Use ALIYUN::VPC::VpnConnection to create an IPsec-VPN connection-Resource Orchestration Service(ROS)-阿里云帮助中心

You can use the ALIYUN::VPC::VpnConnection resource type to create an IPsec-VPN connection.

Syntax

{
  "Type": "ALIYUN::VPC::VpnConnection",
  "Properties": {
    "IpsecConfig": Map,
    "Name": String,
    "IkeConfig": Map,
    "HealthCheckConfig": Map,
    "VpnGatewayId": String,
    "CustomerGatewayId": String,
    "RemoteSubnet": String,
    "LocalSubnet": String,
    "EffectImmediately": Boolean,
    "EnableTunnelsBgp": Boolean,
    "RemoteCaCertificate": String,
    "BgpConfig": Map,
    "AutoConfigRoute": Boolean,
    "EnableDpd": Boolean,
    "EnableNatTraversal": Boolean,
    "TunnelOptionsSpecification": List
  }
}

Properties

Property Name	Type	Required	Update allowed	Description	Constraints
Name	String	No	Yes	The name of the IPsec-VPN connection.	The name must be 2 to 128 characters in length. It must start with a letter or a Chinese character and cannot start with `http://` or `https://`. The name can contain letters, Chinese characters, digits, periods (.), underscores (_), and hyphens (-).
IkeConfig	Map	No	Yes	The configuration of Phase 1 negotiation.	For more information, see IkeConfig properties.
IpsecConfig	Map	No	Yes	The configuration of Phase 2 negotiation.	For more information, see IpsecConfig properties.
HealthCheckConfig	Map	No	No	The configuration of the health check.	For more information, see HealthCheckConfig properties.
VpnGatewayId	String	Yes	No	The ID of the VPN Gateway.	None
CustomerGatewayId	String	No	No	The ID of the customer gateway.	None
RemoteSubnet	String	Yes	Yes	The CIDR block of the on-premises data center. This CIDR block is used for Phase 2 negotiation.	Separate multiple CIDR blocks with commas (,). Example: 192.168.3.0/24,192.168.4.0/24.
LocalSubnet	String	Yes	Yes	The CIDR block of the VPC that interconnects with the on-premises data center. This CIDR block is used for Phase 2 negotiation.	Separate multiple CIDR blocks with commas (,). Example: 192.168.1.0/24,192.168.2.0/24.
EffectImmediately	Boolean	No	Yes	Specifies whether to delete the current IPsec tunnel and renegotiate.	Valid values: true: Renegotiates the connection immediately after the configuration is complete. false (default): Renegotiates the connection when traffic is detected.
EnableTunnelsBgp	Boolean	No	No	The enabling status of Border Gateway Protocol (BGP) for the tunnel.	Valid values: true: Enabled. false: Disabled.
RemoteCaCertificate	String	No	No	The CA certificate of the peer.	None
BgpConfig	Map	No	Yes	The BGP configuration of the tunnel.	For more information, see BgpConfig properties.
AutoConfigRoute	Boolean	No	Yes	Specifies whether to automatically configure routes.	Valid values: false: Manually configure routes. true (default): Automatically configure routes.
EnableDpd	Boolean	No	Yes	Specifies whether to enable the Dead Peer Detection (DPD) feature for the IPsec-VPN connection.	Valid values: true: Enables the DPD feature. The initiator of the IPsec-VPN connection sends DPD packets to check the existence and availability of the peer. If the peer does not respond in a specific period of time, the connection is considered disconnected. The ISAKMP Security Association (SA), IPsec SA, and the corresponding IPsec tunnel are deleted. false: Disables the DPD feature. The initiator of the IPsec-VPN connection does not send DPD packets.
EnableNatTraversal	Boolean	No	Yes	Specifies whether to enable the NAT traversal feature for the tunnel.	Valid values: false: Disabled. true: Enabled.
TunnelOptionsSpecification	List	No	No	The tunnel configuration of the IPsec-VPN connection.	For more information, see TunnelOptionsSpecification properties.

