.. _vpn_ipsec:

vpn ipsec
=========

IPsec settings


ipsec Specification
-------------------

	===================================== =========================================================
	 **Parameter**                         **Value** 

	===================================== =========================================================
	 **Type**                              *Collection*

	 **Object Key(s)**                     *name*

	 **Collection Name**                   :ref:`4087_ipsec_list`

	 **Collection URI**                    /axapi/v3/vpn/ipsec

	                                       

	 **Element Name**                      ipsec

	 **Element URI**                       /axapi/v3/vpn/ipsec/{name}

	 **Element Attributes**                ipsec_attributes

	 **Partition Visibility**              shared

	 **Statistics Data URI**               /axapi/v3/vpn/ipsec/{name}/stats

	 **Operational Data URI**              /axapi/v3/vpn/ipsec/{name}/oper

	 **Schema**                             :download:`ipsec schema <vpn-ipsec/vpn-ipsec.txt>`
	===================================== =========================================================





	**Operations Allowed:**




.. raw:: html

   <script type="text/javascript">
 function showExample(a,b) { document.getElementById(a+'_div').style.display = 'block'; document.getElementById(a+'_cl').style.display = 'block'; document.getElementById(a+'_eg').style.display = 'none';}
   function closeExample(a,b) { document.getElementById(a+'_div').style.display = 'none'; document.getElementById(a+'_cl').style.display = 'none'; document.getElementById(a+'_eg').style.display = 'block';}
 </script>
   <table width='90%' style='margin-left:5%'>



.. raw:: html

   <tr style='border-bottom: thin solid; border-top: thin solid'><th width=15%>Operation</th><th width=10%>Method</th><th>URI</th><th width=15%>Payload</th><th width=10%></th></tr>




.. raw:: html

   <tr  style='border-bottom: thin solid;'><td valign = 'top'>


Create Object



.. raw:: html

   </td><td valign = 'top'>


POST



.. raw:: html

   </td><td valign = 'top'>


/axapi/v3/vpn/ipsec



.. raw:: html

   </td><td valign = 'top'>


:ref:`4087_ipsec_attributes`



.. raw:: html

   </td><td><button id='post_eg' onClick="showExample('post')">example</button> <button id='post_cl' onClick="closeExample('post')" style='display:none'>close</button></td></tr>




.. raw:: html

   <tr><td colspan=5 style='padding: 0         % 0    %;' valign = 'top'><div id='post_div' style='display:none'>


.. include:: ../artifacts/vpn_ipsec_POST.txt
   :literal:




