP.
400	OperationFailed.VpcRoutePropagationDisable	The VPC system routing table does not enable the acceptance of propagated routes.	The VPC system route table is not enabled to accept the propagation route.
400	OperationFailed.VpcRoutePublishEnabledInTR	A VPC supports at most one dynamic route learning source. In the forwarding router, disable route synchronization for the VPC.	A VPC supports at most one dynamic route learning source. In the forwarding router, disable route synchronization for the VPC.
400	OperationFailed.VpcRoutePublishEnabledInECR	VPC supports only one dynamic route learning source at most. Please remove the VPC from ECR.	A VPC supports at most one dynamic route learning source. Remove the VPC from ECR
400	OperationFailed.BondingVpnNotSupportBGP	The architecture does not support BGP capabilities (single tunnel bonding architecture VPN gateway).	the architecture does not support the bgp capability (single-tunnel bonding vpn gateway)
400	OperationFailed.StaleBGPRoutes	BGP routes are still there and automatic route propagation cannot be disabled.	Automatic route propagation cannot be disabled because a BGP route is left.
403	Forbidden.SubUser	User not authorized to operate on the specified resource as your account is created by another user.	The error message returned because you are unauthorized to perform this operation on the specified resource. Acquire the required permissions and try again.
403	Forbidden	User not authorized to operate on the specified resource.	You do not have the permissions to manage the specified resource. Apply for the permissions and try again.
404	InvalidVpnGatewayInstanceId.NotFound	The specified vpn gateway instance id does not exist.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.