Skip to main content

ip_sec_connections

Creates, updates, deletes, gets or lists an ip_sec_connections resource.

Overview​

Nameip_sec_connections
TypeResource
Idoci.network.ip_sec_connections

Fields​

The following fields are returned by SELECT queries:

The information was retrieved.

NameDatatypeDescription
idstringThe IPSec connection's Oracle ID ([OCID](/iaas/Content/General/Concepts/identifiers.htm)).
compartmentIdstringThe [OCID](/iaas/Content/General/Concepts/identifiers.htm) of the compartment containing the IPSec connection.
cpeIdstringThe [OCID](/iaas/Content/General/Concepts/identifiers.htm) of the [Cpe](#/en/iaas/latest/Cpe/) object.
cpeLocalIdentifierstringYour identifier for your CPE device. Can be either an IP address or a hostname (specifically, the fully qualified domain name (FQDN)). The type of identifier here must correspond to the value for cpeLocalIdentifierType. If you don't provide a value when creating the IPSec connection, the ipAddress attribute for the [Cpe](#/en/iaas/latest/Cpe/) object specified by cpeId is used as the cpeLocalIdentifier. For information about why you'd provide this value, see [If Your CPE Is Behind a NAT Device](/iaas/Content/Network/Tasks/overviewIPsec.htm#nat). Example IP address: 10.0.3.3 Example hostname: cpe.example.com
cpeLocalIdentifierTypestringThe type of identifier for your CPE device. The value here must correspond to the value for cpeLocalIdentifier. (IP_ADDRESS, HOSTNAME)
definedTagsobjectDefined tags for this resource. Each key is predefined and scoped to a namespace. For more information, see [Resource Tags](/iaas/Content/General/Concepts/resourcetags.htm). Example: {"Operations": {"CostCenter": "42"}}
displayNamestringA user-friendly name. Does not have to be unique, and it's changeable. Avoid entering confidential information.
drgIdstringThe [OCID](/iaas/Content/General/Concepts/identifiers.htm) of the DRG.
freeformTagsobjectFree-form tags for this resource. Each tag is a simple key-value pair with no predefined name, type, or namespace. For more information, see [Resource Tags](/iaas/Content/General/Concepts/resourcetags.htm). Example: {"Department": "Finance"}
lifecycleStatestringThe IPSec connection's current state. (PROVISIONING, AVAILABLE, TERMINATING, TERMINATED)
staticRoutesarrayStatic routes to the CPE. The CIDR must not be a multicast address or class E address. Used for routing a given IPSec tunnel's traffic only if the tunnel is using static routing. If you configure at least one tunnel to use static routing, then you must provide at least one valid static route. If you configure both tunnels to use BGP dynamic routing, you can provide an empty list for the static routes. The CIDR can be either IPv4 or IPv6. IPv6 addressing is supported for all commercial and government regions. See [IPv6 Addresses](/iaas/Content/Network/Concepts/ipv6.htm). Example: 10.0.1.0/24 Example: 2001:db8::/32
timeCreatedstring (date-time)The date and time the IPSec connection was created, in the format defined by [RFC3339](https:​//tools.ietf.org/html/rfc3339). Example: 2016-08-25T21:10:29.600Z
transportTypestringThe transport type used for the IPSec connection. (INTERNET, FASTCONNECT) (default: INTERNET)

