{"type":"api","title":"Update Organization Appliance Vpn Third Party VPN Peers","meta":{"id":"/apps/pubhub/media/Meraki-Dashboard-API-v1-Documentation/9d30a16886a116eb6fb996e5d66f67d0df0da886/28b52581-f438-3451-9ea2-e3d65df40b84","info":{"title":"Meraki Dashboard API","description":"A RESTful API to programmatically manage and monitor Cisco Meraki networks at scale.\n\n\u003e Date: 16 October, 2026\n\u003e\n\u003e [Recent Updates](https://meraki.io/whats-new/)\n\n---\n\n[API Documentation](https://meraki.io/api)\n\n[Community Support](https://meraki.io/community)\n\n[Meraki Homepage](https://www.meraki.com)\n","contact":{"name":"Meraki Developer Community","url":"https://meraki.io/community"},"version":"v1.75.1"},"security":[{"meraki_api_key":[]},{"bearerAuth":[]}],"tags":[{"name":"organizations"},{"name":"networks"},{"name":"devices"},{"name":"insight"},{"name":"wireless"},{"name":"camera"},{"name":"appliance"},{"name":"switch"},{"name":"cellularGateway"},{"name":"sm"},{"name":"sensor"},{"name":"administered"},{"name":"campusGateway"},{"name":"wirelessController"},{"name":"spaces"},{"name":"accessControlLists"},{"name":"accessPolicies"},{"name":"account"},{"name":"accounts"},{"name":"acls"},{"name":"actionBatches"},{"name":"adaptivePolicy"},{"name":"adaptivePolicyGroups"},{"name":"addresses"},{"name":"admins"},{"name":"aggregated"},{"name":"airMarshal"},{"name":"alertTypes"},{"name":"alerts"},{"name":"allowlist"},{"name":"alternateManagementInterface"},{"name":"analytics"},{"name":"api"},{"name":"apiRequests"},{"name":"apnsCert"},{"name":"appliances"},{"name":"applicationCategories"},{"name":"applicationUsage"},{"name":"applications"},{"name":"areas"},{"name":"arpInspection"},{"name":"arpTable"},{"name":"artifacts"},{"name":"assets"},{"name":"assignments"},{"name":"authenticationToken"},{"name":"authorities"},{"name":"autoLocate"},{"name":"autoRf"},{"name":"availabilities"},{"name":"bands"},{"name":"bandwidthUsageHistory"},{"name":"bgp"},{"name":"billing"},{"name":"blink"},{"name":"bluetooth"},{"name":"bluetoothClients"},{"name":"bonjourForwarding"},{"name":"boundaries"},{"name":"brandingPolicies"},{"name":"bulk"},{"name":"bulkCreate"},{"name":"bulkDelete"},{"name":"bulkUpdate"},{"name":"byBoundary"},{"name":"byClient"},{"name":"byCluster"},{"name":"byDevice"},{"name":"byEnergyUsage"},{"name":"byGroup"},{"name":"byInterval"},{"name":"byMetric"},{"name":"byModel"},{"name":"byNetwork"},{"name":"byPipeline"},{"name":"bySite"},{"name":"bySsid"},{"name":"byStatus"},{"name":"bySwitch"},{"name":"byType"},{"name":"byUsage"},{"name":"byUtilization"},{"name":"byVlan"},{"name":"bypassActivationLockAttempts"},{"name":"cableTest"},{"name":"callbacks"},{"name":"captures"},{"name":"categories"},{"name":"cellular"},{"name":"cellularFirewallRules"},{"name":"cellularUsageHistory"},{"name":"certificates"},{"name":"certs"},{"name":"changeHistory"},{"name":"channelUtilization"},{"name":"channelUtilizationHistory"},{"name":"channels"},{"name":"claim"},{"name":"claimKey"},{"name":"clientCountHistory"},{"name":"clients"},{"name":"clusters"},{"name":"commands"},{"name":"communicationPlans"},{"name":"compliance"},{"name":"configTemplates"},{"name":"configurationChanges"},{"name":"configure"},{"name":"configuredDevices"},{"name":"connectionStats"},{"name":"connections"},{"name":"connectivity"},{"name":"connectivityEvents"},{"name":"connectivityMonitoringDestinations"},{"name":"connectors"},{"name":"contentFiltering"},{"name":"controller"},{"name":"coterm"},{"name":"cpu"},{"name":"crls"},{"name":"current"},{"name":"customAnalytics"},{"name":"customPerformanceClasses"},{"name":"cycle"},{"name":"dailyConsumerMetrics"},{"name":"data"},{"name":"dataRateHistory"},{"name":"delegated"},{"name":