Configures all components of IPsec VPN for remote user connections—common elements, sites, and global settings.

Note

VMware recommends you issue a GET request to retrieve the IPsec VPN configuration, modify the configuration, then submit the changes by sending a PUT request.

Prerequisites
1

Log in to vCloud Air as an administrator. See Log in to vCloud Air for information.

2

Create a login session with vCloud Director. See Create a Session for a Virtual Data Center in a Service for information.

3

Using the vCloud API, query vCloud Director for the ID of the edge gateway that requires IPsec VPN configuration. See Querying the vCloud API for information.

Procedure
1

(Optional) Request the current IPsec VPN configuration for the edge gateway. See List IPsec VPN Configuration for vCloud Air.

2

Examine the response and update the required elements.

For a description of each element of the IPsec VPN schema, see Schema for IPsec VPN Configuration.

3

Submit the updated configuration using the following request header and request body:

PUT https://vchs.vmware.com/hybridity/api/gateways/gatewayId/ipsec/config

In the request header, include the OATH token and the Accept header that you obtained when creating a login session: 

Accept: application/json
Content-Type: application/json
X-Vcloud-Authorization: vcloud-auth-token

In the request body, include the schema elements you retrieved and updated from the GET request.

The server returns status 204 NO CONTENT in the response header. The server does not return a response body.

Example: Requests and Responses to Configure IPsec VPN

Request Header – Get the IPsec Configuration 

GET https://vchs.vmware.com/hybridity/api/gateways/gw-5/ipsec/config
Accept: application/json
Content-Type: application/json
X-Vcloud-Authorization: "d6eFLOqQYfuEn2MJTp7BQ2ISEO+ZYaEgTcqBy8wZQ6js="

Request body not required.

Response Body – Get the IPsec VPN Configuration 

{
featureType": "ipsec_4.0",
"version": 3,
"enabled": true,
"logging": {
    "enable": false,
    "logLevel": "info"
},
"sites": {
    "sites": [
        {
            "enabled": true,
            "name": "onprem-cloud",
            "localId": "cloud",
            "localIp": "10.112.100.3",
            "peerId": "onprem",
            "peerIp": "192.168.10.1",
            "encryptionAlgorithm": "aes",
            "enablePfs": true,
            "dhGroup": "dh2",
            "localSubnets": {
                "subnets": [
                    "172.16.0.0/24"
                ]
            },
            "peerSubnets": {
                "subnets": [
                    "172.10.0.0/24"
                ]
            },
            "psk": "******",
            "authenticationMode": "psk"
        }
    ]
},
"global": {
    "psk": "******",
    "caCertificates": {
        "caCertificate": []
    },
    "crlCertificates": {
        "crlCertificate": []
    }
  }
}

Request Header – Add a Site to the Configuration 

PUT https://vchs.vmware.com/hybridity/api/gateways/gw-5/ipsec/config
Accept: application/json
Content-Type: application/json
X-Vcloud-Authorization: "d6eFLOqQYfuEn2MJTp7BQ2ISEO+ZYaEgTcqBy8wZQ6js="

Request Body – Add a Site to the Configuration 

{
featureType": "ipsec_4.0",
"version": 3,
"enabled": true,
"logging": {
    "enable": false,
    "logLevel": "info"
},
"sites": {
    "sites": [
        {
            "enabled": true,
            "name": "onprem-cloud",
            "localId": "cloud",
            "localIp": "10.112.100.3",
            "peerId": "onprem",
            "peerIp": "192.168.10.1",
            "encryptionAlgorithm": "aes",
            "enablePfs": true,
            "dhGroup": "dh2",
            "localSubnets": {
                "subnets": [
                    "172.16.0.0/24"
                ]
            },
            "peerSubnets": {
                "subnets": [
                    "172.10.0.0/24"
                ]
            },
            "psk": "******",
            "authenticationMode": "psk"
        }, {
            "enabled" : true,
            "name" : "to_remote_site8",
            "description" : "VPN to to remote site8",
            "localId" : "192.168.4.49",
            "localIp" : "192.168.4.49",
            "peerId" : "192.168.4.77",
            "peerIp" : "192.168.4.77",
            "encryptionAlgorithm" : "aes256",
            "enablePfs" : true,
            "dhGroup" : "dh2",
            "localSubnets" : {
                "subnets" : [ 
                    "192.168.35.0/24", "192.168.32.0/24", "192.168.36.0/24", 
                ]
            },
            "peerSubnets" : {
                "subnets" : [ 
                    "192.168.61.0/24", "192.168.63.0/24", "192.168.65.0/24",
                ]
            },
            "psk" : "******",
            "authenticationMode" : "psk"
    ]
},
"global": {
    "psk": "******",
    "caCertificates": {
        "caCertificate": []
    },
    "crlCertificates": {
        "crlCertificate": []
    }
  }
}
What to do next

You must configure the IPsec VPN connection from both sides of the connection—vCloud Air and your on-premises facility. This procedure details how to configure the connection for vCloud Air. Configure the connection for your on-premises facility.