Creates an IPsec-VPN connection.

Usage notes

If the VPN gateway supports the dual-tunnel mode, you can specify the following parameters in addition to the required parameters when you call CreateVpnConnection:

ClientToken, Name, EffectImmediately, AutoConfigRoute, Tags array, TunnelOptionsSpecification array, and EnableTunnelsBgp.

For more information about the regions and zones that support the dual-tunnel mode, see IPsec-VPN connections support the dual-tunnel mode.
If the VPN gateway supports only the dual-tunnel mode, you can specify the following parameters in addition to the required parameters when you call CreateVpnConnection:

ClientToken, CustomerGatewayId, Name, EffectImmediately, IkeConfig, IpsecConfig, HealthCheckConfig, AutoConfigRoute, EnableDpd, EnableNatTraversal, BgpConfig, RemoteCaCertificate, and Tags array.
CreateVpnConnection is an asynchronous operation. After a request is sent, the system returns a request ID and runs the task in the background. You can call DescribeVpnGateway to query the status of the task.
- If the VPN gateway is in the updating state, the IPsec-VPN connection is being created.
- If the VPN gateway is in the active state, the IPsec-VPN connection is created.
You cannot repeatedly call CreateVpnConnection to create an IPsec-VPN connection on a VPN gateway within the specified period of time.

Debugging

OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer. OpenAPI Explorer dynamically generates the sample code of the operation for different SDKs.

