VpnAttachmentProps

Properties for defining a VpnAttachment.

See https://www.alibabacloud.com/help/ros/developer-reference/aliyun-vpc-vpnattachment

Initializer

import ros_cdk_vpc
ros_cdk_vpc.VpnAttachmentProps(
  local_subnet: typing.Union[str, IResolvable],
  remote_subnet: typing.Union[str, IResolvable],
  auto_config_route: typing.Union[bool, IResolvable] = None,
  bgp_config: typing.Union[IResolvable, BgpConfigProperty] = None,
  customer_gateway_id: typing.Union[str, IResolvable] = None,
  effect_immediately: typing.Union[bool, IResolvable] = None,
  enable_dpd: typing.Union[bool, IResolvable] = None,
  enable_nat_traversal: typing.Union[bool, IResolvable] = None,
  enable_tunnels_bgp: typing.Union[bool, IResolvable] = None,
  health_check_config: typing.Union[IResolvable, HealthCheckConfigProperty] = None,
  ike_config: typing.Union[IResolvable, IkeConfigProperty] = None,
  ipsec_config: typing.Union[IResolvable, IpsecConfigProperty] = None,
  name: typing.Union[str, IResolvable] = None,
  network_type: typing.Union[str, IResolvable] = None,
  remote_ca_cert: typing.Union[str, IResolvable] = None,
  resource_group_id: typing.Union[str, IResolvable] = None,
  tunnel_bandwidth: typing.Union[str, IResolvable] = None,
  tunnel_options_specification: typing.Union[IResolvable, typing.List[typing.Union[IResolvable, TunnelOptionsSpecificationProperty]]] = None
)

Properties

local_subnet^Required

local_subnet: typing.Union[str, IResolvable]

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property localSubnet: The CIDR block on the VPC side.

The CIDR block is used in Phase 2 negotiations. Separate multiple CIDR blocks with commas (,). Example: 192.168.1.0/24,192.168.2.0/24. The following routing modes are supported:

• If you set LocalSubnet and RemoteSubnet to 0.0.0.0/0, the routing mode of the IPsec-VPN connection is set to Destination Routing Mode.
• If you set LocalSubnet and RemoteSubnet to specific CIDR blocks, the routing mode of the IPsec-VPN connection is set to Protected Data Flows.

remote_subnet^Required

remote_subnet: typing.Union[str, IResolvable]

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property remoteSubnet: The CIDR block on the data center side.

This CIDR block is used in Phase 2 negotiations. Separate multiple CIDR blocks with commas (,). Example: 192.168.3.0/24,192.168.4.0/24. The following routing modes are supported:

• If you set LocalSubnet and RemoteSubnet to 0.0.0.0/0, the routing mode of the IPsec-VPN connection is set to Destination Routing Mode.
• If you set LocalSubnet and RemoteSubnet to specific CIDR blocks, the routing mode of the IPsec-VPN connection is set to Protected Data Flows.

auto_config_route^Optional

auto_config_route: typing.Union[bool, IResolvable]

• Type: typing.Union[bool, ros_cdk_core.IResolvable]

Property autoConfigRoute: Specifies whether to automatically configure routes.

Valid values: true (default) false

bgp_config^Optional

bgp_config: typing.Union[IResolvable, BgpConfigProperty]

• Type: typing.Union[ros_cdk_core.IResolvable, BgpConfigProperty]

Property bgpConfig: The Border Gateway Protocol (BGP) configuration.

This parameter is required when the VPN gateway has dynamic BGP enabled. Before you configure BGP, we recommend that you learn about how BGP works and its limits. For more information, see VPN Gateway supports BGP dynamic routing. We recommend that you use a private ASN to establish a connection with Alibaba Cloud over BGP. Refer to the relevant documentation for the private ASN range.

customer_gateway_id^Optional

customer_gateway_id: typing.Union[str, IResolvable]

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property customerGatewayId: The ID of the user gateway.

effect_immediately^Optional

effect_immediately: typing.Union[bool, IResolvable]

• Type: typing.Union[bool, ros_cdk_core.IResolvable]

Property effectImmediately: Whether to delete the currently negotiated IPsec tunnel and re-initiate the negotiation.

Value: True: Negotiate immediately after the configuration is complete. False (default): Negotiate when traffic enters.

enable_dpd^Optional

enable_dpd: typing.Union[bool, IResolvable]

• Type: typing.Union[bool, ros_cdk_core.IResolvable]

Property enableDpd: Specifies whether to enable the dead peer detection (DPD) feature.

