UpdateIpsecServer - VPN Gateway - Alibaba Cloud Documentation Center

Modifies the configuration of an IPsec server.

Operation description

If you modify only the IpsecServerName parameter, this operation is synchronous. If you modify parameters other than IpsecServerName, this operation is asynchronous.
When the UpdateIpsecServer operation is asynchronous, the system returns a request ID after you send a request to call this operation and the IPsec server is being modified in the backend. You can call DescribeVpnGateway to query the status of a VPN gateway.
- If the VPN gateway is in the updating state, the configuration of the IPsec server is being modified.
- If the VPN gateway is in the active state, the configuration of the IPsec server is modified.
You cannot repeatedly call the UpdateIpsecServer operation for the same VPN gateway within the specified period of time.

Debugging

You can run this interface directly in OpenAPI Explorer, saving you the trouble of calculating signatures. After running successfully, OpenAPI Explorer can automatically generate SDK code samples.

Debug

Authorization information

The following table shows the authorization information corresponding to the API. The authorization information can be used in the Action policy element to grant a RAM user or RAM role the permissions to call this API operation. Description:

Operation: the value that you can use in the Action element to specify the operation on a resource.
Access level: the access level of each operation. The levels are read, write, and list.
Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
- The required resource types are displayed in bold characters.
- If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
Condition Key: the condition key that is defined by the cloud service.
Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.

Operation	Access level	Resource type	Condition key	Associated operation
vpc:UpdateIpsecServer	update	All Resources *	none	none

Request parameters

Parameter	Type	Required	Description	Example
RegionId	string	Yes	The ID of the region where the IPsec server is created. You can call the DescribeRegions operation to query the most recent region list.	cn-shanghai
IpsecServerId	string	Yes	The IPsec server ID.	iss-bp1bo3xuvcxo7ixll****
LocalSubnet	string	No	The local CIDR blocks, which are the CIDR blocks of the virtual private cloud (VPC) for the client to access. Multiple CIDR blocks are separated with commas (,). Example: 192.168.1.0/24,192.168.2.0/24.	192.168.0.0/24,172.17.0.0/16
ClientIpPool	string	No	The client CIDR block from which an IP address is allocated to the virtual network interface controller (NIC) of the client. Note The client CIDR block must not overlap with the CIDR blocks of the VPC.	10.0.0.0/24
IpsecServerName	string	No	The name of the IPsec server. It must be 1 to 100 characters in length.	test
EffectImmediately	boolean	No	Specifies whether to delete the negotiated IPsec tunnel and initiate the negotiation again. Valid values: true: immediately initiates negotiations after the configuration is complete. false: initiates negotiations when inbound traffic is detected.	false
IkeConfig	string	No	The configuration of Phase 1 negotiations. Valid values: IkeVersion: The IKE version. Valid values: ikev1 and ikev2. IkeMode: The IKE negotiation mode. Default value: main. IkeEncAlg: the encryption algorithm that is used in Phase 1 negotiation. Default value: aes. IkeAuthAlg: the authentication algorithm that is used in Phase 1 negotiation. Default value: sha1. IkePfs: The Diffie-Hellman key exchange algorithm that is used in Phase 1 negotiations. Default value: group2. IkeLifetime: The SA lifetime determined by Phase 1 negotiations. Unit: seconds. Valid values: 0 to 86400. Default value: 86400. LocalId: The identifier of the IPsec server. Only FQDN and IP address formats are supported. RemoteId: the peer identifier. Only FQDN and IP address formats are supported.	{"IkeVersion":"ikev2","IkeMode":"main","IkeEncAlg":"aes","IkeAuthAlg":"sha1","IkePfs":"group2","IkeLifetime":86400}
IpsecConfig	string	No	The configuration of Phase 2 negotiation. Valid values: IpsecEncAlg: the encryption algorithm that is used in Phase 2 negotiation. Default value: aes. IpsecAuthAlg: the authentication algorithm that is used in Phase 2 negotiation. Default value: sha1. IpsecPfs: forwards packets of all protocols. The Diffie-Hellman key exchange algorithm that is used in Phase 2 negotiation. Default value: group2. IpsecLifetime: the SA lifetime determined by Phase 2 negotiation. Unit: seconds. Valid values: 0 to 86400. Default value: 86400.	{"IpsecEncAlg":"aes","IpsecAuthAlg":"sha1","IpsecPfs":"group2","IpsecLifetime":86400}
PskEnabled	boolean	No	Specifies whether to enable pre-shared key authentication. If you set the value to true, pre-shared key authentication is enabled.	true
Psk	string	No	The pre-shared key. The pre-shared key that is used for authentication between the IPsec-VPN server and the client. It must be 1 to 100 characters in length. You can call ListIpsecServers to query keys generated by the system. Note The pre-shared key of the IPsec server key must be the same as that of the client. Otherwise, the connection between the IPsec server and the client cannot be established.	Cfd123****
ClientToken	string	No	The client token that is used to ensure the idempotence of the request. You can use the client to generate a value, and you must make sure that each request has a unique token value. The client token can contain only ASCII characters. Note If you do not specify this parameter, the system automatically uses the value of RequestId as the value of ClientToken. The request ID may be different for each request.	e4567-e89b-12d3-a456-42665544****
DryRun	string	No	Specifies whether to only precheck this request. Valid values: true: prechecks the request without modifying the configurations of the IPsec server. The system checks the required parameters, request format, and service limits. If the request fails to pass the precheck, an error code is returned. If the request passes the precheck, the `DryRunOperation` error code is returned. false: sends the request. This is the default value. If the request passes the precheck, the system modifies the configurations of the IPsec server.	false