Request parameters

Parameter	Type	Required	Example	Description
Action	String	Yes	CreateVpnConnection	The operation that you want to perform. Set the value to CreateVpnConnection.
RegionId	String	Yes	cn-shanghai	The ID of the region where you want to create the IPsec-VPN connection. You can call the DescribeRegions operation to query the most recent region list.
ClientToken	String	No	02fb3da4-130e-11e9-8e44-001****	The client token that is used to ensure the idempotence of the request. You can use the client to generate the token, but you must make sure that the token is unique among different requests. The client token can contain only ASCII characters. Note If you do not specify this parameter, the system automatically uses the request ID as the client token. The request ID may be different for each request.
CustomerGatewayId	String	No	cgw-p0w2jemrcj5u61un8****	When you create an IPsec-VPN connection in single-tunnel mode, this parameter is required. The ID of the customer gateway.
VpnGatewayId	String	Yes	vpn-bp1q8bgx4xnkm****	The ID of the VPN gateway.
Name	String	No	IPsec	The name of the IPsec-VPN connection. The name must be 1 to 100 characters in length and cannot start with `http://` or `https://`.
LocalSubnet	String	Yes	10.10.1.0/24,10.10.2.0/24	The CIDR block on the virtual private cloud (VPC) side. The CIDR block is used in Phase 2 negotiations. Separate CIDR blocks with commas (,). Example: 192.168.1.0/24,192.168.2.0/24. The following routing modes are supported: If you set LocalSubnet and RemoteSubnet to 0.0.0.0/0, the routing mode of the IPsec-VPN connection is set to Destination Routing Mode. If you set LocalSubnet and RemoteSubnet to specific CIDR blocks, the routing mode of the IPsec-VPN connection is set to Protected Data Flows.
RemoteSubnet	String	Yes	10.10.3.0/24,10.10.4.0/24	The CIDR block on the data center side. This CIDR block is used in Phase 2 negotiations. Separate CIDR blocks with commas (,). Example: 192.168.3.0/24,192.168.4.0/24. The following routing modes are supported: If you set LocalSubnet and RemoteSubnet to 0.0.0.0/0, the routing mode of the IPsec-VPN connection is set to Destination Routing Mode. If you set LocalSubnet and RemoteSubnet to specific CIDR blocks, the routing mode of the IPsec-VPN connection is set to Protected Data Flows.
EffectImmediately	Boolean	No	false	Specifies whether to immediately start IPsec negotiations. Valid values: true: immediately starts IPsec negotiations after the configuration is complete. false: starts IPsec negotiations when inbound traffic is detected. This is the default value.
IkeConfig	String	No	{"Psk":"1234****","IkeVersion":"ikev1","IkeMode":"main","IkeEncAlg":"aes","IkeAuthAlg":"sha1","IkePfs":"group2","IkeLifetime":86400,"LocalId":"47.XX.XX.1","RemoteId":"47.XX.XX.2"}	This parameter is available if you create an IPsec-VPN connection in single-tunnel mode. The configuration of Phase 1 negotiations: IkeConfig.Psk: The pre-shared key that is used for authentication between the VPN gateway and the data center. The key must be 1 to 100 characters in length and can contain digits, letters, and the following characters: ~!\`@#$%^&()_-+={}[]\|;:',.<>/? If you do not specify a pre-shared key, the system generates a random 16-character string as the pre-shared key. You can call the DescribeVpnConnection operation to query the pre-shared key that is generated by the system. Note* The pre-shared key of the IPsec-VPN connection must be the same as the authentication key of the data center. Otherwise, you cannot establish a connection between the data center and the VPN gateway. IkeConfig.IkeVersion: the IKE version. Valid values: ikev1 and ikev2. Default value: ikev1. Compared with IKEv1, IKEv2 simplifies the SA negotiation process and is more suitable for scenarios in which multiple CIDR blocks are used. IkeConfig.IkeMode: the negotiation mode of IKE. Valid values: main and aggressive. Default value: main. main: This mode offers higher security during negotiations. aggressive: This mode is faster and has a higher success rate. IkeConfig.IkeEncAlg: the encryption algorithm that is used in Phase 1 negotiations. Valid values: aes, aes192, aes256, des, and 