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
getselectipscId, regionGets the specified IPSec connection's basic information, including the static routes for the<br />on-premises router. If you want the status of the connection (whether it's up or down), use<br />[GetIPSecConnectionTunnel](#/en/iaas/latest/IPSecConnectionTunnel/GetIPSecConnectionTunnel).<br />
listselectcompartmentId, regiondrgId, cpeId, limit, pageLists the IPSec connections for the specified compartment. You can filter the<br />results by DRG or CPE.<br />
createinsertregion, compartmentId, drgId, cpeIdopc-retry-tokenCreates a new IPSec connection between the specified DRG and CPE. For more information, see<br />[Site-to-Site VPN Overview](/iaas/Content/Network/Tasks/overviewIPsec.htm).<br /><br />If you configure at least one tunnel to use static routing, then in the request you must provide<br />at least one valid static route (you're allowed a maximum of 10). For example: 10.0.0.0/16.<br />If you configure both tunnels to use BGP dynamic routing, you can provide an empty list for<br />the static routes. For more information, see the important note in<br />[IPSecConnection](#/en/iaas/latest/IPSecConnection/).<br /><br />For the purposes of access control, you must provide the [OCID](/iaas/Content/General/Concepts/identifiers.htm) of the compartment where you want the<br />IPSec connection to reside. Notice that the IPSec connection doesn't have to be in the same compartment<br />as the DRG, CPE, or other Networking Service components. If you're not sure which compartment to<br />use, put the IPSec connection in the same compartment as the DRG. For more information about<br />compartments and access control, see<br />[Overview of the IAM Service](/iaas/Content/Identity/Concepts/overview.htm).<br /><br />You may optionally specify a display name for the IPSec connection, otherwise a default is provided.<br />It does not have to be unique, and you can change it. Avoid entering confidential information.<br /><br />After creating the IPSec connection, you need to configure your on-premises router<br />with tunnel-specific information. For tunnel status and the required configuration information, see:<br /><br /> * [IPSecConnectionTunnel](#/en/iaas/latest/IPSecConnectionTunnel/)<br /> * [IPSecConnectionTunnelSharedSecret](#/en/iaas/latest/IPSecConnectionTunnelSharedSecret/)<br /><br />For each tunnel, you need the IP address of Oracle's VPN headend and the shared secret<br />(that is, the pre-shared key). For more information, see<br />[CPE Configuration](/iaas/Content/Network/Tasks/configuringCPE.htm).<br />
updateupdateipscId, regionif-matchUpdates the specified IPSec connection.<br /><br />To update an individual IPSec tunnel's attributes, use<br />[UpdateIPSecConnectionTunnel](#/en/iaas/latest/IPSecConnectionTunnel/UpdateIPSecConnectionTunnel).<br />
deletedeleteipscId, regionif-matchDeletes the specified IPSec connection. If your goal is to disable the Site-to-Site VPN between your VCN and<br />on-premises network, it's easiest to simply detach the DRG but keep all the Site-to-Site VPN components intact.<br />If you were to delete all the components and then later need to create an Site-to-Site VPN again, you would<br />need to configure your on-premises router again with the new information returned from<br />[CreateIPSecConnection](#/en/iaas/latest/IPSecConnection/CreateIPSecConnection).<br /><br />This is an asynchronous operation. The connection's lifecycleState will change to TERMINATING temporarily<br />until the connection is completely removed.<br />
change_compartmentexecipscId, region, compartmentIdopc-request-id, opc-retry-tokenMoves an IPSec connection into a different compartment within the same tenancy. For information<br />about moving resources between compartments, see<br />[Moving Resources to a Different Compartment](/iaas/Content/Identity/Tasks/managingcompartments.htm#moveRes).<br />

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
compartmentIdstringThe [OCID](/iaas/Content/General/Concepts/identifiers.htm) of the compartment.
ipscIdstringThe [OCID](/iaas/Content/General/Concepts/identifiers.htm) of the IPSec connection.
regionstringOCI region identifier (e.g. us-ashburn-1, ap-sydney-1); resolves from OCI_REGION when not supplied in the query. (default: us-ashburn-1, x-stackQL-envVar: OCI_REGION)
cpeIdstringThe [OCID](/iaas/Content/General/Concepts/identifiers.htm) of the CPE.
drgIdstringThe [OCID](/iaas/Content/General/Concepts/identifiers.htm) of the DRG.
if-matchstringFor optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource's current etag value.
limitintegerFor list pagination. The maximum number of results per page, or items to return in a paginated "List" call. For important details about how pagination works, see [List Pagination](/iaas/Content/API/Concepts/usingapi.htm#nine). Example: 50
opc-request-idstringUnique identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.
opc-retry-tokenstringA token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations (for example, if a resource has been deleted and purged from the system, then a retry of the original creation request may be rejected).
pagestringFor list pagination. The value of the opc-next-page response header from the previous "List" call. For important details about how pagination works, see [List Pagination](/iaas/Content/API/Concepts/usingapi.htm#nine).

SELECT examples​

Gets the specified IPSec connection's basic information, including the static routes for the<br />on-premises router. If you want the status of the connection (whether it's up or down), use<br />[GetIPSecConnectionTunnel](#/en/iaas/latest/IPSecConnectionTunnel/GetIPSecConnectionTunnel).<br />

SELECT
id,
compartmentId,
cpeId,
cpeLocalIdentifier,
cpeLocalIdentifierType,
definedTags,
displayName,
drgId,
freeformTags,
lifecycleState,
staticRoutes,
timeCreated,
transportType
FROM oci.network.ip_sec_connections
WHERE ipscId = '{{ ipscId }}' -- required
AND region = '{{ region }}' -- required
;