"deltas"},{"name":"deployable"},{"name":"deployed"},{"name":"deployments"},{"name":"desktopLogs"},{"name":"details"},{"name":"detections"},{"name":"deviceCategories"},{"name":"deviceCommandLogs"},{"name":"deviceProfiles"},{"name":"deviceTypeGroupPolicies"},{"name":"dhcp"},{"name":"dhcpServerPolicy"},{"name":"discovery"},{"name":"disenrollments"},{"name":"dns"},{"name":"domains"},{"name":"doorLocks"},{"name":"downloadUrl"},{"name":"dscpTaggingOptions"},{"name":"dscpToCosMappings"},{"name":"eapOverride"},{"name":"earlyAccess"},{"name":"electronicShelfLabel"},{"name":"eligible"},{"name":"enrollments"},{"name":"entitlements"},{"name":"entries"},{"name":"eox"},{"name":"esims"},{"name":"ethernet"},{"name":"eventTypes"},{"name":"events"},{"name":"failedConnections"},{"name":"failover"},{"name":"features"},{"name":"fields"},{"name":"firewall"},{"name":"firewalledServices"},{"name":"firmware"},{"name":"firmwareUpgrades"},{"name":"floorPlans"},{"name":"gateways"},{"name":"geolocations"},{"name":"global"},{"name":"group"},{"name":"groupPolicies"},{"name":"groups"},{"name":"health"},{"name":"healthByTime"},{"name":"historical"},{"name":"history"},{"name":"hotspot20"},{"name":"httpServers"},{"name":"httpsInspection"},{"name":"httpsi"},{"name":"identities"},{"name":"identityPsks"},{"name":"idps"},{"name":"impacted"},{"name":"impactedDevice"},{"name":"inboundCellularFirewallRules"},{"name":"inboundFirewallRules"},{"name":"integrate"},{"name":"integration"},{"name":"integrations"},{"name":"interfaces"},{"name":"internetPolicies"},{"name":"intrusion"},{"name":"inventory"},{"name":"ipsec"},{"name":"ipv6"},{"name":"isolation"},{"name":"jobs"},{"name":"keys"},{"name":"l2"},{"name":"l3"},{"name":"l3FirewallRules"},{"name":"l7FirewallRules"},{"name":"lan"},{"name":"latencyHistory"},{"name":"latencyStats"},{"name":"latest"},{"name":"leds"},{"name":"licenses"},{"name":"licensing"},{"name":"lines"},{"name":"linkAggregations"},{"name":"linkLayer"},{"name":"live"},{"name":"liveTools"},{"name":"lldpCdp"},{"name":"load"},{"name":"local"},{"name":"localOverrides"},{"name":"location"},{"name":"loginSecurity"},{"name":"logs"},{"name":"lookups"},{"name":"lossAndLatencyHistory"},{"name":"macTable"},{"name":"malware"},{"name":"managementInterface"},{"name":"manufacturers"},{"name":"masks"},{"name":"mdns"},{"name":"me"},{"name":"memory"},{"name":"merakiAuthUsers"},{"name":"meshStatuses"},{"name":"migrations"},{"name":"mode"},{"name":"models"},{"name":"monitor"},{"name":"monitoredMediaServers"},{"name":"moves"},{"name":"mqtt"},{"name":"mqttBrokers"},{"name":"mtu"},{"name":"multicast"},{"name":"multicastForwarding"},{"name":"multicastRouting"},{"name":"nat"},{"name":"netflow"},{"name":"networkAdapters"},{"name":"networkHealth"},{"name":"objectDetectionModels"},{"name":"onboarding"},{"name":"oneToManyNatRules"},{"name":"oneToOneNatRules"},{"name":"openRoaming"},{"name":"openapiSpec"},{"name":"optIns"},{"name":"order"},{"name":"orders"},{"name":"ospf"},{"name":"override"},{"name":"overrides"},{"name":"overview"},{"name":"overviews"},{"name":"owe"},{"name":"packetCapture"},{"name":"packetLoss"},{"name":"packets"},{"name":"payloadTemplates"},{"name":"peers"},{"name":"performance"},{"name":"performanceHistory"},{"name":"permissions"},{"name":"pii"},{"name":"piiKeys"},{"name":"ping"},{"name":"pingDevice"},{"name":"pipelines"},{"name":"policies"},{"name":"policy"},{"name":"policyObjects"},{"name":"portForwardingRules"},{"name":"portSchedules"},{"name":"ports"},{"name":"power"},{"name":"powerModules"},{"name":"prefixes"},{"name":"priorities"},{"name":"profiles"},{"name":"provisioning"},{"name":"qosRules"},{"name":"qualityAndRetention"},{"name":"qualityRetentionProfiles"},{"name":"radio"},{"name":"radsec"