az network vpn-connection ipsec-policy

Manage VPN connection IPSec policies.

Commands

az network vpn-connection ipsec-policy add

Add a VPN connection IPSec policy.
az network vpn-connection ipsec-policy clear

Delete all IPsec policies on a VPN connection.
az network vpn-connection ipsec-policy list

List IPSec policies associated with a VPN connection.

az network vpn-connection ipsec-policy add

Edit

Add a VPN connection IPSec policy.

Set all IPsec policies of a VPN connection. If you want to set any IPsec policy, you must set them all.

az network vpn-connection ipsec-policy add --connection-name
                                           --dh-group {DHGroup1, DHGroup14, DHGroup2, DHGroup2048, DHGroup24, ECP256, ECP384, None}
                                           --ike-encryption {AES128, AES192, AES256, DES, DES3, GCMAES128, GCMAES256}
                                           --ike-integrity {GCMAES128, GCMAES256, MD5, SHA1, SHA256, SHA384}
                                           --ipsec-encryption {AES128, AES192, AES256, DES, DES3, GCMAES128, GCMAES192, GCMAES256, None}
                                           --ipsec-integrity {GCMAES128, GCMAES192, GCMAES256, MD5, SHA1, SHA256}
                                           --pfs-group {ECP256, ECP384, None, PFS1, PFS14, PFS2, PFS2048, PFS24, PFSMM}
                                           --resource-group
                                           --sa-lifetime
                                           --sa-max-size
                                           [--no-wait]
                                           [--subscription]

Examples

Add specified IPsec policies to a connection instead of relying on defaults.

az network vpn-connection ipsec-policy add -g MyResourceGroup --connection-name MyConnection \
    --dh-group DHGroup14 --ike-encryption AES256 --ike-integrity SHA384 --ipsec-encryption DES3 \
    --ipsec-integrity GCMAES256 --pfs-group PFS2048 --sa-lifetime 27000 --sa-max-size 102400000

Required Parameters

--connection-name

Connection name.

--dh-group

Required. The DH Group used in IKE Phase 1 for initial SA.

accepted values: DHGroup1, DHGroup14, DHGroup2, DHGroup2048, DHGroup24, ECP256, ECP384, None
--ike-encryption

Required. The IKE encryption algorithm (IKE phase 2).

accepted values: AES128, AES192, AES256, DES, DES3, GCMAES128, GCMAES256
--ike-integrity

Required. The IKE integrity algorithm (IKE phase 2).

accepted values: GCMAES128, GCMAES256, MD5, SHA1, SHA256, SHA384
--ipsec-encryption

Required. The IPSec encryption algorithm (IKE phase 1).

accepted values: AES128, AES192, AES256, DES, DES3, GCMAES128, GCMAES192, GCMAES256, None
--ipsec-integrity

Required. The IPSec integrity algorithm (IKE phase 1).

accepted values: GCMAES128, GCMAES192, GCMAES256, MD5, SHA1, SHA256
--pfs-group

Required. The Pfs Group used in IKE Phase 2 for new child SA.

accepted values: ECP256, ECP384, None, PFS1, PFS14, PFS2, PFS2048, PFS24, PFSMM
--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--sa-lifetime

Required. The IPSec Security Association (also called Quick Mode or Phase 2 SA) lifetime in seconds for a site to site VPN tunnel.

--sa-max-size

Required. The IPSec Security Association (also called Quick Mode or Phase 2 SA) payload size in KB for a site to site VPN tunnel.

Optional Parameters

--no-wait

Do not wait for the long-running operation to finish.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

az network vpn-connection ipsec-policy clear

Edit

Delete all IPsec policies on a VPN connection.

az network vpn-connection ipsec-policy clear --connection-name
                                             --resource-group
                                             [--no-wait]
                                             [--subscription]

Examples

Remove all previously specified IPsec policies from a connection.

az network vpn-connection ipsec-policy clear -g MyResourceGroup --connection-name MyConnection

Required Parameters

--connection-name

Connection name.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

--no-wait

Do not wait for the long-running operation to finish.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

az network vpn-connection ipsec-policy list

Edit

List IPSec policies associated with a VPN connection.

az network vpn-connection ipsec-policy list --connection-name
                                            --resource-group
                                            [--query-examples]
                                            [--subscription]

Examples

List the IPsec policies set on a connection.

az network vpn-connection ipsec-policy list -g MyResourceGroup --connection-name MyConnection

Required Parameters

--connection-name

Connection name.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

--query-examples

Recommend JMESPath string for you. You can copy one of the query and paste it after --query parameter within double quotation marks to see the results. You can add one or more positional keywords so that we can give suggestions based on these key words.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.