3des. Default value: aes. Default value: aes. IkeConfig.IkeAuthAlg: the authentication algorithm that is used in Phase 1 negotiations. Valid values: md5, sha1, sha256, sha384, and sha512. Default value: md5. IkeConfig.IkePfs: The Diffie-Hellman (DH) key exchange algorithm that is used in Phase 1 negotiations. Valid values: group1, group2, group5, and group14. Default value: group2. IkeConfig.IkeLifetime: the SA lifetime determined by Phase 1 negotiations. Unit: seconds. Valid values: 0 to 86400. Default value: 86400. IkeConfig.LocalId: the identifier of the VPN gateway. The identifier of the VPN gateway cannot exceed 100 characters in length. The default value is the IP address of the VPN gateway. IkeConfig.RemoteId: the identifier of the customer gateway. The identifier of the customer gateway cannot exceed 100 characters in length. The default value is the IP address of the customer gateway.
IpsecConfig	String	No	{"IpsecEncAlg":"aes","IpsecAuthAlg":"sha1","IpsecPfs":"group2","IpsecLifetime":86400}	This parameter is available if you create an IPsec-VPN connection in single-tunnel mode. The configurations of Phase 2 negotiations: IpsecConfig.IpsecEncAlg: the encryption algorithm that is used in Phase 2 negotiations. Valid values: aes, aes192, aes256, des, and 3des. Default value: aes. IpsecConfig. IpsecAuthAlg: the authentication algorithm that is used in Phase 2 negotiations. Valid values: md5, sha1, sha256, sha384, and sha512. Default value: md5. IpsecConfig. IpsecPfs: the DH key exchange algorithm that is used in Phase 2 negotiations. Valid values: disabled, group1, group2, group5, and group14. Default value: group2. IpsecConfig. IpsecLifetime: the SA lifetime that is determined by Phase 2 negotiations. Unit: seconds. Valid values: 0 to 86400. Default value: 86400.
HealthCheckConfig	String	No	{"enable":"true","dip":"192.168.10.1","sip":"10.10.1.1","interval":"3","retry":"3"}	This parameter is available if you create an IPsec-VPN connection in single-tunnel mode. The health check configuration: HealthCheckConfig.enable: specifies whether to enable health checks. Valid values: true and false. Default value: false. HealthCheckConfig.dip: the destination IP address configured for health checks. HealthCheckConfig.sip: the source IP address configured for health checks. HealthCheckConfig.interval: the time interval of health check retries. Unit: seconds. Default value: 3. HealthCheckConfig.retry: the maximum number of health check retries. Default value: 3.
AutoConfigRoute	Boolean	No	true	Specifies whether to automatically configure routes. Valid values: true (default) false
EnableDpd	Boolean	No	true	This parameter is available if you create an IPsec-VPN connection in single-tunnel mode. Specifies whether to enable the dead peer detection (DPD) feature. Valid values: true (default) The initiator of the IPsec-VPN connection sends DPD packets to verify the existence and availability of the peer. If no feedback is received from the peer within a specified period of time, the connection fails. ISAKMP SAs and IPsec SAs are deleted. The IPsec tunnel is also deleted. false
EnableNatTraversal	Boolean	No	true	This parameter is available if you create an IPsec-VPN connection in single-tunnel mode. Specifies whether to enable NAT traversal. Valid values: true (default) After NAT traversal is enabled, the initiator does not check the UDP ports during IKE negotiations and can automatically discover NAT gateway devices along the VPN tunnel. false
BgpConfig	String	No	{"EnableBgp":"true","LocalAsn":"45104","TunnelCidr":"169.254.11.0/30","LocalBgpIp":"169.254.11.1"}	This parameter is available if you create an IPsec-VPN connection in single-tunnel mode. The Border Gateway Protocol (BGP) configuration: BgpConfig.EnableBgp: specifies whether to enable BGP. Valid values: true and false. Default value: false. BgpConfig.LocalAsn: the autonomous system number (ASN) on the Alibaba Cloud side. Valid values: 1 to 4294967295. Default value: 45104. BgpConfig.TunnelCidr: the CIDR block of the IPsec tunnel. The CIDR block must belong to 169.254.0.0/16. The subnet mask of the CIDR block must be 30 bits in length. Note The tunnel CIDR block of each IPsec-VPN connection on a VPN gateway must be unique. LocalBgpIp: the BGP IP address on the Alibaba Cloud side. This IP address must fall within the CIDR block of the IPsec tunnel. Note Before you configure BGP, we recommend that you learn about how BGP works and its limits. For more information, see VPN Gateway supports BGP dynamic routing. We recommend that you use a private ASN to establish a connection with Alibaba Cloud over BGP. Refer to the relevant documentation for the private ASN range.