},{"name":"ratePlans"},{"name":"readings"},{"name":"receivers"},{"name":"recent"},{"name":"records"},{"name":"redundancy"},{"name":"regions"},{"name":"relationships"},{"name":"rendezvousPoints"},{"name":"requests"},{"name":"responseCodes"},{"name":"rest"},{"name":"restrictions"},{"name":"rfProfiles"},{"name":"roles"},{"name":"rollbacks"},{"name":"routing"},{"name":"routingTable"},{"name":"rrm"},{"name":"ruleGroups"},{"name":"rules"},{"name":"rulesets"},{"name":"saml"},{"name":"samlRoles"},{"name":"sase"},{"name":"scanning"},{"name":"schedules"},{"name":"sdwan"},{"name":"search"},{"name":"security"},{"name":"securityCenters"},{"name":"seen"},{"name":"sense"},{"name":"sentry"},{"name":"servers"},{"name":"serviceProviders"},{"name":"settings"},{"name":"signalQualityHistory"},{"name":"sims"},{"name":"singleLan"},{"name":"siteToSite"},{"name":"siteToSiteVpn"},{"name":"sites"},{"name":"slas"},{"name":"smDevicesForKey"},{"name":"smOwnersForKey"},{"name":"snmp"},{"name":"softwares"},{"name":"splash"},{"name":"splashAuthorizationStatus"},{"name":"splashLoginAttempts"},{"name":"split"},{"name":"ssids"},{"name":"stacks"},{"name":"staged"},{"name":"stages"},{"name":"staticRoutes"},{"name":"statics"},{"name":"stats"},{"name":"status"},{"name":"statuses"},{"name":"stormControl"},{"name":"stp"},{"name":"subnetPool"},{"name":"subnets"},{"name":"subscription"},{"name":"subscriptions"},{"name":"summaries"},{"name":"summary"},{"name":"summaryConsumerMetrics"},{"name":"sustainability"},{"name":"swap"},{"name":"swaps"},{"name":"switches"},{"name":"syslog"},{"name":"syslogServers"},{"name":"system"},{"name":"targetGroups"},{"name":"targets"},{"name":"taxonomy"},{"name":"themes"},{"name":"thirdPartyVPNPeers"},{"name":"throughputTest"},{"name":"top"},{"name":"topology"},{"name":"towers"},{"name":"traffic"},{"name":"trafficAnalysis"},{"name":"trafficHistory"},{"name":"trafficShaping"},{"name":"transceivers"},{"name":"trustedAccessConfigs"},{"name":"trustedServers"},{"name":"tunnelable"},{"name":"tunneling"},{"name":"types"},{"name":"umbrella"},{"name":"update"},{"name":"upgrades"},{"name":"uplink"},{"name":"uplinkBandwidth"},{"name":"uplinkSelection"},{"name":"uplinks"},{"name":"uplinksLossAndLatency"},{"name":"usage"},{"name":"usageHistories"},{"name":"usageHistory"},{"name":"userAccessDevices"},{"name":"utilization"},{"name":"v4"},{"name":"video"},{"name":"videoLink"},{"name":"vlanAssignments"},{"name":"vlanProfiles"},{"name":"vlans"},{"name":"vmx"},{"name":"vpn"},{"name":"vpnExclusions"},{"name":"vpnFirewallRules"},{"name":"vppAccounts"},{"name":"vrfs"},{"name":"wakeOnLan"},{"name":"warmSpare"},{"name":"warnings"},{"name":"webhookTests"},{"name":"webhooks"},{"name":"wirelessControllers"},{"name":"wirelessProfiles"},{"name":"wlanLists"},{"name":"xdr"},{"name":"zigbee"},{"name":"zones"}],"x-parser-conf":{"exampleAsDefault":true,"expand":3,"groupBy":{"$remoteModule":"config/group_platform.js"},"httpBearer":{"bearerToken":"75dd5334bef4d2bc96f26138c163c0a3fa0b5ca6"},"labelConfig":{"endpoint":{"field":"operationId","format":"startCase"}},"meta":{"useProxy":true},"overview":{"markdownPath":"docs/overview.md"},"sampleCode":{"python":{"folder":"meraki/sdk/python","highlight":"python","name":"Meraki Python Library"}},"serverConfig":true,"sortBy":{"$remoteModule":"config/sort_by.js"},"theme":"meraki","variables":{"networkId":"N_784752235069315754","organizationId":"1215707","serial":"QBSB-VQ3J-XZ54"}},"openapi":"3.0.1","servers":[{"url":"https://api.meraki.com/{basePath}","variables":{"basePath":{"default":"api/v1"}}}],"securitySchemes":{"meraki_api_key":{"type":"apiKey","name":"X-Cisco-Meraki-API-Key","in":"header"},"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"API