Automate IPsec Server Updates with UpdateIpsecServer API - VPN Gateway - Alibaba Cloud - VPN Gateway

Calls the UpdateIpsecServer operation to update the configuration of an IPsec server.

Operation description

If you modify only the IpsecServerName of the IPsec server, this operation is synchronous. If you modify configurations other than IpsecServerName, this operation is asynchronous.
When UpdateIpsecServer is an asynchronous operation, the system returns a request ID first, but the IPsec server configuration has not been modified yet because the modification task is still running in the background. You can call DescribeVpnGateway to query the status of the VPN gateway instance to determine the modification status of the IPsec server configuration:
- If the VPN gateway instance is in the updating state, the IPsec server configuration is being modified.
- If the VPN gateway instance is in the active state, the IPsec server configuration has been modified.
The UpdateIpsecServer operation does not support concurrent modifications to IPsec server configurations under the same VPN gateway.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

vpc:UpdateIpsecServer

update

*All Resource

*

None

Request parameters

Parameter	Type	Required	Description	Example
RegionId	string	Yes	The region ID of the IPsec server. You can call the DescribeRegions operation to query the region ID.	cn-shanghai
IpsecServerId	string	Yes	The ID of the IPsec server.	iss-bp1bo3xuvcxo7ixll****
LocalSubnet	string	No	The local CIDR block, which is the CIDR block on the VPC side that needs to communicate with the client CIDR block. Separate multiple CIDR blocks with commas (,). Example: 192.168.1.0/24,192.168.2.0/24.	192.168.0.0/24,172.17.0.0/16
ClientIpPool	string	No	The client CIDR block, which is the CIDR block from which IP addresses are assigned to virtual network interface controllers (NICs) of the client. Note The client CIDR block cannot conflict with the VPC CIDR block.	10.0.0.0/24
IpsecServerName	string	No	The name of the IPsec server. The name must be 1 to 100 characters in length.	test
EffectImmediately	boolean	No	Specifies whether to delete the currently negotiated IPsec tunnel and reinitiate negotiation. Valid values: true: Negotiation is initiated immediately after the configuration is complete. false: Negotiation is initiated when inbound traffic is detected.	false
IkeConfig	string	No	The configuration of Phase 1 negotiation parameters. Valid values: IkeVersion: The version of the Internet Key Exchange protocol. Valid values: ikev1 or ikev2. IkeMode: The negotiation mode of the IKE version. Default value: main. IkeEncAlg: The encryption algorithm used in Phase 1 negotiation. Default value: aes. IkeAuthAlg: The authentication algorithm used in Phase 1 negotiation. Default value: sha1. IkePfs: The Diffie-Hellman key exchange algorithm used in Phase 1 negotiation. Default value: group2. IkeLifetime: The lifetime of the security association (SA) established in Phase 1 negotiation. Unit: seconds. Valid values: 0 to 86400. Default value: 86400. LocalId: The identifier of the IPsec server. The FQDN and IP address formats are supported. RemoteId: The identifier of the peer. The FQDN and IP address formats are supported.	{"IkeVersion":"ikev2","IkeMode":"main","IkeEncAlg":"aes","IkeAuthAlg":"sha1","IkePfs":"group2","IkeLifetime":86400}
IpsecConfig	string	No	The Phase 2 negotiation parameter settings. Valid values: IpsecEncAlg: The encryption algorithm used in Phase 2 negotiation. Default value: aes. IpsecAuthAlg: The authentication algorithm used in Phase 2 negotiation. Default value: sha1. IpsecPfs: Forward all protocol packets. The Diffie-Hellman key exchange algorithm used in Phase 2 negotiation. Default value: group2. IpsecLifetime: The epoch of the SA generated in Phase 2 negotiation. Unit: seconds. Valid values: 0 to 86400. Default value: 86400.	{"IpsecEncAlg":"aes","IpsecAuthAlg":"sha1","IpsecPfs":"group2","IpsecLifetime":86400}
PskEnabled	boolean	No	Specifies whether to enable pre-shared key authentication. Valid values: true, which indicates that pre-shared key authentication is enabled.	true
Psk	string	No	The pre-shared key. The pre-shared key is used for identity authentication between the IPsec server and the client. The key must be 1 to 100 characters in length. You can call the ListIpsecServers operation to query the key generated by the system. Note The pre-shared key of the IPsec server must be the same as the authentication key of the client. Otherwise, a connection cannot be established between the IPsec server and the client.	Cfd123****
ClientToken	string	No	The client token that is used to ensure the idempotence of the request. You can use the client to generate the token, but you must make sure that the token is unique among different requests. The token can contain only ASCII characters. Note If you do not specify this parameter, the system automatically uses the RequestId of the API request as the ClientToken. The RequestId may be different for each API request.	e4567-e89b-12d3-a456-42665544****
DryRun	string	No	Specifies whether to perform a dry run. Valid values: true: performs a dry run without updating the IPsec server configuration. The system checks whether the required parameters are specified, whether the request format is valid, and whether business restrictions are met. If the check fails, the corresponding error message is returned. If the check passes, `DryRunOperation` is returned. false (default): performs a dry run and sends the request. After the check passes, the IPsec server configuration is updated.	false