RemoteCaCertificate	String	No	-----BEGIN CERTIFICATE----- MIIB7zCCAZW**** -----END CERTIFICATE-----	This parameter is available if you create an IPsec-VPN connection in single-tunnel mode. If the VPN gateway is of the ShangMi (SM) type, you need to configure a CA certificate for the peer gateway device. This parameter is required when an SM VPN gateway is used to create the IPsec-VPN connection. You can ignore this parameter when a standard VPN gateway is used to create the IPsec-VPN connection.
Tags.N.Key	String	No	TagKey	The key of tag N to add to the resource. The value of this parameter cannot be an empty string. It can be at most 64 characters in length, and cannot contain `http://` or `https://`. It cannot start with `aliyun` or `acs:`. You can specify at most 20 tag keys in each call.
Tags.N.Value	String	No	TagValue	The value of tag N to add to the resource. The tag value can be an empty string and cannot exceed 128 characters in length. It cannot start with `aliyun` or `acs:`, and cannot contain `http://` or `https://`. Each tag key corresponds to one tag value. You can specify at most 20 tag values in each call.
TunnelOptionsSpecification.N.CustomerGatewayId	String	No	cgw-p0wy363lucf1uyae8****	The ID of the customer gateway associated with the tunnel. Note This parameter is required if the VPN gateway supports the dual-tunnel mode. You can specify the parameters in the TunnelOptionsSpecification array if you create an IPsec-VPN connection in dual-tunnel mode. If you create an IPsec-VPN connection in dual-tunnel mode, you need to configure an active tunnel and a standby tunnel. Each IPsec-VPN connection supports only one active tunnel and one standby tunnel.
TunnelOptionsSpecification.N.EnableDpd	Boolean	No	true	Specifies whether to enable DPD for the tunnel. Valid values: true (default) The initiator of the IPsec-VPN connection sends DPD packets to verify the existence and availability of the peer. If no feedback is received from the peer within a specified period of time, the connection fails. ISAKMP SAs and IPsec SAs are deleted. The IPsec tunnel is also deleted. false
TunnelOptionsSpecification.N.EnableNatTraversal	Boolean	No	true	Specifies whether to enable NAT traversal for the tunnel. Valid values: true (default) After NAT traversal is enabled, the verification process for the peer UDP port is deleted from IKE negotiations. In addition, the NAT gateway in the tunnel can be found. false
TunnelOptionsSpecification.N.RemoteCaCertificate	String	No	-----BEGIN CERTIFICATE----- MIIB7zCCAZW**** -----END CERTIFICATE-----	If the VPN gateway is of the SM type, you need to configure a CA certificate for the peer gateway device. This parameter is required for an SM VPN gateway. You can ignore this parameter when a standard VPN gateway is used to create the IPsec-VPN connection.
TunnelOptionsSpecification.N.Role	String	No	master	The tunnel role. Valid values: master slave
TunnelOptionsSpecification.N.TunnelBgpConfig.LocalAsn	Long	No	65530	The autonomous system number (ASN) on the Alibaba Cloud side. Valid values: 1 to 4294967295. Default value: 45104. Note If you set EnableTunnelsBgp to true, this parameter is required. Before you configure BGP, we recommend that you learn about how BGP works and its limits. For more information, see VPN Gateway supports BGP dynamic routing. We recommend that you use a private ASN to establish a connection with Alibaba Cloud over BGP. Refer to the relevant documentation for the private ASN range.
TunnelOptionsSpecification.N.TunnelBgpConfig.LocalBgpIp	String	No	169.254.10.1	The BGP address on the Alibaba Cloud side. The address is an IP address that falls within the BGP CIDR block.
