:CreateVpnAttachment

The operation that you want to perform. Set the value to CreateVpnAttachment.

The ID of the region where the IPsec-VPN connection is established.

You can call the DescribeRegions operation to query the most recent region list.

The name of the IPsec-VPN connection.

The name must be 1 to 100 characters in length and cannot start with http:// or https://.

The ID of the customer gateway.

The network type of the IPsec-VPN connection. Valid values:

• public (default)
• private

The CIDR block on the VPC side. The CIDR block is used in Phase 2 negotiations.

Separate multiple CIDR blocks with commas (,). Example: 192.168.1.0/24,192.168.2.0/24.

The following routing modes are supported:

• If you set LocalSubnet and RemoteSubnet to 0.0.0.0/0, the routing mode of the IPsec-VPN connection is set to Destination Routing Mode.
• If you set LocalSubnet and RemoteSubnet to specific CIDR blocks, the routing mode of the IPsec-VPN connection is set to Protected Data Flows.

The CIDR block on the data center side. This CIDR block is used in Phase 2 negotiations.

Separate multiple CIDR blocks with commas (,). Example: 192.168.3.0/24,192.168.4.0/24.

The following routing modes are supported:

• If you set LocalSubnet and RemoteSubnet to 0.0.0.0/0, the routing mode of the IPsec-VPN connection is set to Destination Routing Mode.
• If you set LocalSubnet and RemoteSubnet to specific CIDR blocks, the routing mode of the IPsec-VPN connection is set to Protected Data Flows.

Specifies whether to immediately start IPsec negotiations. Valid values:

• true: immediately starts IPsec negotiations after the configuration is complete.
• false (default): starts IPsec negotiations when inbound traffic is received.

The configuration of Phase 1 negotiations:

• IkeConfig.Psk: The pre-shared key that is used for authentication between the VPN gateway and the data center.
  • The key must be 1 to 100 characters in length and can contain digits, letters, and the following characters:

    ~!`@#$%^&*()_-+={}[]|;:',.<>/?

  • If you do not specify a pre-shared key, the system generates a random 16-bit string as the pre-shared key. You can call the DescribeVpnConnection operation to query the pre-shared key that is generated by the system.

    Note The pre-shared key of the IPsec-VPN connection must be the same as the authentication key of the data center. Otherwise, you cannot establish a connection between the data center and the VPN gateway.
• IkeConfig.IkeVersion: the version of the IKE protocol. Valid values: ikev1 and ikev2. Default value: ikev1.
• IkeConfig.IkeMode: the negotiation mode. Valid values: main and aggressive. Default value: main.
• IkeConfig.IkeEncAlg: the encryption algorithm that is used in Phase 1 negotiations. Valid values: aes, aes192, aes256, des, and 3des. Default value: aes.
• IkeConfig.IkeAuthAlg: the authentication algorithm that is used in Phase 1 negotiations. Valid values: md5, sha1, sha256, sha384, and sha512. Default value: md5.
• IkeConfig.IkePfs: The Diffie-Hellman key exchange algorithm that is used in Phase 1 negotiations. Valid values: group1, group2, group5, and group14. Default value: group2.
• IkeConfig.IkeLifetime: the SA lifetime determined by Phase 1 negotiations. Unit: seconds. Valid values: 0 to 86400. Default value: 86400.
• IkeConfig.LocalId: the identifier on the Alibaba Cloud side. The identifier cannot exceed 100 characters in length. This parameter is empty by default.
• IkeConfig.RemoteId: the identifier on the data center side. The identifier cannot exceed 100 characters in length. The default value is the IP address of the customer gateway.

The configurations of Phase 2 negotiations:

• IpsecConfig.IpsecEncAlg: the encryption algorithm that is used in Phase 2 negotiations. Valid values: aes, aes192, aes256, des, and 3des. Default value: aes.
• IpsecConfig. IpsecAuthAlg: the authentication algorithm that is used in Phase 2 negotiations. Valid values: md5, sha1, sha256, sha384, and sha512. Default value: md5.
• IpsecConfig. IpsecPfs: the Diffie-Hellman key exchange algorithm that is used in Phase 2 negotiations. Valid values: disabled, group1, group2, group5, and group14. Default value: group2.
• IpsecConfig. IpsecLifetime: the SA lifetime that is determined by Phase 2 negotiations. Unit: seconds. Valid values: 0 to 86400. Default value: 86400.

The Border Gateway Protocol (BGP) configuration:

• BgpConfig.EnableBgp: specifies whether to enable BGP. Valid values: true and false. Default value: false.
• BgpConfig.LocalAsn: the ASN on the Alibaba Cloud side. Valid values: 1 to 4294967295. Default value: 45104.
• BgpConfig.TunnelCidr: the CIDR block of the IPsec tunnel. The CIDR block must belong to 169.254.0.0/16. The subnet mask of the CIDR block must be 30 bits in length.
• LocalBgpIp: the BGP IP address on the Alibaba Cloud side. This IP address must fall within the CIDR block of the IPsec tunnel.

The health check configuration:

• HealthCheckConfig.enable: specifies whether to enable health checks. Valid values: true and false. Default value: false.
• HealthCheckConfig.dip: the destination IP address that is used for health checks. Enter the IP address on the data center side that the VPC can communicate with through the IPsec-VPN connection.
• HealthCheckConfig.sip: the source IP address that is used for health checks. Enter the IP address on the VPC side that the data center can communicate with through the IPsec-VPN connection.
• HealthCheckConfig.interval: the interval between two consecutive health checks. Unit: seconds. Default value: 3.
• HealthCheckConfig.retry: the maximum number of health check retries. Default value: 3.
• HealthCheckConfig.Policy: specifies whether to withdraw published routes when health checks fail. Valid values:
  • revoke_route (default): withdraws published routes.
  • reserve_route: does not withdraw published routes.

Specifies whether to automatically configure routes. Valid values:

• true (default)
• false

Specifies whether to enable the dead peer detection (DPD) feature. Valid values:

• true (default) The initiator of the IPsec-VPN connection sends DPD packets to verify the existence and availability of the peer. If no response is received from the peer within a specified period of time, the connection fails. ISAKMP SAs and IPsec SAs are deleted. The IPsec tunnel is also deleted.
• false

Specifies whether to enable NAT traversal. Valid values:

• true (default) After NAT traversal is enabled, the initiator does not check the UDP ports during IKE negotiations and can automatically discover NAT gateway devices along the VPN tunnel.
• false

The peer CA certificate when a ShangMi (SM) VPN gateway is used to create the IPsec-VPN connection.

The client token that is used to ensure the idempotence of the request.

You can use the client to generate the token, but you must make sure that the token is unique among different requests. The token can contain only ASCII characters.

The tag key. The tag key cannot be an empty string.

It can be at most 64 characters in length, and cannot contain http:// or https://. It cannot start with aliyun or acs:.

You can specify at most 20 tag keys in each call.

The tag value.

The tag value can be an empty string and cannot exceed 128 characters in length. It cannot start with aliyun or acs:, and cannot contain http:// or https://.

Each tag key corresponds to one tag value. You can specify at most 20 tag values in each call.

The request ID.

The ID of the IPsec-VPN connection.

The name of the IPsec-VPN connection.

The timestamp generated when the IPsec-VPN connection was established. Unit: milliseconds.

This value is a UNIX timestamp representing the number of milliseconds that have elapsed since the epoch time January 1, 1970, 00:00:00 UTC.

The status code returned by the current operation. 200 indicates that the operation is successful.

Indicates whether the current operation is successful.

• true
• false

The information returned by the current operation.