Key"},"oauth2":{"type":"oauth2","description":"This API uses OAuth 2 with the authorization code grant flow. [More info](https://developer.cisco.com/meraki/api-v1/authorization/)","flows":{"authorizationCode":{"authorizationUrl":"https://as.meraki.com/oauth/authorize","tokenUrl":"https://as.meraki.com/oauth/token","scopes":{"camera:config:read":"Cameras (MV)","camera:config:write":"Cameras (MV)","camera:telemetry:read":"Cameras (MV)","camera:telemetry:write":"Cameras (MV)","dashboard:general:config:read":"Entire dashboard, excluding identity and access management","dashboard:general:config:write":"Entire dashboard, excluding identity and access management","dashboard:general:telemetry:read":"Entire dashboard, excluding identity and access management","dashboard:general:telemetry:write":"Entire dashboard, excluding identity and access management","dashboard:iam:config:read":"Dashboard related to identity and access management, including early access features","dashboard:iam:config:write":"Dashboard related to identity and access management, including early access features","dashboard:iam:telemetry:read":"Dashboard related to identity and access management, including early access features","dashboard:iam:telemetry:write":"Dashboard related to identity and access management, including early access features","dashboard:licensing:config:read":"Licensing","dashboard:licensing:config:write":"Licensing","dashboard:licensing:telemetry:read":"Licensing","dashboard:licensing:telemetry:write":"Licensing","iot:gateway:general:config:read":"Sensor Connect (IoT Control)","iot:gateway:general:config:write":"Sensor Connect (IoT Control)","iot:gateway:general:telemetry:read":"Sensor Connect (IoT Control)","iot:gateway:general:telemetry:write":"Sensor Connect (IoT Control)","iot:gateway:onboarding:config:read":"Sensor Connect (IoT Onboarding)","iot:gateway:onboarding:config:write":"Sensor Connect (IoT Onboarding)","policy:config:read":"Provides granular authorization over all global policy resources including policy objects, adaptive policy, and Organization Group Policy","policy:config:write":"Provides granular authorization over all global policy resources including policy objects, adaptive policy, and Organization Group Policy","policy:telemetry:read":"Provides granular authorization over all global policy resources including policy objects, adaptive policy, and Organization Group Policy","policy:telemetry:write":"Provides granular authorization over all global policy resources including policy objects, adaptive policy, and Organization Group Policy","sdwan:config:read":"Secure SD-WAN (MX including MXIGZ)","sdwan:config:write":"Secure SD-WAN (MX including MXIGZ)","sdwan:telemetry:read":"Secure SD-WAN (MX including MXIGZ)","sdwan:telemetry:write":"Secure SD-WAN (MX including MXIGZ)","sensor:config:read":"Sensors (MT)","sensor:config:write":"Sensors (MT)","sensor:telemetry:read":"Sensors (MT)","sensor:telemetry:write":"Sensors (MT)","sm:config:read":"Endpoint Management (SM)","sm:config:write":"Endpoint Management (SM)","sm:telemetry:read":"Endpoint Management (SM)","sm:telemetry:write":"Endpoint Management (SM)","switch:config:read":"Switches (MS)","switch:config:write":"Switches (MS)","switch:telemetry:read":"Switches (MS)","switch:telemetry:write":"Switches (MS)","wireless:config:read":"Wireless (MR)","wireless:config:write":"Wireless (MR)","wireless:telemetry:read":"Wireless (MR)","wireless:telemetry:write":"Wireless (MR)"}}}}}},"spec":{"description":"Update the third party VPN peers for an organization.