TunnelOptionsSpecification.N.TunnelBgpConfig.TunnelCidr	String	No	169.254.10.0/30	The BGP CIDR block of the tunnel. The CIDR block must belong to 169.254.0.0/16. The subnet mask of the CIDR block must be 30 bits in length. Note The BGP CIDR block of each tunnel on a VPN gateway must be unique.
TunnelOptionsSpecification.N.TunnelIkeConfig.IkeAuthAlg	String	No	md5	The authentication algorithm that is used in Phase 1 negotiations. Valid values: md5, sha1, sha256, sha384, and sha512. Default value: md5.
TunnelOptionsSpecification.N.TunnelIkeConfig.IkeEncAlg	String	No	aes	The encryption algorithm that is used in Phase 1 negotiations. Valid values: aes, aes192, aes256, des, and 3des. Default value: aes.
TunnelOptionsSpecification.N.TunnelIkeConfig.IkeLifetime	Long	No	86400	The SA lifetime that is determined by Phase 1 negotiations. Unit: seconds. Valid values: 0 to 86400. Default value: 86400.
TunnelOptionsSpecification.N.TunnelIkeConfig.IkeMode	String	No	main	The IKE negotiation mode. Valid values: main and aggressive. Default value: main. main: This mode offers higher security during negotiations. aggressive: This mode is faster and has a higher success rate.
TunnelOptionsSpecification.N.TunnelIkeConfig.IkePfs	String	No	group2	The DH key exchange algorithm that is used in Phase 1 negotiations. Default value: group2. Valid values: group1, group2, group5, and group14.
TunnelOptionsSpecification.N.TunnelIkeConfig.IkeVersion	String	No	ikev1	The version of the IKE protocol. Valid values: ikev1 and ikev2. Default value: ikev1. Compared with IKEv1, IKEv2 simplifies the SA negotiation process and is more suitable for scenarios in which multiple CIDR blocks are used.
TunnelOptionsSpecification.N.TunnelIkeConfig.LocalId	String	No	47.21.XX.XX	The identifier on the Alibaba Cloud side, which is used in Phase 1 negotiations. The description can be up to 100 characters in length. The default identifier is the tunnel IP address. You can set LocalId to a fully qualified domain name (FQDN). In this case, we recommend that you set Negotiation Mode to aggressive.
TunnelOptionsSpecification.N.TunnelIkeConfig.Psk	String	No	123456****	The pre-shared key, which is used for identity authentication between the tunnel and the tunnel peer. The key must be 1 to 100 characters in length and can contain digits, letters, and the following characters: ~!\`@#$%^&()_-+={}[]\|;:',.<>/? If you do not specify a pre-shared key, the system generates a random 16-character string as the pre-shared key. You can call the DescribeVpnConnection operation to query the pre-shared key that is generated by the system. Note* Make sure that the tunnels and peers use the same pre-shared key. Otherwise, tunnel communication cannot be established.
TunnelOptionsSpecification.N.TunnelIkeConfig.RemoteId	String	No	47.42.XX.XX	The identifier of the tunnel peer, which is used in Phase 1 negotiations. The description can be up to 100 characters in length. The default identifier is the IP address of the customer gateway. You can set RemoteId to an FQDN. In this case, we recommend that you set Negotiation Mode to aggressive.
TunnelOptionsSpecification.N.TunnelIpsecConfig.IpsecAuthAlg	String	No	md5	The authentication algorithm that is used in Phase 2 negotiations. Valid values: md5, sha1, sha256, sha384, and sha512. Default value: md5.
TunnelOptionsSpecification.N.TunnelIpsecConfig.IpsecEncAlg	String	No	aes	The encryption algorithm that is used in Phase 2 negotiations. Valid values: aes, aes192, aes256, des, and 3des. Default value: aes.
TunnelOptionsSpecification.N.TunnelIpsecConfig.IpsecLifetime	Long	No	86400	The SA lifetime that is determined by Phase 2 negotiations. Unit: seconds. Valid values: 0 to 86400. Default value: 86400.
TunnelOptionsSpecification.N.TunnelIpsecConfig.IpsecPfs	String	No	group2	The Diffie-Hellman key exchange algorithm that is used in Phase 2 negotiations. Default value: group2. Valid values: disabled, group1, group2, group5, and group14.
EnableTunnelsBgp	Boolean	No	true	This parameter is available if you create an IPsec-VPN connection in dual-tunnel mode. Specifies whether to enable the BGP feature for the tunnel. Valid values: true and false. Default value: false.