Valid values: true (default) The initiator of the IPsec-VPN connection sends DPD packets to verify the existence and availability of the peer. If no response is received from the peer within a specified period of time, the connection fails. ISAKMP SAs and IPsec SAs are deleted. The IPsec tunnel is also deleted. false: disables DPD. The IPsec initiator does not send DPD packets.

enable_nat_traversal^Optional

enable_nat_traversal: typing.Union[bool, IResolvable]

• Type: typing.Union[bool, ros_cdk_core.IResolvable]

Property enableNatTraversal: Specifies whether to enable NAT traversal.

Valid values: true (default) After NAT traversal is enabled, the initiator does not check the UDP ports during IKE negotiations and can automatically discover NAT gateway devices along the VPN tunnel. false

enable_tunnels_bgp^Optional

enable_tunnels_bgp: typing.Union[bool, IResolvable]

• Type: typing.Union[bool, ros_cdk_core.IResolvable]

Property enableTunnelsBgp: Support configuring this parameter when creating dual-tunnel mode IPsec-VPN connections.

Whether to enable BGP function for the tunnel. Values: true or false (default value).

Before adding BGP configuration, it is recommended that you first understand the working mechanism and usage limitations of the BGP dynamic routing function. For more information, please see Configuring BGP Dynamic Routing.

health_check_config^Optional

health_check_config: typing.Union[IResolvable, HealthCheckConfigProperty]

• Type: typing.Union[ros_cdk_core.IResolvable, HealthCheckConfigProperty]

Property healthCheckConfig: This parameter is supported if you create an IPsec-VPN connection in single-tunnel mode.

The health check configurations:

• HealthCheckConfig.enable: indicates whether the health check is enabled. Valid values: true and false (default).
• HealthCheckConfig.dip: the destination IP address configured for health checks. Enter the IP address of the on-premises data center that the VPC can access through the IPsec connection.
• HealthCheckConfig.sip: the source IP address configured for health checks. Enter the IP address of the VPC that the on-premises data center can access through the IPsec connection.
• HealthCheckConfig.interval: the time interval of health check retries. Unit: seconds. Default value: 3.
• HealthCheckConfig.retry: the maximum number of health check retries. Default value: 3.
• HealthCheckConfig.Policy: specifies whether to withdraw published routes when health checks fail. Valid values:
• revoke_route (default): withdraws published routes.
• reserve_route: does not withdraw published routes.

ike_config^Optional

ike_config: typing.Union[IResolvable, IkeConfigProperty]

• Type: typing.Union[ros_cdk_core.IResolvable, IkeConfigProperty]

Property ikeConfig: Configuration information for the first phase of negotiation.

ipsec_config^Optional

ipsec_config: typing.Union[IResolvable, IpsecConfigProperty]

• Type: typing.Union[ros_cdk_core.IResolvable, IpsecConfigProperty]

Property ipsecConfig: Configuration information for the second phase negotiation.

name^Optional

name: typing.Union[str, IResolvable]

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property name: The name of the IPsec-VPN connection.

The name must be 1 to 100 characters in length and cannot start with http:\/\/ or https:\/\/.

network_type^Optional

network_type: typing.Union[str, IResolvable]

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property networkType: The network type of the IPsec connection.

Value: public|private.

remote_ca_cert^Optional

remote_ca_cert: typing.Union[str, IResolvable]

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property remoteCaCert: The peer CA certificate when a ShangMi (SM) VPN gateway is used to establish the IPsec-VPN connection.

This parameter is required when an SM VPN gateway is used to establish the IPsec-VPN connection. You can ignore this parameter when a standard VPN gateway is used to create the IPsec-VPN connection.

resource_group_id^Optional

resource_group_id: typing.Union[str, IResolvable]

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property resourceGroupId: The resource group ID to which the IPsec connection belongs.

• You can call the ListResourceGroups interface to query the resource group ID.
• If you do not specify a resource group ID, the IPsec connection will belong to the default resource group after creation.

tunnel_bandwidth^Optional

tunnel_bandwidth: typing.Union[str, IResolvable]

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property tunnelBandwidth: Used to indicate the bandwidth specification of a single VPN tunnel, values: Standard (default value): Standard type, default bandwidth 1Gbps Large: Large type, default bandwidth 3Gbps.

tunnel_options_specification^Optional

tunnel_options_specification: typing.Union[IResolvable, typing.List[typing.Union[IResolvable, TunnelOptionsSpecificationProperty]]]

• Type: typing.Union[ros_cdk_core.IResolvable, typing.List[typing.Union[ros_cdk_core.IResolvable, TunnelOptionsSpecificationProperty]]]

Property tunnelOptionsSpecification: Configuration of tunnels.

• When creating dual-tunnel mode IPsec-VPN connections, you can configure parameters under TunnelOptionsSpecification array.
• When creating dual-tunnel mode IPsec-VPN connections, you must add two tunnels for the IPsec-VPN connection simultaneously to ensure the IPsec-VPN connection has link redundancy capability. Only two tunnels are supported under an IPsec-VPN connection.