\n\nSubnet overlap warning: Unlike the Dashboard UI, updateOrganizationApplianceVpnThirdPartyVPNPeers does not run the org-wide subnet-overlap validation before saving changes. Requests with overlapping VPN subnets will succeed through the API, but the resulting configuration may be blocked from further edits in Dashboard until the overlaps are resolved manually. Use this endpoint only when you've already confirmed the advertised subnets are unique across the organization.\n","operationId":"updateOrganizationApplianceVpnThirdPartyVPNPeers","parameters":[{"name":"organizationId","in":"path","description":"Organization ID","schema":{"type":"string"},"required":true}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"peers":{"type":"array","items":{"type":"object","properties":{"peerId":{"type":"string","description":"The ID of the IPsec peer"},"name":{"type":"string","description":"The name of the VPN peer"},"publicIp":{"type":"string","description":"[optional] The public IP of the VPN peer"},"publicHostname":{"type":"string","description":"[optional] The public hostname of the VPN peer"},"privateSubnets":{"type":"array","items":{"type":"string"},"description":"The list of the private subnets of the VPN peer"},"localId":{"type":"string","description":"[optional] The local ID is used to identify the MX to the peer. This will apply to all MXs this peer applies to."},"remoteId":{"type":"string","description":"[optional] The remote ID is used to identify the connecting VPN peer. This can either be a valid IPv4 Address, FQDN or User FQDN."},"ipsecPolicies":{"type":"object","properties":{"ikeCipherAlgo":{"type":"array","items":{"type":"string","enum":["aes128","aes192","aes256","des","tripledes"]},"description":"This is the cipher algorithm to be used in Phase 1. The value should be an array with one of the following algorithms: 'aes256', 'aes192', 'aes128', 'tripledes', 'des'"},"ikeAuthAlgo":{"type":"array","items":{"type":"string","enum":["md5","sha1","sha256"]},"description":"This is the authentication algorithm to be used in Phase 1. The value should be an array with one of the following algorithms: 'sha256', 'sha1', 'md5'"},"ikePrfAlgo":{"type":"array","items":{"type":"string","enum":["default","prfmd5","prfsha1","prfsha256"]},"description":"[optional] This is the pseudo-random function to be used in IKE_SA. The value should be an array with one of the following algorithms: 'prfsha256', 'prfsha1', 'prfmd5', 'default'. The 'default' option can be used to default to the Authentication algorithm."},"ikeDiffieHellmanGroup":{"type":"array","items":{"type":"string"},"description":"This is the Diffie-Hellman group to be used in Phase 1. The value should be an array with one of the following algorithms: 'group14', 'group5', 'group2', 'group1'"},"ikeLifetime":{"type":"integer","description":"The lifetime of the Phase 1 SA in seconds."},"childCipherAlgo":{"type":"array","items":{"type":"string","enum":["aes128","aes192","aes256","des","null","tripledes"]},"description":"This is the cipher algorithms to be used in Phase 2. The value should be an array with one or more of the following algorithms: 'aes256', 'aes192', 'aes128', 'tripledes', 'des', 'null'"},"childAuthAlgo":{"type":"array","items":{"type":"string","enum":["md5","sha1","sha256"]},"description":"This is the authentication algorithms to be used in Phase 2. The value should be an array with one of the following algorithms: 'sha256', 'sha1', 'md5'"},"childPfsGroup":{"type":"array","items":{"type":"string"},"description":"This is the Diffie-Hellman group to be used for Perfect Forward Secrecy in Phase 2. The value should be an array with one of the following values: 'disabled','group14', 'group5', 'group2', 'group1'"},"childLifetime":{"type":"integer","description":"The lifetime of the Phase 2 SA in seconds."}},"description":"Custom IPSec policies for the VPN peer. If not included and a preset has not been chosen, the default preset for IPSec policies will be used."