Response parameters

Parameter	Type	Example	Description
RequestId	String	082AD562-B8DB-4BB2-861F-DA1FCA01FD76	The request ID.
VpnConnectionId	String	vco-bp15oes1py4i6****	The ID of the IPsec-VPN connection.
Name	String	test	The name of the IPsec-VPN connection.
CreateTime	Long	1544666102000	The timestamp generated when the IPsec-VPN connection was created. Unit: milliseconds. This value is a UNIX timestamp representing the number of milliseconds that have elapsed since the epoch time January 1, 1970, 00:00:00 UTC.

Examples

Sample requests

http(s)://[Endpoint]/?Action=CreateVpnConnection
&RegionId=cn-shanghai
&ClientToken=02fb3da4-130e-11e9-8e44-001****
&CustomerGatewayId=cgw-p0w2jemrcj5u61un8****
&VpnGatewayId=vpn-bp1q8bgx4xnkm****
&Name=IPsec
&LocalSubnet=10.10.1.0/24,10.10.2.0/24
&RemoteSubnet=10.10.3.0/24,10.10.4.0/24
&EffectImmediately=false
&IkeConfig={"Psk":"1234****","IkeVersion":"ikev1","IkeMode":"main","IkeEncAlg":"aes","IkeAuthAlg":"sha1","IkePfs":"group2","IkeLifetime":86400,"LocalId":"47.XX.XX.1","RemoteId":"47.XX.XX.2"}
&IpsecConfig={"IpsecEncAlg":"aes","IpsecAuthAlg":"sha1","IpsecPfs":"group2","IpsecLifetime":86400}
&HealthCheckConfig={"enable":"true","dip":"192.168.10.1","sip":"10.10.1.1","interval":"3","retry":"3"}
&AutoConfigRoute=true
&EnableDpd=true
&EnableNatTraversal=true
&BgpConfig={"EnableBgp":"true","LocalAsn":"45104","TunnelCidr":"169.254.11.0/30","LocalBgpIp":"169.254.11.1"}
&Tags=[{"Key":"TagKey","Value":"TagValue"}]
&Common request parameters