IkeConfig syntax

"IkeConfig": {
  "RemoteId": String,
  "Psk": String,
  "IkeVersion": String,
  "IkeMode": String,
  "IkeAuthAlg": String,
  "IkeEncAlg": String,
  "IkePfs": String,
  "IkeLifetime": Integer,
  "LocalId": String
}

IkeConfig properties

Property Name	Type	Required	Update allowed	Description	Constraints
RemoteId	String	No	Yes	The identity of the customer gateway.	The value can be up to 100 characters in length. The default value is the public IP address of the customer gateway.
Psk	String	No	Yes	Authentication between the IPsec VPN Gateway and the customer gateway.	The value can be up to 100 characters in length. By default, the system randomly generates a key. You can also specify the key.
IkeVersion	String	No	Yes	The version of the IKE protocol.	Valid values: ikev1 (default) ikev2
IkeMode	String	No	Yes	The negotiation mode of IKEv1.	Valid values: main (default) aggressive
IkeAuthAlg	String	No	Yes	The authentication algorithm for Phase 1 negotiation.	Valid values: md5 (default) sha1
IkeEncAlg	String	No	Yes	The encryption algorithm for Phase 1 negotiation.	Valid values: aes (default) aes192 aes256 des 3des
IkePfs	String	No	Yes	The Diffie-Hellman key exchange algorithm used for Phase 1 negotiation.	Valid values: group1 group2 (default) group5 group14 group24
IkeLifetime	Integer	No	Yes	The lifetime of the SA negotiated in Phase 1.	The value must be between 0 and 86,400. The default value is 86,400.
LocalId	String	No	Yes	The identity of the VPN Gateway.	The value can be up to 100 characters in length. The default value is the IP address of the VPN Gateway.

IpsecConfig syntax

"IpsecConfig": {
  "IpsecAuthAlg": String,
  "IpsecEncAlg": String,
  "IpsecLifetime": Integer,
  "IpsecPfs": String
}

IpsecConfig properties

Property Name	Type	Required	Update allowed	Description	Constraints
IpsecAuthAlg	String	No	Yes	The authentication algorithm for Phase 2 negotiation.	Valid values: md5 (default) sha1
IpsecEncAlg	String	No	Yes	The encryption algorithm for Phase 2 negotiation.	Valid values: aes (default) aes192 aes256 des 3des
IpsecLifetime	Integer	No	Yes	The lifetime of the SA negotiated in Phase 2.	The value must be between 0 and 86,400. Unit: seconds. The default value is 86,400.
IpsecPfs	String	No	Yes	The Diffie-Hellman key exchange algorithm used for Phase 2 negotiation.	Valid values: group1 group2 (default) group5 group14 group24

HealthCheckConfig syntax

"HealthCheckConfig": {
  "Enable": Boolean,
  "Dip": Boolean,
  "Retry": Integer,
  "Sip": String,
  "Interval": Integer,
  "Policy": String 
}

HealthCheckConfig properties

Property Name	Type	Required	Update allowed	Description	Constraints
Enable	Boolean	No	Yes	Specifies whether to enable health checks.	Valid values: true false If you set the value to true, you must configure the other parameters.
Interval	Integer	No	Yes	The interval between health check retries.	Unit: seconds.
Retry	Integer	No	Yes	The number of times to send health check packets.	None
Dip	String	No	Yes	The destination IP address. This is the IP address of the on-premises data center that you can access through the IPsec-VPN connection.	None
Sip	String	No	Yes	The source IP address. This is the IP address that the on-premises data center can access through the IPsec-VPN connection.	None
Policy	String	No	Yes	Specifies whether to revoke the published route when the health check fails.	None

BgpConfig syntax

"BgpConfig": {
  "TunnelCidr": String,
  "LocalBgpIp": String,
  "EnableBgp": Boolean,
  "LocalAsn": Number
}