.. raw:: html

   </div></td></tr>


.. raw:: html

   <tr  style='border-bottom: thin solid;'><td valign = 'top'>


Create List



.. raw:: html

   </td><td valign = 'top'>


POST



.. raw:: html

   </td><td valign = 'top'>


/axapi/v3/vpn/ipsec



.. raw:: html

   </td><td valign = 'top'>


:ref:`4087_ipsec_attributes`



.. raw:: html

   </td><td></td></tr>




.. raw:: html

   <tr  style='border-bottom: thin solid;'><td valign = 'top'>


Get Object



.. raw:: html

   </td><td valign = 'top'>


GET



.. raw:: html

   </td><td valign = 'top'>


/axapi/v3/vpn/ipsec/{name}



.. raw:: html

   </td><td valign = 'top'>


:ref:`4087_ipsec_attributes`



.. raw:: html

   </td><td></td></tr>




.. raw:: html

   <tr  style='border-bottom: thin solid;'><td valign = 'top'>


Get List



.. raw:: html

   </td><td valign = 'top'>


GET



.. raw:: html

   </td><td valign = 'top'>


/axapi/v3/vpn/ipsec



.. raw:: html

   </td><td valign = 'top'>


:ref:`4087_ipsec_list`



.. raw:: html

   </td><td></td></tr>




.. raw:: html

   <tr  style='border-bottom: thin solid;'><td valign = 'top'>


Modify Object



.. raw:: html

   </td><td valign = 'top'>


POST



.. raw:: html

   </td><td valign = 'top'>


/axapi/v3/vpn/ipsec/{name}



.. raw:: html

   </td><td valign = 'top'>


:ref:`4087_ipsec_attributes`



.. raw:: html

   </td><td></td></tr>




.. raw:: html

   <tr  style='border-bottom: thin solid;'><td valign = 'top'>


Replace Object



.. raw:: html

   </td><td valign = 'top'>


PUT



.. raw:: html

   </td><td valign = 'top'>


/axapi/v3/vpn/ipsec/{name}



.. raw:: html

   </td><td valign = 'top'>


:ref:`4087_ipsec_attributes`



.. raw:: html

   </td><td></td></tr>




.. raw:: html

   <tr  style='border-bottom: thin solid;'><td valign = 'top'>


Replace List



.. raw:: html

   </td><td valign = 'top'>


PUT



.. raw:: html

   </td><td valign = 'top'>


/axapi/v3/vpn/ipsec



.. raw:: html

   </td><td valign = 'top'>


:ref:`4087_ipsec_list`



.. raw:: html

   </td><td></td></tr>




.. raw:: html

   <tr  style='border-bottom: thin solid;'><td valign = 'top'>


Delete Object



.. raw:: html

   </td><td valign = 'top'>


DELETE



.. raw:: html

   </td><td valign = 'top'>


/axapi/v3/vpn/ipsec/{name}



.. raw:: html

   </td><td valign = 'top'>


:ref:`4087_ipsec_attributes`



.. raw:: html

   </td><td></td></tr>




.. raw:: html

   </table>

.. _4087_ipsec_list:

ipsec-list
----------


    ipsec-list is **JSON List** of :ref:`4087_ipsec_attributes` 

        ipsec-list : [

             { :ref:`4087_ipsec_attributes` },

             { :ref:`4087_ipsec_attributes` },

             ...

         ]

.. _4087_ipsec_attributes:

ipsec attributes
----------------

    **anti-replay-window**

        **Description** '0': Disable Anti-Replay Window Check; '32': Window size of 32; '64': Window size of 64; '128': Window size of 128; '256': Window size of 256; '512': Window size of 512; '1024': Window size of 1024; '2048': Window size of 2048; '3072': Window size of 3072; '4096': Window size of 4096; '8192': Window size of 8192; 

        **Type:** string

        **Supported Values:** 0, 32, 64, 128, 256, 512, 1024, 2048, 3072, 4096, 8192

        **Default:** 0

    **bind-tunnel**

        **Description:** bind-tunnel is a **JSON Block**.  Please see below for :ref:`4087_bind-tunnel` 

        **Type:** Object

        **Reference Object:** :doc:`/axapi/v3/vpn/ipsec/{name}/bind-tunnel <vpn_ipsec>`

    **dh-group**

        **Description** '0': Diffie-Hellman group 0 (Default); '1': Diffie-Hellman group 1 - 768-bits; '2': Diffie-Hellman group 2 - 1024-bits; '5': Diffie-Hellman group 5 - 1536-bits; '14': Diffie-Hellman group 14 - 2048-bits; '15': Diffie-Hellman group 15 - 3072-bits; '16': Diffie-Hellman group 16 - 4096-bits; '18': Diffie-Hellman group 18 - 8192-bits; '19': Diffie-Hellman group 19 - 256-bit Elliptic Curve; '20': Diffie-Hellman group 20 - 384-bit Elliptic Curve; 

        **Type:** string

        **Supported Values:** 0, 1, 2, 5, 14, 15, 16, 18, 19, 20

        **Default:** 0

    **dscp**

        **Description** 'default': Default dscp (000000); 'af11': AF11 (001010); 'af12': AF12 (001100); 'af13': AF13 (001110); 'af21': AF21 (010010); 'af22': AF22 (010100); 'af23': AF23 (010110); 'af31': AF31 (011010); 'af32': AF32 (011100); 'af33': AF33 (011110); 'af41': AF41 (100010); 'af42': AF42 (100100); 'af43': AF43 (100110); 'cs1': CS1 (001000); 'cs2': CS2 (010000); 'cs3': CS3 (011000); 'cs4': CS4 (100000); 'cs5': CS5 (101000); 'cs6': CS6 (110000); 'cs7': CS7 (111000); 'ef': EF (101110); '0': 000000; '1': 000001; '2': 000010; '3': 000011; '4': 000100; '5': 000101; '6': 000110; '7': 000111; '8': 001000; '9': 001001; '10': 001010; '11': 001011; '12': 001100; '13': 001101; '14': 001110; '15': 001111; '16': 010000; '17': 010001; '18': 010010; '19': 010011; '20': 010100; '21': 010101; '22': 010110; '23': 010111; '24': 011000; '25': 011001; '26': 011010; '27': 011011; '28': 011100; '29': 011101; '30': 011110; '31': 011111; '32': 100000; '33': 100001; '34': 100010; '35': 100011; '36': 100100; '37': 100101; '38': 100110; '39': 100111; '40': 101000; '41': 101001; '42': 101010; '43': 101011; '44': 101100; '45': 101101; '46': 101110; '47': 101111; '48': 110000; '49': 110001; '50': 110010; '51': 110011; '52': 110100; '53': 110101; '54': 110110; '55': 110111; '56': 111000; '57': 111001; '58': 111010; '59': 111011; '60': 111100; '61': 111101; '62': 111110; '63': 111111; 

