Interface IPhase2Config

NetworkConfig / CustomerGatewayConfig / VpnConnectionConfig / VpnTunnelOptionsSpecificationsConfig / Phase2Config

Description

Internet Key Exchange (IKE) Phase 2 tunnel options configuration. Use this configuration to restrict the permitted Diffie-Hellman group numbers, encryption algorithms, and integrity algorithms for IKE Phase 2 negotiations. You may also modify the Phase 2 lifetime for the VPN tunnel.

Example

dhGroups: [14, 20, 24]
encryptionAlgorithms: [AES256, AES256-GCM-16]
integrityAlgorithms: [SHA2-256, SHA2-384, SHA2-512]
lifetime: 1800
interface IPhase2Config {
    dhGroups?: Phase2DhGroupType[];
    encryptionAlgorithms?: EncryptionAlgorithmType[];
    integrityAlgorithms?: IntegrityAlgorithmType[];
    lifetimeSeconds?: number;
}

Properties

dhGroups? encryptionAlgorithms? integrityAlgorithms? lifetimeSeconds?

Properties

Optional ReadonlydhGroups

dhGroups?: Phase2DhGroupType[]

(OPTIONAL) An array of permitted Diffie-Hellman group numbers used in the IKE Phase 2 negotiations.

Default - [2, 5, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24]

Remarks

If you update this property after deployment, your VPN tunnel will become temporarily unavailable. Please see Customer initiated endpoint replacements for additional details.

Optional ReadonlyencryptionAlgorithms

encryptionAlgorithms?: EncryptionAlgorithmType[]

(OPTIONAL) An array of encryption algorithms permitted for IKE Phase 2 negotiations.

Default - [AES128, AES256, AES128-GCM-16, AES256-GCM-16]

Remarks

If you update this property after deployment, your VPN tunnel will become temporarily unavailable. Please see Customer initiated endpoint replacements for additional details.

Optional ReadonlyintegrityAlgorithms

integrityAlgorithms?: IntegrityAlgorithmType[]

(OPTIONAL) An array of integrity algorithms permitted for IKE Phase 2 negotiations.

Default - [SHA1, SHA2-256, SHA2-384, SHA2-512]

Remarks

If you update this property after deployment, your VPN tunnel will become temporarily unavailable. Please see Customer initiated endpoint replacements for additional details.

Optional ReadonlylifetimeSeconds

lifetimeSeconds?: number

(OPTIONAL) The IKE Phase 2 lifetime (in seconds) for the VPN tunnel.

Default: 3600 (1 hour)

Remarks

If you update this property after deployment, your VPN tunnel will become temporarily unavailable. Please see Customer initiated endpoint replacements for additional details.

You can specify a value between 900 and 3600

Settings

Member Visibility

On This Page

Properties