},"ipsecPoliciesPreset":{"type":"string","enum":["aws","azure","default","secure","umbrella","umbrella_short_lived","zscaler"],"description":"One of the following available presets: 'default', 'aws', 'azure', 'umbrella', 'umbrella_short_lived', 'secure', 'zscaler'. If this is provided, the 'ipsecPolicies' parameter is ignored. Note that 'umbrella_short_lived' maps to the Dashboard UI label 'Umbrella', while 'umbrella' maps to the Dashboard UI label 'Umbrella (Deprecated)'."},"slaPolicy":{"type":"object","properties":{"id":{"type":"string","description":"The ID of the SLA policy"}},"description":"[optional] Information about the SLA policy to be applied to the peer"},"secret":{"type":"string","description":"The shared secret with the VPN peer"},"ikeVersion":{"type":"string","enum":["1","2"],"description":"[optional] The IKE version to be used for the IPsec VPN peer configuration. Defaults to '1' when omitted.","default":"1"},"networkTags":{"type":"array","items":{"type":"string"},"description":"A list of network tags that will connect with this peer. Use ['all'] for all networks. Use ['none'] for no networks. If not included, the default is ['all']."},"network":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"},"description":"[optional] A list of network IDs."}},"description":"[optional] A list of network Names and IDs that will connect with this peer. Supported only for MX 19.1 and above."},"isRouteBased":{"type":"boolean","description":"[optional] If true, the VPN peer is route-based. If not included, the default is false. Supported only for MX 19.1 and above."},"ebgpNeighbor":{"type":"object","properties":{"neighborIp":{"type":"string","description":"IPv4/IPv6 address of the neighbor"},"ipVersion":{"type":"integer","enum":[4,6],"description":"The IP version of the neighbor"},"remoteAsNumber":{"type":"integer","description":"Remote ASN of the neighbor. The remote ASN must be an integer between 1 and 4294967295."},"ebgpHoldTimer":{"type":"integer","description":"The eBGP hold timer in seconds for each neighbor. The eBGP hold timer must be an integer between 12 and 240."},"ebgpMultihop":{"type":"integer","description":"Configure this if the neighbor is not adjacent. The eBGP multi-hop must be an integer between 1 and 255."},"sourceIp":{"type":"string","description":"Source IP of eBGP neighbor"},"vrf":{"type":"object","properties":{"id":{"type":"string","description":"VRF ID for the Catalyst BGP neighbor. Use 0 for the default VRF."},"name":{"type":"string","description":"VRF name for the Catalyst BGP neighbor."}},"required":["id"],"description":"The VRF associated with the BGP neighbor. Required for Catalyst BGP peers, including an explicit default VRF (id 0); optional for existing MX peers, which use the default VRF when omitted.","x-release-stage":"general_availability"},"pathPrepend":{"type":"array","items":{"type":"integer"},"description":"Prepends the AS_PATH BGP Attribute associated with routes received from the remote peer. Configurable value of ASNs to prepend. Length of the array may not exceed 10, and each ASN in the array must be an integer between 1 and 4294967295. AS_PATH is 4th in the decision tree when identical routes from multiple peers exist."},"multiExitDiscriminator":{"type":"integer","description":"Configures the local metric associated with routes received from the remote peer. Routes from peers with lower metrics are will be preferred. Must be an integer between 0 and 4294967295. MED is 6th in the decision tree when identical routes from multiple peers exist."