        **Type:** string

        **Supported Values:** default, af11, af12, af13, af21, af22, af23, af31, af32, af33, af41, af42, af43, cs1, cs2, cs3, cs4, cs5, cs6, cs7, ef, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63

    **enc-cfg**

        **Type:** List

    **enforce-traffic-selector**

        **Description** Enforce Traffic Selector

        **Type:** boolean

        **Supported Values:** true, false, 1, 0

        **Default:** 0

    **ipsec-gateway**

        **Description:** ipsec-gateway is a **JSON Block**.  Please see below for :ref:`4087_ipsec-gateway` 

        **Type:** Object

        **Reference Object:** :doc:`/axapi/v3/vpn/ipsec/{name}/ipsec-gateway <vpn_ipsec>`

    **lifebytes**

        **Description** IPsec SA age in megabytes (0 indicates unlimited bytes)

        **Type:** number

        **Range:** 0-8000000

        **Default:** 0

    **lifetime**

        **Description** IPsec SA age in seconds

        **Type:** number

        **Range:** 300-28800

        **Default:** 28800

    **mode**

        **Description** 'tunnel': Encapsulating the packet in IPsec tunnel mode (Default); 

        **Type:** string

        **Supported Values:** tunnel

        **Default:** tunnel

    **name**

        **Description** IPsec name

        **Type:** string

        **Maximum Length:** 31 characters

        **Maximum Length:** 1 characters

    **proto**

        **Description** 'esp': Encapsulating security protocol (Default); 

        **Type:** string

        **Supported Values:** esp

        **Default:** esp

    **sampling-enable**

        **Type:** List

    **sequence-number-disable**

        **Description** Do not use incremental sequence number in the ESP header

        **Type:** boolean

        **Supported Values:** true, false, 1, 0

        **Default:** 0

    **traffic-selector**

        **Description:** traffic-selector is a **JSON Block**.  Please see below for :ref:`4087_traffic-selector` 

        **Type:** Object

    **up**

        **Description** Initiates SA negotiation to bring the IPsec connection up

        **Type:** boolean

        **Supported Values:** true, false, 1, 0

        **Default:** 0

    **user-tag**

        **Description** Customized tag

        **Type:** string

        **Format:** string-rlx

        **Maximum Length:** 127 characters

        **Maximum Length:** 1 characters

    **uuid**

        **Description** uuid of the object

        **Type:** string

        **Maximum Length:** 64 characters

        **Maximum Length:** 1 characters

.. _4087_traffic-selector:

traffic-selector
^^^^^^^^^^^^^^^^
	=============================== ===================================================
	**Specification**                 **Value**
	=============================== ===================================================
	 **Type**                        *object*

	=============================== ===================================================

    **ipv4**

        **Description:** ipv4 is a **JSON Block**.  Please see below for :ref:`4087_traffic-selector_ipv4` 

        **Type:** Object

    **ipv6**

        **Description:** ipv6 is a **JSON Block**.  Please see below for :ref:`4087_traffic-selector_ipv6` 

        **Type:** Object

.. _4087_traffic-selector_ipv4:

traffic-selector_ipv4
^^^^^^^^^^^^^^^^^^^^^
	=============================== ===================================================
	**Specification**                 **Value**
	=============================== ===================================================
	 **Type**                        *object*

	=============================== ===================================================