INSERT examples​

Creates a new IPSec connection between the specified DRG and CPE. For more information, see<br />[Site-to-Site VPN Overview](/iaas/Content/Network/Tasks/overviewIPsec.htm).<br /><br />If you configure at least one tunnel to use static routing, then in the request you must provide<br />at least one valid static route (you're allowed a maximum of 10). For example: 10.0.0.0/16.<br />If you configure both tunnels to use BGP dynamic routing, you can provide an empty list for<br />the static routes. For more information, see the important note in<br />[IPSecConnection](#/en/iaas/latest/IPSecConnection/).<br /><br />For the purposes of access control, you must provide the [OCID](/iaas/Content/General/Concepts/identifiers.htm) of the compartment where you want the<br />IPSec connection to reside. Notice that the IPSec connection doesn't have to be in the same compartment<br />as the DRG, CPE, or other Networking Service components. If you're not sure which compartment to<br />use, put the IPSec connection in the same compartment as the DRG. For more information about<br />compartments and access control, see<br />[Overview of the IAM Service](/iaas/Content/Identity/Concepts/overview.htm).<br /><br />You may optionally specify a display name for the IPSec connection, otherwise a default is provided.<br />It does not have to be unique, and you can change it. Avoid entering confidential information.<br /><br />After creating the IPSec connection, you need to configure your on-premises router<br />with tunnel-specific information. For tunnel status and the required configuration information, see:<br /><br /> * [IPSecConnectionTunnel](#/en/iaas/latest/IPSecConnectionTunnel/)<br /> * [IPSecConnectionTunnelSharedSecret](#/en/iaas/latest/IPSecConnectionTunnelSharedSecret/)<br /><br />For each tunnel, you need the IP address of Oracle's VPN headend and the shared secret<br />(that is, the pre-shared key). For more information, see<br />[CPE Configuration](/iaas/Content/Network/Tasks/configuringCPE.htm).<br />

INSERT INTO oci.network.ip_sec_connections (
compartmentId,
cpeId,
cpeLocalIdentifier,
cpeLocalIdentifierType,
definedTags,
displayName,
drgId,
freeformTags,
staticRoutes,
tunnelConfiguration,
region,
opc-retry-token
)
SELECT 
'{{ compartmentId }}' /* required */,
'{{ cpeId }}' /* required */,
'{{ cpeLocalIdentifier }}',
'{{ cpeLocalIdentifierType }}',
'{{ definedTags }}',
'{{ displayName }}',
'{{ drgId }}' /* required */,
'{{ freeformTags }}',
'{{ staticRoutes }}',
'{{ tunnelConfiguration }}',
'{{ region }}',
'{{ opc-retry-token }}'
RETURNING
id,
compartmentId,
cpeId,
cpeLocalIdentifier,
cpeLocalIdentifierType,
definedTags,
displayName,
drgId,
freeformTags,
lifecycleState,
staticRoutes,
timeCreated,
transportType
;

UPDATE examples​

Updates the specified IPSec connection.<br /><br />To update an individual IPSec tunnel's attributes, use<br />[UpdateIPSecConnectionTunnel](#/en/iaas/latest/IPSecConnectionTunnel/UpdateIPSecConnectionTunnel).<br />

UPDATE oci.network.ip_sec_connections
SET 
cpeLocalIdentifier = '{{ cpeLocalIdentifier }}',
cpeLocalIdentifierType = '{{ cpeLocalIdentifierType }}',
definedTags = '{{ definedTags }}',
displayName = '{{ displayName }}',
freeformTags = '{{ freeformTags }}',
staticRoutes = '{{ staticRoutes }}'
WHERE 
ipscId = '{{ ipscId }}' --required
AND region = '{{ region }}' --required
AND if-match = '{{ if-match}}'
RETURNING
id,
compartmentId,
cpeId,
cpeLocalIdentifier,
cpeLocalIdentifierType,
definedTags,
displayName,
drgId,
freeformTags,
lifecycleState,
staticRoutes,
timeCreated,
transportType;

DELETE examples​

Deletes the specified IPSec connection. If your goal is to disable the Site-to-Site VPN between your VCN and<br />on-premises network, it's easiest to simply detach the DRG but keep all the Site-to-Site VPN components intact.<br />If you were to delete all the components and then later need to create an Site-to-Site VPN again, you would<br />need to configure your on-premises router again with the new information returned from<br />[CreateIPSecConnection](#/en/iaas/latest/IPSecConnection/CreateIPSecConnection).<br /><br />This is an asynchronous operation. The connection's lifecycleState will change to TERMINATING temporarily<br />until the connection is completely removed.<br />

DELETE FROM oci.network.ip_sec_connections
WHERE ipscId = '{{ ipscId }}' --required
AND region = '{{ region }}' --required
AND if-match = '{{ if-match }}'
;

Lifecycle Methods​

Moves an IPSec connection into a different compartment within the same tenancy. For information<br />about moving resources between compartments, see<br />[Moving Resources to a Different Compartment](/iaas/Content/Identity/Tasks/managingcompartments.htm#moveRes).<br />

EXEC oci.network.ip_sec_connections.change_compartment 
@ipscId='{{ ipscId }}' --required, 
@region='{{ region }}' --required, 
@opc-request-id='{{ opc-request-id }}', 
@opc-retry-token='{{ opc-retry-token }}' 
@@json=
'{
"compartmentId": "{{ compartmentId }}"
}'
;