az network vnet-gateway ipsec-policy

Is this page helpful?

Any additional feedback?

Feedback will be sent to Microsoft: By pressing the submit button, your feedback will be used to improve Microsoft products and services. Privacy policy.

Manage virtual network gateway IPSec policies.

Commands

az network vnet-gateway ipsec-policy add	Add a virtual network gateway IPSec policy.
az network vnet-gateway ipsec-policy clear	Delete all IPsec policies on a virtual network gateway.
az network vnet-gateway ipsec-policy list	List IPSec policies associated with a virtual network gateway.

az network vnet-gateway ipsec-policy add

Add a virtual network gateway IPSec policy.

Set all IPsec policies of a virtual network gateway. If you want to set any IPsec policy, you must set them all.

az network vnet-gateway ipsec-policy add --dh-group {DHGroup1, DHGroup14, DHGroup2, DHGroup2048, DHGroup24, ECP256, ECP384, None}
                                         --gateway-name
                                         --ike-encryption {AES128, AES192, AES256, DES, DES3, GCMAES128, GCMAES256}
                                         --ike-integrity {GCMAES128, GCMAES256, MD5, SHA1, SHA256, SHA384}
                                         --ipsec-encryption {AES128, AES192, AES256, DES, DES3, GCMAES128, GCMAES192, GCMAES256, None}
                                         --ipsec-integrity {GCMAES128, GCMAES192, GCMAES256, MD5, SHA1, SHA256}
                                         --pfs-group {ECP256, ECP384, None, PFS1, PFS14, PFS2, PFS2048, PFS24, PFSMM}
                                         --resource-group
                                         --sa-lifetime
                                         --sa-max-size
                                         [--no-wait]

Examples

Add specified IPsec policies to a gateway instead of relying on defaults.

az network vnet-gateway ipsec-policy add -g MyResourceGroup --gateway-name MyGateway \
    --dh-group DHGroup14 --ike-encryption AES256 --ike-integrity SHA384 --ipsec-encryption DES3 \
    --ipsec-integrity GCMAES256 --pfs-group PFS2048 --sa-lifetime 27000 --sa-max-size 102400000

Required Parameters

--dh-group

The DH Groups used for initial SA.

accepted values: DHGroup1, DHGroup14, DHGroup2, DHGroup2048, DHGroup24, ECP256, ECP384, None

--gateway-name

Virtual network gateway name.

--ike-encryption

The IKE encryption algorithm.

accepted values: AES128, AES192, AES256, DES, DES3, GCMAES128, GCMAES256

--ike-integrity

The IKE integrity algorithm.

accepted values: GCMAES128, GCMAES256, MD5, SHA1, SHA256, SHA384

--ipsec-encryption

The IPSec encryption algorithm.

accepted values: AES128, AES192, AES256, DES, DES3, GCMAES128, GCMAES192, GCMAES256, None

--ipsec-integrity

The IPSec integrity algorithm.

accepted values: GCMAES128, GCMAES192, GCMAES256, MD5, SHA1, SHA256

--pfs-group

The Pfs Groups used for new child SA.

accepted values: ECP256, ECP384, None, PFS1, PFS14, PFS2, PFS2048, PFS24, PFSMM

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--sa-lifetime

The lifetime in seconds for P2S client.

--sa-max-size

The payload size in KB for P2S client.

Optional Parameters

--no-wait

Do not wait for the long-running operation to finish.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az network vnet-gateway ipsec-policy clear

Delete all IPsec policies on a virtual network gateway.

az network vnet-gateway ipsec-policy clear --gateway-name
                                           --resource-group
                                           [--no-wait]

Examples

Remove all previously specified IPsec policies from a gateway.

az network vnet-gateway ipsec-policy clear -g MyResourceGroup --gateway-name MyConnection

Required Parameters

--gateway-name

Virtual network gateway name.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

--no-wait

Do not wait for the long-running operation to finish.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az network vnet-gateway ipsec-policy list

List IPSec policies associated with a virtual network gateway.

az network vnet-gateway ipsec-policy list --gateway-name
                                          --resource-group

Examples

List the IPsec policies set on a gateway.

az network vnet-gateway ipsec-policy list -g MyResourceGroup --gateway-name MyConnection

Required Parameters

--gateway-name

Virtual network gateway name.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.