    **local**

        **Description** Local Traffic Selector

        **Type:** string

        **Format:** ipv4-address

        **Mutual Exclusion:** local and localv6 are mutually exclusive

    **local_netmask**

        **Description** IPv4 Address Network Mask

        **Type:** string

        **Format:** ipv4-netmask

    **local_port**

        **Description** Port Number

        **Type:** number

        **Range:** 0-65535

    **protocol**

        **Description** IP Protocol Number (0-255)

        **Type:** number

        **Range:** 0-255

    **remote-ip**

        **Description** IPv4 Address

        **Type:** string

        **Format:** ipv4-address

        **Mutual Exclusion:** remote-ip and remote-ipv4-assigned are mutually exclusive

    **remote-ipv4-assigned**

        **Description** Remote IP address assigned

        **Type:** boolean

        **Supported Values:** true, false, 1, 0

        **Default:** 0

        **Mutual Exclusion:** remote-ipv4-assigned and remote-ip are mutually exclusive

    **remote_netmask**

        **Description** IPv4 Address Network Mask

        **Type:** string

        **Format:** ipv4-netmask

    **remote_port**

        **Description** Port Number

        **Type:** number

        **Range:** 0-65535

.. _4087_traffic-selector_ipv6:

traffic-selector_ipv6
^^^^^^^^^^^^^^^^^^^^^
	=============================== ===================================================
	**Specification**                 **Value**
	=============================== ===================================================
	 **Type**                        *object*

	=============================== ===================================================

    **local_portv6**

        **Description** Port Number

        **Type:** number

        **Range:** 0-65535

    **localv6**

        **Description** Local Traffic Selector

        **Type:** string

        **Format:** ipv6-address-plen

        **Mutual Exclusion:** localv6 and local are mutually exclusive

    **protocolv6**

        **Description** IP Protocol Number (0-255)

        **Type:** number

        **Range:** 0-255

    **remote-ipv6**

        **Description** IPv6 Address

        **Type:** string

        **Format:** ipv6-address-plen

        **Mutual Exclusion:** remote-ipv6 and remote-ipv6-assigned are mutually exclusive

    **remote-ipv6-assigned**

        **Description** Remote IPv6 address assigned

        **Type:** boolean

        **Supported Values:** true, false, 1, 0

        **Default:** 0

        **Mutual Exclusion:** remote-ipv6-assigned and remote-ipv6 are mutually exclusive

    **remote_portv6**

        **Description** Port Number

        **Type:** number

        **Range:** 0-65535

.. _4087_bind-tunnel:

bind-tunnel
^^^^^^^^^^^
	=============================== ===================================================
	**Specification**                 **Value**
	=============================== ===================================================
	 **Type**                        *object*

	=============================== ===================================================

    **next-hop**

        **Description** IPsec Next Hop IP Address

        **Type:** string

        **Format:** ipv4-address

        **Mutual Exclusion:** next-hop and next-hop-v6 are mutually exclusive

    **next-hop-v6**

        **Description** IPsec Next Hop IPv6 Address

        **Type:** string

        **Format:** ipv6-address

        **Mutual Exclusion:** next-hop-v6 and next-hop are mutually exclusive

    **tunnel**

        **Description** Tunnel interface index

        **Type:** number

        **Range:** 1-128

        **Reference Object:** :doc:`/axapi/v3/interface/tunnel <interface_tunnel>`

    **uuid**

        **Description** uuid of the object

        **Type:** string

        **Maximum Length:** 64 characters

        **Maximum Length:** 1 characters

.. _4087_sampling-enable:

sampling-enable
^^^^^^^^^^^^^^^
	=============================== ===================================================
	**Specification**                 **Value**
	=============================== ===================================================
	 **Type**                        *list*

	 **Block object keys**             

	=============================== ===================================================

    **counters1**

        **Description** 'all': all; 'packets-encrypted': Encrypted Packets; 'packets-decrypted': Decrypted Packets; 'anti-replay-num': Anti-Replay Failure; 'rekey-num': Rekey Times; 'packets-err-inactive': Inactive Error; 'packets-err-encryption': Encryption Error; 'packets-err-pad-check': Pad Check Error; 'packets-err-pkt-sanity': Packets Sanity Error; 'packets-err-icv-check': ICV Check Error; 'packets-err-lifetime-lifebytes': Lifetime Lifebytes Error; 'bytes-encrypted': Encrypted Bytes; 'bytes-decrypted': Decrypted Bytes; 'prefrag-success': Pre-frag Success; 'prefrag-error': Pre-frag Error; 'cavium-bytes-encrypted': CAVIUM Encrypted Bytes; 'cavium-bytes-decrypted': CAVIUM Decrypted Bytes; 'cavium-packets-encrypted': CAVIUM Encrypted Packets; 'cavium-packets-decrypted': CAVIUM Decrypted Packets; 'qat-bytes-encrypted': QAT Encrypted Bytes; 'qat-bytes-decrypted': QAT Decrypted Bytes; 'qat-packets-encrypted': QAT Encrypted Packets; 'qat-packets-decrypted': QAT Decrypted Packets; 'tunnel-intf-down': Packet dropped: Tunnel Interface Down; 'pkt-fail-prep-to-send': Packet dropped: Failed in prepare to send; 'no-next-hop': Packet dropped: No next hop; 'invalid-tunnel-id': Packet dropped: Invalid tunnel ID; 'no-tunnel-found': Packet dropped: No tunnel found; 'pkt-fail-to-send': Packet dropped: Failed to send; 'frag-after-encap-frag-packets': Frag-after-encap Fragment Generated; 'frag-received': Fragment Received; 'sequence-num': Sequence Number; 'sequence-num-rollover': Sequence Number Rollover; 'packets-err-nh-check': Next Header Check Error; 