Sample success responses

XML format

HTTP/1.1 200 OK
Content-Type:application/xml

<CreateVpnConnectionResponse>
    <RequestId>082AD562-B8DB-4BB2-861F-DA1FCA01FD76</RequestId>
    <VpnConnectionId>vco-bp15oes1py4i6****</VpnConnectionId>
    <Name>test</Name>
    <CreateTime>1544666102000</CreateTime>
</CreateVpnConnectionResponse>

JSON format

HTTP/1.1 200 OK
Content-Type:application/json

{
  "RequestId" : "082AD562-B8DB-4BB2-861F-DA1FCA01FD76",
  "VpnConnectionId" : "vco-bp15oes1py4i6****",
  "Name" : "test",
  "CreateTime" : 1544666102000
}

Error codes

HttpCode	Error code	Error message	Description
400	Resource.QuotaFull	The quota of resource is full	The resource quota is exhausted.
400	InvalidVpnConnection.AlreadyExists	Vpn connection already exists.	The IPsec-VPN connection already exists.
400	VpnGateway.Configuring	The specified service is configuring.	The operation is not allowed when the specified service is being configured. Try again later.
400	VpnGateway.FinancialLocked	The specified service is financial locked.	The service is suspended due to overdue payments. Top up your account first.
400	VpnGateway.IpsecVpnDisabled	The vpn gateway does not enable IPSec VPN.	The IPsec-VPN feature is not enabled for the VPN gateway.
400	VpnRouteEntry.AlreadyExists	The specified route entry is already exist.	The route already exists.
400	VpnRouteEntry.Conflict	The specified route entry has conflict.	The specified route conflicts with an existing route.
400	NotSupportVpnConnectionParameter.IpsecPfs	The specified vpn connection ipsec Ipsec Pfs is not support.	The PFS parameter set for the IPsec-VPN connection is not supported.
400	NotSupportVpnConnectionParameter.IpsecAuthAlg	The specified vpn connection ipsec Auth Alg is not support.	The authentication algorithm specified for the IPsec-VPN connection is not supported.
400	VpnRouteEntry.ConflictSSL	The specified route entry has conflict with SSL client.	The route conflicts with the SSL client.
400	VpnRouteEntry.BackupRoute	Validate backup route entry failed.	Active/standby routes failed authentication.
400	VpnRouteEntry.InvalidWeight	Invalid route entry weight value.	The specified weight of the route is invalid.
400	InvalidParameter.VpnConnectionName	The specified vpn connection name is invalid.	The VPN connection name does not meet the requirements.
400	OperationUnsupported.SetDPD	Current version of the VPN does not support setting DPD.	The VPN gateway version does not support DPD.
400	OperationUnsupported.SetNatTraversal	Current version of the VPN does not support setting NAT traversal.	The VPN gateway version does not support NAT traversal.
400	QuotaExceeded.PolicyBasedRoute	The maximum number of policy-based routes is exceeded. Existing routes: %s. Routes to be created: %s. Maximum routes: %s.	The number of policy-based routes has reached the upper limit. The maximum number of routes that you can create is %s. The number of existing routes is %s. You are creating %s routes.
400	MissingParameter.TunnelCidr	The parameter TunnelCidr is mandatory when BGP is enabled.	You must specify the tunnel CIDR block when you enable BGP.
400	OperationUnsupported.EnableBgp	Current version of the VPN does not support enable BGP.	The current version of the VPN gateway does not support BGP.
400	MissingParam.CustomerGatewayAsn	Asn of customer gateway is mandatory when BGP is enabled.	The ASN of the customer gateway cannot be empty when you enable BGP.
400	IllegalParam.LocalAsn	The specified LocalAsn is invalid.	The local ASN is invalid.
400	IllegalParam.BgpConfig	The specified BgpConfig is invalid.	The BGP configuration is invalid.
400	IllegalParam.EnableBgp	VPN connection must enable BGP when VPN gateway has enabled BGP.	The IPsec-VPN connection must use BGP if BGP is enabled for the VPN gateway.
400	IllegalParam.TunnelCidr	The specified TunnelCidr is invalid.	TunnelCidr is set to an invalid value.
400	InvalidLocalBgpIp.Malformed	The specified LocalBgpIp is malformed.	The local BGP IP address is in an abnormal state.
400	IllegalParam.LocalBgpIp	The specified LocalBgpIp is invalid.	The local BGP IP address is invalid.
400	IllegalParam.LocalSubnet	The specified "LocalSubnet" (%s) is invalid.	LocalSubnet (%s) is set to an invalid value.
400	IllegalParam.RemoteSubnet	The specified "RemoteSubnet" (%s) is invalid.	RemoteSubnet is set to an invalid value.
400	OperationFailed.MissCertificate	The VPN gateway has not associated any certificates.	The VPN gateway is not associated with a certificate.
400	MissingParam.RemoteId	The remote ID is mandatory when creating national standard VPN connection.	The peer ID is not specified. You must specify the peer ID when you create a VPN connection encrypted by SM.
400	OperationFailed.CenLevelNotSupport	When the VPC to which the VPN gateway belongs is attached to a FULL-mode CEN, the VPN gateway cannot enable BGP.	The VPC of the VPN gateway is attached to a Cloud Enterprise Network (CEN) instance that uses the FULL mode. Therefore, you cannot enable BGP for the VPN gateway.
400	CustomerGateway.ConflictRouteEntry	The specified customer gateway has conflict with route entry.	The customer gateway conflicts with the current routes.
400	VpnTask.CONFLICT	Vpn task has conflict.	The VPN operation is conflicting. Try again later.
400	Forbidden.TagKey.Duplicated	The specified tag key already exists.	The tag resources are duplicate.
400	SizeLimitExceeded.TagNum	The maximum number of tags is exceeded.	The number of tags has reached the upper limit.
400	InvalidParameter.TagValue	The specified parameter TagValue is invalid.	The tag value is invalid.
400	InvalidParameter.TagKey	The specified parameter TagKey is invalid.	The tag key is invalid.
400	Duplicated.TagKey	The specified parameter TagKey is duplicated.	The tag key already exists.
400	InternalError	The request processing has failed due to some unknown error, exception or failure.	An internal error has occurred.
400	InvalidTunnelCidr.Malformed	The specified TunnelCidr is malformed.	The specified tunnel CIDR block is invalid.
400	VpnConnectionParamInvalid.SameVpnAndCgwDifferentIkeConfigs	IPSec connections associated with the same user gateway and VPN gateway should have the same pre-shared key and IKE configuration.	The pre-shared key and IKE parameters must be the same for IPsec-VPN connections that are associated with the same VPN gateway and customer gateway.
400	VpnConnectionParamInvalid.SameVpnAndCgwTrafficSelectorOverlap	Traffic selectors of IPSec connections associated with the same user gateway and VPN gateway should not overlap.	The protected data flows of IPsec-VPN connections that are associated with the same VPN gateway and customer gateway cannot overlap.
403	Forbbiden.SubUser	User not authorized to operate on the specified resource as your account is created by another user.	You are unauthorized to perform this operation on the specified resource. You can apply for the required permissions and try again.
403	Forbidden	User not authorized to operate on the specified resource.	You are unauthorized to perform this operation on the specified resource. You can apply for the required permissions and try again.
404	InvalidCustomerGatewayInstanceId.NotFound	The specified customer gateway instance id does not exist.	The customer gateway is not found.
404	InvalidVpnGatewayInstanceId.NotFound	The specified vpn gateway instance id does not exist.	The VPN gateway is not found.

For a list of error codes, see Service error codes.