editSToSConnectionProfile

The editSToSConnectionProfile operation handles configuration related to SToSConnectionProfile model.

Description

This API call is not allowed on the standby unit in an HA pair.

Data Parameters

Parameter	Required	Type	Description
version	False	string	A unique string version assigned by the system when the object is created or modified. No assumption can be made on the format or content of this identifier. The identifier must be provided whenever attempting to modify/delete an existing object. As the version will change every time the object is modified, the value provided in this identifier must match exactly what is present in the system or the request will be rejected.
name	True	string	A string containing the name of the VPN profile. The string can be up to 50 characters, but can only consist of alphanumeric characters and the following special characters: _.+-
outsideInterfaces	True	[object]	A mandatory list of a PhysicalInterface or SubInterface objects that can be used for establishing the VPN connection. Field level constraints: cannot be null. (Note: Additional constraints might exist) Allowed types are: [EtherChannelInterface, PhysicalInterface, SubInterface, VirtualTunnelInterface, VlanInterface]
localNetworks	False	[object]	A list of NetworkObject or NetworkObjectGroup objects of the source of the traffic that is to be routed through the VPN tunnel. If no source networks are provided, then traffic from any source may be forwarded through the tunnel. Allowed types are: [NetworkObject, NetworkObjectGroup]
isRemotePeerIpDynamic	False	boolean	A Boolean value that determines whether the remote peer ip is static or dynamic. FALSE is the default.
ikev1AuthMethod	True	string	Determines whether the IKEv1 authentication is done using a pre-shared key or a certificate. EnumType with values PRE_SHARED_KEY or CERTIFICATE. PRE_SHARE is the default. Field level constraints: cannot be null. (Note: Additional constraints might exist)
ikev2AuthMethod	True	string	Determines whether the IKEv2 authentication is done using a pre-shared key or a certificate. EnumType with values PRE_SHARED_KEY or CERTIFICATE. PRE_SHARE is the default. Field level constraints: cannot be null. (Note: Additional constraints might exist)
ikev1IDCertificate	False	object	Reference to an identity certificate of type internalcertificate. Allowed types are: [InternalCertificate]
ikev2IDCertificate	False	object	Reference to an identity certificate of type internalcertificate. Allowed types are: [InternalCertificate]
remotePeerIpAddress	False	string	A mandatory string that contains the IP address of the site-to-site VPN peer to connect to Field level constraints: must be a valid IP address. (Note: Additional constraints might exist)
remoteBackupPeers	False	[object]	A list of remote backup peers. The backups could be a device redundancy terminating on two different remote devices or an ISP redundancy terminating on the same remote device but on two different interfaces
remoteNetworks	False	[object]	A list of NetworkObject or NetworkObjectGroup objects of the destination of the traffic that is to be routed through the VPN tunnel. If no remote networks are provided, then traffic going to any destination may be forwarded through the tunnel. Allowed types are: [NetworkObject, NetworkObjectGroup]
ikev1Enabled	True	boolean	A mandatory Boolean value, TRUE (default) or FALSE. The TRUE value indicates that IKEv1 will be used by the VPN tunnel in connection attempts and negotiations. Note that if both IKEv1 and IKEv2 are enabled, IKEv2 will be used first. Field level constraints: cannot be null. (Note: Additional constraints might exist)
ikev2Enabled	True	boolean	A mandatory Boolean value, TRUE (default) or FALSE. The TRUE value indicates that IKEv2 will be used by the VPN tunnel in connection attempts and negotiations. Note that if both IKEv1 and IKEv2 are enabled, IKEv2 will be used first. Field level constraints: cannot be null. (Note: Additional constraints might exist)
rriEnabled	True	boolean	A Boolean Value that determines whether static routes needs to be automatically inserted into routing process for those networks and hosts protected by a remote tunnel endpoint. FALSE is the default. Field level constraints: cannot be null. (Note: Additional constraints might exist)
dynamicRRIEnabled	True	boolean	A Boolean Value that determines whether static routes needs to be added to the routing process after IPSec Site to Site VPN Establishment. FALSE is the default Field level constraints: cannot be null. (Note: Additional constraints might exist)
staticVTIEnabled	False	boolean	A boolean value (FALSE by default), used to specify whether the profile is VTI-based(Route-based) or Policy-based.
ikev1PreSharedKey	False	string	A string containing the pre-shared key for IKE v1 connections. This is mandatory if IKEv1 is enabled. The key is encrypted when stored in the system, and the system will return a generic string instead of the key string for security reasons.
diffieHellmanGroup	False	string	An enum value that defines the Diffie-Hellman group to use for Perfect Forwarding Secrecy. If left empty, Perfect Forward Secrecy is disabled. Possible values are: (unsupported) GROUP1 - 768-bit modulus. (unsupported) GROUP2 - 1024-bit modulus. (deprecated) GROUP5 - 1536-bit modulus. GROUP14 - 2048 bit modulus. GROUP15 - 3072 bit modulus. GROUP16 - 4096 bit modulus. GROUP19 - 256 bit elliptic curve. GROUP20 - 384 bit elliptic curve. GROUP21 - 521 bit elliptic curve. (unsupported) GROUP24 - 2048-bit modulus and 256-bit prime order subgroup. GROUP31 - 256-bit elliptic curve.
ikev2LocalPreSharedKey	False	string	A string containing the local pre-shared key for IKE v2 connections. This is mandatory if IKEv2 is enabled. The key is encrypted when stored in the system, and the system will return a generic string instead of the key string for security reasons.
ikev2RemotePeerPreSharedKey	False	string	A string containing the remote pre-shared key for IKE v2 connections. This is mandatory if IKEv2 is enabled. The key is encrypted when stored in the system, and the system will return a generic string instead of the key string for security reasons.
ikev1Proposals	False	[object]	A list of IkevOneProposal objects to be used in IKEv1 connections. The list cannot be empty if IKEv1 is enabled. Allowed types are: [IkevOneProposal]
ikev2Proposals	False	[object]	A list of IkevTwoProposal objects to be used in IKEv2 connections. The list cannot be empty if IKEv2 is enabled. Allowed types are: [IkevTwoProposal]
connectionType	False	string	Determines whether the IKE connection type is bidirectional, initiator-only or responder-only. EnumType with values BIDIRECTIONAL, INITIATE_ONLY or RESPOND_ONLY.
ipsecLifetimeInSeconds	True	integer	Specifies the number of seconds a security associatiob will live before it expires. Range is 120 to 214783647. Default value is 28800 seconds (eight hours) Field level constraints: must be between 120 and 2147483647 (inclusive), cannot be null. (Note: Additional constraints might exist)
ipsecLifetimeInKiloBytes	True	integer	Specifies the volume of traffic (in kilobytes) that can pass between peers using a given security association before it expires. Range is 10 to 214783647 kilobytes. Default value is 4608000 kilobytes Field level constraints: must be between 10 and 2147483647 (inclusive), cannot be null. (Note: Additional constraints might exist)
ipsecLifetimeUnlimited	True	boolean	A Boolean value (FALSE by default), is used to determine if the ipsec lifetime in kilobytes is set to unlimited. When this value is set ipsecLifetimeInKiloBytes, the value is saved, however cli will be deployed with unlimited kilobytes Field level constraints: cannot be null. (Note: Additional constraints might exist)
interfaceForNatExempt	False	object	A PhysicalInterface or SubInterface object that needs a NAT exempt rule generated for access through VPN. If left empty, no NAT exempt rules will be automatically generated. Allowed types are: [EtherChannelInterface, PhysicalInterface, SubInterface, VirtualTunnelInterface, VlanInterface]
id	False	string	A unique string identifier assigned by the system when the object is created. No assumption can be made on the format or content of this identifier. The identifier must be provided whenever attempting to modify/delete (or reference) an existing object. Field level constraints: must match pattern ^((?!;).)*$. (Note: Additional constraints might exist)
type	True	string	A UTF8 string, all letters lower-case, that represents the class-type. This corresponds to the class name.