BgpConfig properties

Property Name	Type	Required	Update allowed	Description	Constraints
TunnelCidr	String	No	Yes	The BGP CIDR block of the tunnel.	None
LocalBgpIp	String	No	Yes	The BGP IP address on the Alibaba Cloud side of the tunnel.	None
EnableBgp	Boolean	No	No	Specifies whether to enable the BGP feature for the tunnel.	Valid values: true. false. The default value is false.
LocalAsn	Number	No	Yes	The autonomous system number (ASN) on the Alibaba Cloud side of the tunnel.	None

TunnelOptionsSpecification syntax

"TunnelOptionsSpecification": [
  {
    "RemoteCaCertificate": String,
    "CustomerGatewayId": String,
    "TunnelBgpConfig": Map,
    "TunnelIpsecConfig": Map,
    "EnableDpd": Boolean,
    "TunnelIkeConfig": Map,
    "EnableNatTraversal": Boolean,
    "Role": String
  }
]

TunnelOptionsSpecification properties

Property Name	Type	Required	Update allowed	Description	Constraints
RemoteCaCertificate	String	No	No	The CA certificate of the peer of the tunnel.	This parameter is returned only when the VPN Gateway instance is a ShangMi (SM) instance.
CustomerGatewayId	String	No	Yes	The ID of the customer gateway associated with the tunnel.	None
TunnelBgpConfig	Map	No	Yes	The BGP configuration of the tunnel.	For more information, see TunnelBgpConfig properties.
TunnelIpsecConfig	Map	No	No	The configuration of Phase 2 negotiation.	For more information, see TunnelIpsecConfig properties.
EnableDpd	Boolean	No	Yes	Specifies whether to enable the DPD feature for the IPsec-VPN connection.	Valid values: true: Enables the DPD feature. The initiator of the IPsec-VPN connection sends DPD packets to check the existence and availability of the peer. If the peer does not respond in a specific period of time, the connection is considered disconnected. The ISAKMP SA, IPsec SA, and the corresponding IPsec tunnel are deleted. false: Disables the DPD feature. The initiator of the IPsec-VPN connection does not send DPD packets.
TunnelIkeConfig	Map	No	Yes	The configuration of Phase 1 negotiation.	For more information, see TunnelIkeConfig properties.
EnableNatTraversal	Boolean	No	Yes	Specifies whether to enable the NAT traversal feature for the IPsec-VPN connection.	Valid values: true: Enables the NAT traversal feature. After you enable NAT traversal, the IKE negotiation process does not verify UDP ports. The system can also discover NAT Gateway devices in the VPN tunnel. false: Disables the NAT traversal feature.
Role	String	No	Yes	The role of the tunnel.	Valid values: master: The tunnel is a primary tunnel. slave: The tunnel is a standby tunnel.

TunnelBgpConfig syntax

"TunnelBgpConfig": {
  "TunnelCidr": String,
  "LocalAsn": Number,
  "LocalBgpIp": String
}

TunnelBgpConfig properties

Property name	Type	Required	Update allowed	Description	Constraints
TunnelCidr	String	No	Yes	The BGP CIDR block of the tunnel.	None
LocalBgpIp	String	No	Yes	The BGP IP address on the Alibaba Cloud side of the tunnel.	None
LocalAsn	Number	No	Yes	The ASN on the Alibaba Cloud side of the tunnel.	None

TunnelIpsecConfig syntax

"TunnelIpsecConfig": {
  "IpsecAuthAlg": String,
  "IpsecEncAlg": String,
  "IpsecPfs": String,
  "IpsecLifetime": Integer
}

TunnelIpsecConfig properties

Property Name	Type	Required	Update allowed	Description	Constraints
IpsecAuthAlg	String	No	Yes	The authentication algorithm for the IPsec phase.	None
IpsecEncAlg	String	No	Yes	The encryption algorithm for the IPsec phase.	None
IpsecPfs	String	No	Yes	Lifetime of an IPsec phase.	Unit: seconds.
IpsecLifetime	Integer	No	Yes	The autonomous system number (ASN) for the Alibaba Cloud side of the tunnel.	None