Response elements

Element	Type	Description	Example
	object	The response parameters.
RequestId	string	The request ID.	B61C08E5-403A-46A2-96C1-F7B1216DB10C

Examples

Success response

JSON format

{
  "RequestId": "B61C08E5-403A-46A2-96C1-F7B1216DB10C"
}

Error codes

HTTP status code	Error code	Error message	Description
400	VpnGateway.Configuring	The specified service is configuring.
400	VpnGateway.FinancialLocked	The specified service is financial locked.
400	OperationUnsupported.IpsecPfs	The specified IPsec Pfs is unsupported.	The specified IPsec PFS property is not supported.
400	IllegalParam.AuthMethod	One authentication method (Psk or IDaaS) should be specified at least.	You must specify at least one authentication method, such as PSK or IDaaS.
400	IllegalParam.LocalSubnet	The specified "LocalSubnet" (%s) is invalid.	The specified "LocalSubnet" (%s) is invalid.
400	IllegalParam.ClientIpPool	The specified "ClientIpPool" (%s) is invalid.
400	MissingParam.IDaaSInstanceId	The input parameter IDaaSInstanceId is mandatory when enable multi-factor authentication.	You must specify the IDaaS instance ID when two-factor authentication is enabled.
400	OperationFailed.NoRamPermission	Vpn Service has no permission to operate your IDaaS instances.	The VPN service does not have the permissions to manage your IDaaS instance.
400	OperationFailed.AddVpcRoute	It's failed to add VPC route after this operation.
400	ClientIpPool.NetmaskInvalid	The netmask length of client IP pool must be greater than or equal to 16 and less than or equal to 29.	The subnet mask of the client IP pool must range from 16 to 29.
400	VpnRouteEntry.Conflict	The specified client IP pool conflicts with VPN connection or SSL server.	The specified client IP pool conflicts with the VPN connection or the SSL server.
400	ClientIpPool.SubnetInvalid	The specified client IP pool cannot be used.	The client CIDR block is unavailable.
400	InvalidClientIpPool.Conflict	The specified client IP pool conflicts with other resources in the same VPC.	The client CIDR block conflicts with resources in the VPC.
400	SystemBusy	The system is busy. Please try again later.
403	Forbidden	User not authorized to operate on the specified resource.	You do not have the permissions to manage the specified resource. Apply for the permissions and try again.
404	InvalidIpsecServerId.NotFound	The specified IPsec server ID (%s) does not exist.
404	InvalidIDaaSInstanceId.NotFound	The specified IDaaS instance ID does not exist.	The specified IDaaS instance does not exist.
409	OperationConflict	The operation against this instance is too frequent, please try again later.	Operations are too frequently performed on the instance. Try again later.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.