Skip to content
Network as Code

Transport WAN VPN IPsec Interface Feature

Configure IPsec interface under the WAN VPN (VPN 0)

Diagram

Section titled “Diagram”
Diagram

Classes

Section titled “Classes”

wan_vpn (sdwan.feature_profiles.transport_profiles)

Section titled “wan_vpn (sdwan.feature_profiles.transport_profiles)”
NameTypeConstraintMandatoryDefault Value
ipsec_interfacesList[ipsec_interfaces]No

ipsec_interfaces (sdwan.feature_profiles.transport_profiles.wan_vpn)

Section titled “ipsec_interfaces (sdwan.feature_profiles.transport_profiles.wan_vpn)”
NameTypeConstraintMandatoryDefault Value
nameStringRegex: ^[^&<>! "]{1,128}$Yes
descriptionStringNo
application_tunnel_typeChoicenone, sigNonone
application_tunnel_type_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
clear_dont_fragmentBooleantrue, falseNo
clear_dont_fragment_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
dpd_intervalIntegermin: 10, max: 3600No
dpd_interval_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
dpd_retriesIntegermin: 2, max: 60No
dpd_retries_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
ike_cipher_suiteChoiceaes256-cbc-sha1, aes256-cbc-sha2, aes128-cbc-sha1, aes128-cbc-sha2No
ike_cipher_suite_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
ike_diffie_hellman_groupChoice2, 14, 15, 16, 19, 20, 21, 24No
ike_diffie_hellman_group_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
ike_integrity_protocolChoicemain, aggressiveNo
ike_integrity_protocol_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
ike_local_endpoint_idStringmin: 1, max: 63No
ike_local_endpoint_id_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
ike_preshared_keyStringmin: 1, max: 127No
ike_preshared_key_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
ike_rekey_intervalIntegermin: 60, max: 86400No
ike_rekey_interval_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
ike_remote_endpoint_idStringmin: 1, max: 63No
ike_remote_endpoint_id_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
ike_versionIntegermin: 1, max: 2No
interface_descriptionStringmin: 0, max: 240No
interface_description_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
interface_nameStringRegex: ^ipsec\d{1,3}$No
interface_name_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
ipsec_cipher_suiteChoiceaes256-cbc-sha1, aes256-cbc-sha256, aes256-cbc-sha384, aes256-cbc-sha512, aes256-gcm, null-sha1, null-sha256, null-sha384, null-sha512No
ipsec_cipher_suite_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
ipsec_perfect_forward_secrecyChoicegroup-1, group-2, group-5, group-14, group-15, group-16, group-19, group-20, group-21, group-24, noneNo
ipsec_perfect_forward_secrecy_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
ipsec_rekey_intervalIntegermin: 120, max: 2592000No
ipsec_rekey_interval_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
ipsec_replay_windowIntegermin: 64, max: 4096No
ipsec_replay_window_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
ipv4_addressIPNo
ipv4_address_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
ipv4_mtuIntegermin: 68, max: 9216No
ipv4_mtu_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
ipv4_subnet_maskChoice255.255.255.255, 255.255.255.254, 255.255.255.252, 255.255.255.248, 255.255.255.240, 255.255.255.224, 255.255.255.192, 255.255.255.128, 255.255.255.0, 255.255.254.0, 255.255.252.0, 255.255.248.0, 255.255.240.0, 255.255.224.0, 255.255.192.0, 255.255.128.0, 255.255.0.0, 255.254.0.0, 255.252.0.0, 255.240.0.0, 255.224.0.0, 255.192.0.0, 255.128.0.0, 255.0.0.0, 254.0.0.0, 252.0.0.0, 248.0.0.0, 240.0.0.0, 224.0.0.0, 192.0.0.0, 128.0.0.0, 0.0.0.0No
ipv4_subnet_mask_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
ipv4_tcp_mssIntegermin: 500, max: 1460No
ipv4_tcp_mss_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
ipv6_addressStringRegex: ((^\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?\s*(\/)(\b([0-9]{1,2}|1[01][0-9]|12[0-8])\b)$))No
ipv6_address_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
ipv6_mtuIntegermin: 1280, max: 9976No
ipv6_mtu_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
ipv6_tcp_mssIntegermin: 40, max: 1454No
ipv6_tcp_mss_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
multiplexingBooleantrue, falseNo
multiplexing_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
shutdownBooleantrue, falseNo
shutdown_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
tracker_idStringNo
tracker_id_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
tunnel_destination_ipv4_addressIPNo
tunnel_destination_ipv4_address_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
tunnel_destination_ipv6_addressIPNo
tunnel_destination_ipv6_address_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
tunnel_modeChoiceipv4, ipv6, ipv4-v6overlayNo
tunnel_route_viaStringmin: 1, max: 32No
tunnel_route_via_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
tunnel_source_interfaceStringRegex: (ATM|ATM-ACR|AppGigabitEthernet|AppNav-Compress|AppNav-UnCompress|Async|BD-VIF|BDI|CEM|CEM-ACR|Cellular|Dialer|Embedded-Service-Engine|Ethernet|Ethernet-Internal|FastEthernet|FiftyGigabitEthernet|FiveGigabitEthernet|FortyGigabitEthernet|FourHundredGigE|GMPLS|GigabitEthernet|Group-Async|HundredGigE|L2LISP|LISP|Loopback|MFR|Multilink|Port-channel|SM|Serial|Service-Engine|TenGigabitEthernet|Tunnel|TwentyFiveGigE|TwentyFiveGigabitEthernet|TwoGigabitEthernet|TwoHundredGigE|Vif|Virtual-PPP|Virtual-Template|VirtualPortGroup|Vlan|Wlan-GigabitEthernet|nat64|nat66|ntp|nve|ospfv3|overlay|pseudowire|ucse|vasileft|vasiright|vmi)([0-9]*(. ?[1-9][0-9]*)*|[0-9/]+|[0-9]+/[0-9]+/[0-9]+:[0-9]+|[0-9]+/[0-9]+/[0-9]+|[0-9]+/[0-9]+|[0-9]+)No
tunnel_source_interface_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
tunnel_source_ipv4_addressIPNo
tunnel_source_ipv4_address_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No
tunnel_source_ipv6_addressIPNo
tunnel_source_ipv6_address_variableStringRegex: ^[./\[\]a-zA-Z0-9_-]{1,128}$No