TunnelIkeConfig syntax

"TunnelIkeConfig": {
  "Psk": String,
  "IkePfs": String,
  "LocalId": String,
  "IkeVersion": String,
  "IkeAuthAlg": String,
  "IkeMode": String,
  "RemoteId": String,
  "IkeLifetime": Integer,
  "IkeEncAlg": String
}

TunnelIkeConfig properties

Property Name	Type	Required	Update allowed	Description	Constraints
Psk	String	No	Yes	The pre-shared key.	None
IkePfs	String	No	Yes	The DH group for the IKE phase.	None
LocalId	String	No	Yes	The identity on the Alibaba Cloud side of the tunnel.	None
IkeVersion	String	No	Yes	The version of the IKE protocol.	Valid values: ikev1 ikev2 Compared with IKEv1, IKEv2 simplifies the SA negotiation process and provides better support for multi-CIDR-block scenarios.
IkeAuthAlg	String	No	Yes	The authentication algorithm for the IKE phase.
IkeMode	String	No	Yes	The IKE negotiation mode.	Valid values: main: main mode. This mode offers higher security during negotiation. aggressive: aggressive mode. This mode is faster and has a higher success rate of negotiation.
RemoteId	String	No	Yes	The identity of the peer of the tunnel.	None
IkeLifetime	Integer	No	Yes	The lifetime of the IKE phase.	Unit: seconds.
IkeEncAlg	String	No	Yes	The encryption algorithm for the IKE phase.	None

Return values

Fn::GetAtt

VpnConnectionId: The ID of the IPsec-VPN connection.
Status: The status of the IPsec-VPN connection.
PeerVpnConnectionConfig: The connection configuration for the peer VPC.

Examples

YAML format

ROSTemplateFormatVersion: '2015-09-01'
Parameters:
  LocalSubnet:
    Type: String
    Description: >-
      The CIDR block of the VPC to be interconnected with the on-premises data center.
      This CIDR block is used for Phase 2 negotiation.
      Separate multiple CIDR blocks with commas (,). Example: 192.168.1.0/24,192.168.2.0/24.
  EffectImmediately:
    Type: Boolean
    Description: >-
      Specifies whether to delete the current IPsec tunnel and renegotiate.
      Valid values:
      True: Renegotiates immediately after the configuration is complete.
      False (default): Renegotiates when traffic is detected.
    AllowedValues:
      - 'True'
      - 'true'
      - 'False'
      - 'false'
    Default: false
  RemoteSubnet:
    Type: String
    Description: >-
      The CIDR block of the on-premises data center. This CIDR block is used for Phase 2 negotiation.
      Separate multiple CIDR blocks with commas (,). Example: 192.168.3.0/24,192.168.4.0/24.
  CustomerGatewayId:
    Type: String
    Description: The ID of the customer gateway.
  VpnGatewayId:
    Type: String
    Description: The ID of the VPN Gateway.
  IpsecConfig:
    Type: Json
    Description: The configuration of Phase 2 negotiation.
  HealthCheckConfig:
    Type: Json
    Description: The configuration of the health check.
  IkeConfig:
    Type: Json
    Description: The configuration of Phase 1 negotiation.
  Name:
    Type: String
    Description: >-
      The name of the IPsec-VPN connection.
      The name must be 2 to 128 characters in length. It must start with a letter or a Chinese character and cannot start with http:// or https://. The name can contain digits, periods (.), underscores (_), and hyphens (-).
    MinLength: 2
    MaxLength: 128
Resources:
  VpnConnection:
    Type: 'ALIYUN::VPC::VpnConnection'
    Properties:
      LocalSubnet:
        Ref: LocalSubnet
      EffectImmediately:
        Ref: EffectImmediately
      RemoteSubnet:
        Ref: RemoteSubnet
      CustomerGatewayId:
        Ref: CustomerGatewayId
      VpnGatewayId:
        Ref: VpnGatewayId
      IpsecConfig:
        Ref: IpsecConfig
      HealthCheckConfig:
        Ref: HealthCheckConfig
      IkeConfig:
        Ref: IkeConfig
      Name:
        Ref: Name
Outputs:
  Status:
    Description: The status of the IPsec-VPN connection.
    Value:
      'Fn::GetAtt':
        - VpnConnection
        - Status
  PeerVpnConnectionConfig:
    Description: The configuration of the peer VPC connection.
    Value:
      'Fn::GetAtt':
        - VpnConnection
        - PeerVpnConnectionConfig
  VpnConnectionId:
    Description: The ID of the IPsec-VPN connection.
    Value:
      'Fn::GetAtt':
        - VpnConnection
        - VpnConnectionId