        **Type:** string

        **Supported Values:** all, packets-encrypted, packets-decrypted, anti-replay-num, rekey-num, packets-err-inactive, packets-err-encryption, packets-err-pad-check, packets-err-pkt-sanity, packets-err-icv-check, packets-err-lifetime-lifebytes, bytes-encrypted, bytes-decrypted, prefrag-success, prefrag-error, cavium-bytes-encrypted, cavium-bytes-decrypted, cavium-packets-encrypted, cavium-packets-decrypted, qat-bytes-encrypted, qat-bytes-decrypted, qat-packets-encrypted, qat-packets-decrypted, tunnel-intf-down, pkt-fail-prep-to-send, no-next-hop, invalid-tunnel-id, no-tunnel-found, pkt-fail-to-send, frag-after-encap-frag-packets, frag-received, sequence-num, sequence-num-rollover, packets-err-nh-check

.. _4087_ipsec-gateway:

ipsec-gateway
^^^^^^^^^^^^^
	=============================== ===================================================
	**Specification**                 **Value**
	=============================== ===================================================
	 **Type**                        *object*

	=============================== ===================================================

    **ike-gateway**

        **Description** Gateway to use for IPsec SA

        **Type:** string

        **Maximum Length:** 31 characters

        **Maximum Length:** 1 characters

        **Reference Object:** :doc:`/axapi/v3/vpn/ike-gateway <vpn_ike_gateway>`

    **uuid**

        **Description** uuid of the object

        **Type:** string

        **Maximum Length:** 64 characters

        **Maximum Length:** 1 characters

.. _4087_enc-cfg:

enc-cfg
^^^^^^^
	=============================== ===================================================
	**Specification**                 **Value**
	=============================== ===================================================
	 **Type**                        *list*

	 **Block object keys**             

	=============================== ===================================================

    **encryption**

        **Description** 'des': Data Encryption Standard algorithm; '3des': Triple Data Encryption Standard algorithm; 'aes-128': Advanced Encryption Standard algorithm CBC Mode(key size: 128 bits); 'aes-192': Advanced Encryption Standard algorithm CBC Mode(key size: 192 bits); 'aes-256': Advanced Encryption Standard algorithm CBC Mode(key size: 256 bits); 'aes-gcm-128': Advanced Encryption Standard algorithm Galois/Counter Mode(key size: 128 bits, ICV size: 16 bytes); 'aes-gcm-192': Advanced Encryption Standard algorithm Galois/Counter Mode(key size: 192 bits, ICV size: 16 bytes); 'aes-gcm-256': Advanced Encryption Standard algorithm Galois/Counter Mode(key size: 256 bits, ICV size: 16 bytes); 'null': No encryption algorithm; 

        **Type:** string

        **Supported Values:** des, 3des, aes-128, aes-192, aes-256, aes-gcm-128, aes-gcm-192, aes-gcm-256, null

    **gcm_priority**

        **Description** Prioritizes (1-10) security protocol, least value has highest priority

        **Type:** number

        **Range:** 1-10

        **Default:** 5

    **hash**

        **Description** 'md5': MD5 Dessage-Digest Algorithm; 'sha1': Secure Hash Algorithm 1; 'sha256': Secure Hash Algorithm 256; 'sha384': Secure Hash Algorithm 384; 'sha512': Secure Hash Algorithm 512; 'null': No hash algorithm; 

        **Type:** string

        **Supported Values:** md5, sha1, sha256, sha384, sha512, null

    **priority**

        **Description** Prioritizes (1-10) security protocol, least value has highest priority

        **Type:** number

        **Range:** 1-10

        **Default:** 5