Path Parameters

Parameter	Required	Type	Description
objId	True	string

Example

- name: Execute 'editSToSConnectionProfile' operation
  ftd_configuration:
    operation: "editSToSConnectionProfile"
    data:
        version: "{{ version }}"
        name: "{{ name }}"
        outsideInterfaces: "{{ outside_interfaces }}"
        localNetworks: "{{ local_networks }}"
        isRemotePeerIpDynamic: "{{ is_remote_peer_ip_dynamic }}"
        ikev1AuthMethod: "{{ ikev1_auth_method }}"
        ikev2AuthMethod: "{{ ikev2_auth_method }}"
        ikev1IDCertificate: "{{ ikev1_id_certificate }}"
        ikev2IDCertificate: "{{ ikev2_id_certificate }}"
        remotePeerIpAddress: "{{ remote_peer_ip_address }}"
        remoteBackupPeers: "{{ remote_backup_peers }}"
        remoteNetworks: "{{ remote_networks }}"
        ikev1Enabled: "{{ ikev1_enabled }}"
        ikev2Enabled: "{{ ikev2_enabled }}"
        rriEnabled: "{{ rri_enabled }}"
        dynamicRRIEnabled: "{{ dynamic_rri_enabled }}"
        staticVTIEnabled: "{{ static_vti_enabled }}"
        ikev1PreSharedKey: "{{ ikev1_pre_shared_key }}"
        diffieHellmanGroup: "{{ diffie_hellman_group }}"
        ikev2LocalPreSharedKey: "{{ ikev2_local_pre_shared_key }}"
        ikev2RemotePeerPreSharedKey: "{{ ikev2_remote_peer_pre_shared_key }}"
        ikev1Proposals: "{{ ikev1_proposals }}"
        ikev2Proposals: "{{ ikev2_proposals }}"
        connectionType: "{{ connection_type }}"
        ipsecLifetimeInSeconds: "{{ ipsec_lifetime_in_seconds }}"
        ipsecLifetimeInKiloBytes: "{{ ipsec_lifetime_in_kilo_bytes }}"
        ipsecLifetimeUnlimited: "{{ ipsec_lifetime_unlimited }}"
        interfaceForNatExempt: "{{ interface_for_nat_exempt }}"
        id: "{{ id }}"
        type: "{{ type }}"
    path_params:
        objId: "{{ obj_id }}"