JSON format

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Parameters": {
    "LocalSubnet": {
      "Type": "String",
      "Description": "The CIDR block of the VPC to be interconnected with the on-premises data center. This CIDR block is used for Phase 2 negotiation.\nSeparate multiple CIDR blocks with commas (,). Example: 192.168.1.0/24,192.168.2.0/24."
    },
    "EffectImmediately": {
      "Type": "Boolean",
      "Description": "Specifies whether to delete the current IPsec tunnel and renegotiate. Valid values:\nTrue: Renegotiates immediately after the configuration is complete.\nFalse (default): Renegotiates when traffic is detected.",
      "AllowedValues": [
        "True",
        "true",
        "False",
        "false"
      ],
      "Default": false
    },
    "RemoteSubnet": {
      "Type": "String",
      "Description": "The CIDR block of the on-premises data center. This CIDR block is used for Phase 2 negotiation.\nSeparate multiple CIDR blocks with commas (,). Example: 192.168.3.0/24,192.168.4.0/24."
    },
    "CustomerGatewayId": {
      "Type": "String",
      "Description": "The ID of the customer gateway."
    },
    "VpnGatewayId": {
      "Type": "String",
      "Description": "The ID of the VPN Gateway."
    },
    "IpsecConfig": {
      "Type": "Json",
      "Description": "The configuration of Phase 2 negotiation."
    },
    "HealthCheckConfig": {
      "Type": "Json",
      "Description": "The configuration of the health check."
    },
    "IkeConfig": {
      "Type": "Json",
      "Description": "The configuration of Phase 1 negotiation."
    },
    "Name": {
      "Type": "String",
      "Description": "The name of the IPsec-VPN connection.\nThe name must be 2 to 128 characters in length. It must start with a letter or a Chinese character and cannot start with http:// or https://. The name can contain digits, periods (.), underscores (_), and hyphens (-).",
      "MinLength": 2,
      "MaxLength": 128
    }
  },
  "Resources": {
    "VpnConnection": {
      "Type": "ALIYUN::VPC::VpnConnection",
      "Properties": {
        "LocalSubnet": {
          "Ref": "LocalSubnet"
        },
        "EffectImmediately": {
          "Ref": "EffectImmediately"
        },
        "RemoteSubnet": {
          "Ref": "RemoteSubnet"
        },
        "CustomerGatewayId": {
          "Ref": "CustomerGatewayId"
        },
        "VpnGatewayId": {
          "Ref": "VpnGatewayId"
        },
        "IpsecConfig": {
          "Ref": "IpsecConfig"
        },
        "HealthCheckConfig": {
          "Ref": "HealthCheckConfig"
        },
        "IkeConfig": {
          "Ref": "IkeConfig"
        },
        "Name": {
          "Ref": "Name"
        }
      }
    }
  },
  "Outputs": {
    "Status": {
      "Description": "The status of the IPsec-VPN connection.",
      "Value": {
        "Fn::GetAtt": [
          "VpnConnection",
          "Status"
        ]
      }
    },
    "PeerVpnConnectionConfig": {
      "Description": "The configuration of the peer VPC connection.",
      "Value": {
        "Fn::GetAtt": [
          "VpnConnection",
          "PeerVpnConnectionConfig"
        ]
      }
    },
    "VpnConnectionId": {
      "Description": "The ID of the IPsec-VPN connection.",
      "Value": {
        "Fn::GetAtt": [
          "VpnConnection",
          "VpnConnectionId"
        ]
      }
    }
  }
}