Examples

Section titled “Examples”

Example-1: This example demonstrates two methods for configuring IPsec interfaces under the wan_vpn feature within a transport profile using IPv4 tunnel mode. IPSEC-1 is configured with an explicit tunnel source IPv4 address, while IPSEC-2 references a tunnel source interface.

sdwan:
  feature_profiles:
    transport_profiles:
      - name: transport1
        wan_vpn:
          name: wan_vpn
          ipsec_interfaces:
            - name: IPSEC-1
              description: IPSEC Interface 1
              interface_name: ipsec1
              ipv4_address: 3.3.3.1
              ipv4_subnet_mask: 255.255.255.252
              ike_preshared_key: mysecret
              shutdown: false
              tunnel_destination_ipv4_address: 2.2.2.2
              tunnel_source_ipv4_address: 1.1.1.1
            - name: IPSEC-2
              description: IPSEC Interface 2
              interface_name: ipsec2
              ike_preshared_key: mysecret
              shutdown: false
              tunnel_destination_ipv4_address: 3.3.3.3
              tunnel_mode: ipv4
              tunnel_source_interface: GigabitEthernet2

Example-2: This example demonstrates IPsec interface configuration using IPv6 tunnel modes. IPSEC-3 is configured with pure IPv6 tunnel mode, while IPSEC-4 uses IPv4-v6overlay mode to transport IPv6 traffic over an IPv4 tunnel.

sdwan:
  feature_profiles:
    transport_profiles:
      - name: transport1
        wan_vpn:
          name: wan_vpn
          ipsec_interfaces:
            - name: IPSEC-3
              description: IPSEC Interface 3
              interface_name: ipsec3
              ipv6_address: 2001:db8:1::1/128
              ike_preshared_key: mysecret3
              shutdown: false
              tunnel_destination_ipv6_address: 2001:db8:3::1
              tunnel_mode: ipv6
              tunnel_source_ipv6_address: 2001:db8:2::1
            - name: IPSEC-4
              description: IPSEC Interface 4
              interface_name: ipsec4
              ipv6_address: 2001:db8:4::2/128
              ike_preshared_key: mysecret4
              shutdown: false
              tunnel_destination_ipv4_address: 7.7.7.7
              tunnel_mode: ipv4-v6overlay
              tunnel_source_interface: GigabitEthernet1