Response parameters

Parameter	Type	Description	Example
	object	The returned results.
RequestId	string	The request ID.	B61C08E5-403A-46A2-96C1-F7B1216DB10C

Examples

Sample success responses

JSONformat

{
  "RequestId": "B61C08E5-403A-46A2-96C1-F7B1216DB10C"
}

Error codes

HTTP status code	Error code	Error message	Description
400	VpnGateway.Configuring	The specified service is configuring.	The service is being configured. Try again later.
400	VpnGateway.FinancialLocked	The specified service is financial locked.	The service is suspended due to overdue payments. Top up your account first.
400	OperationUnsupported.IpsecPfs	The specified IPsec Pfs is unsupported.	The specified IPsec PFS property is not supported.
400	IllegalParam.AuthMethod	One authentication method (Psk or IDaaS) should be specified at least.	You must specify at least one authentication method, such as PSK or IDaaS.
400	IllegalParam.LocalSubnet	The specified "LocalSubnet" (%s) is invalid.	The specified "LocalSubnet" (%s) is invalid.
400	IllegalParam.ClientIpPool	The specified "ClientIpPool" (%s) is invalid.	-
400	MissingParam.IDaaSInstanceId	The input parameter IDaaSInstanceId is mandatory when enable multi-factor authentication.	You must specify the IDaaS instance ID when two-factor authentication is enabled.
400	OperationFailed.NoRamPermission	Vpn Service has no permission to operate your IDaaS instances.	The VPN service does not have the permissions to manage your IDaaS instance.
400	OperationFailed.AddVpcRoute	It's failed to add VPC route after this operation.	-
400	ClientIpPool.NetmaskInvalid	The netmask length of client IP pool must be greater than or equal to 16 and less than or equal to 29.	The subnet mask of the client IP pool must range from 16 to 29.
400	VpnRouteEntry.Conflict	The specified client IP pool conflicts with VPN connection or SSL server.	The specified client IP pool conflicts with the VPN connection or the SSL server.
400	ClientIpPool.SubnetInvalid	The specified client IP pool cannot be used.	The client CIDR block is unavailable.
400	InvalidClientIpPool.Conflict	The specified client IP pool conflicts with other resources in the same VPC.	The client CIDR block conflicts with resources in the VPC.
400	SystemBusy	The system is busy. Please try again later.	The system is busy. Please try again later.
403	Forbidden	User not authorized to operate on the specified resource.	You do not have the permissions to manage the specified resource. Apply for the permissions and try again.
404	InvalidIpsecServerId.NotFound	The specified IPsec server ID (%s) does not exist.	-
404	InvalidIDaaSInstanceId.NotFound	The specified IDaaS instance ID does not exist.	The specified IDaaS instance does not exist.
409	OperationConflict	The operation against this instance is too frequent, please try again later.	Operations are too frequently performed on the instance. Try again later.

For a list of error codes, visit the Service error codes.

Change history

Change time	Summary of changes	Operation
2023-10-19	API Description Update. The Error code has changed	View Change Details
2023-08-08	API Description Update. The Error code has changed	View Change Details