},"weight":{"type":"integer","description":"Configures the local metric associated with routes received from the remote peer. Routes from peers with lower metrics are will be preferred. Must be an integer between 0 and 4294967295. MED is 6th in the decision tree when identical routes from multiple peers exist."}},"description":"[optional] The BGP neighbor configuration for the VPN peer. Supported only for MX 19.1 and above."},"ecmpUplinkConfigs":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","description":"ID of the ECMP uplink configuration"},"wan":{"type":"string","enum":["WAN 1","WAN 2","WAN 3","WAN 4"],"description":"The WAN uplink associated with this ECMP configuration."},"privateSubnets":{"type":"array","items":{"type":"string"},"description":"The list of the private subnets of the VPN peer"},"ebgpNeighbor":{"type":"object","properties":{"neighborIp":{"type":"string","description":"IPv4/IPv6 address of the neighbor"},"sourceIp":{"type":"string","description":"Source IP of eBGP neighbor"}},"description":"[optional] The BGP neighbor configuration for the VPN peer. Supported only for MX 19.1 and above."}}},"description":"[optional] The ECMP per-uplink BGP-over-IPsec configuration for the VPN peer."},"priorityInGroup":{"type":"integer","description":"[optional] Represents the order of peer inside a group. If you submit a request with the numbers [1, 9, 999], these numbers will be automatically adjusted to a sequential order starting from 1. So, they will be changed to [1, 2, 3] to reflect their positions in the sequence."},"group":{"type":"object","properties":{"number":{"type":"integer","description":"[optional] Represents the ordering of primary and backup tunnels group. primary and backup tunnels are grouped by this number. If you submit a request with the numbers [1, 9, 999], these numbers will be automatically adjusted to a sequential order starting from 1. So, they will be changed to [1, 2, 3] to reflect their positions in the sequence."},"failover":{"type":"object","properties":{"directToInternet":{"type":"boolean","description":"[optional] When both primary and backup tunnels are down, direct traffic to the internet. Traffic will be routed via the WAN"}},"description":"[optional] Contains the failover configuration for the group."},"activeActiveTunnel":{"type":"boolean","description":"[optional] Both primary and backup tunnels are active."}},"description":"[optional] Contains the mapping between primary tunnel and backup tunnels."}},"required":["name","privateSubnets","secret"]},"description":"The list of VPN peers"}},"example":{"peers":[{"peerId":"1234","name":"Peer Name","publicIp":"123.123.123.1","publicHostname":"example.com","privateSubnets":["192.168.1.0/24","192.168.128.0/24"],"localId":"myMXId@meraki.com","remoteId":"miles@meraki.com","ipsecPolicies":{"ikeCipherAlgo":["tripledes"],"ikeAuthAlgo":["sha1"],"ikePrfAlgo":["prfsha1"],"ikeDiffieHellmanGroup":["group2"],"ikeLifetime":28800,"childCipherAlgo":["aes128"],"childAuthAlgo":["sha1"],"childPfsGroup":["disabled"],"childLifetime":28800},"ipsecPoliciesPreset":"default","slaPolicy":{"id":"1234"},"secret":"Sample Password","ikeVersion":"2","networkTags":["none"],"network":{"ids":["N_1","L_2","N_3"]},"isRouteBased":true,"ebgpNeighbor":{"neighborIp":"10.10.10.22","ipVersion":4,"remoteAsNumber":64343,"ebgpHoldTimer":180,"ebgpMultihop":2,"sourceIp":"10.10.10.22","vrf":{"id":"12345","name":"VRF Blue"},"pathPrepend":[1,2],"multiExitDiscriminator":1,"weight":10},"ecmpUplinkConfigs":[{"id":"7890","wan":"WAN 1","privateSubnets":["169.254.10.0/30"],"ebgpNeighbor":{"neighborIp":"169.254.10.2","sourceIp":"169.254.10.1"}}],"priorityInGroup":1,"group":{"number":1,"failover":{"directToInternet":true},"activeActiveTunnel":true}}]},"required":["peers"]}}},"required":true},"responses":{"200":{"description":"Successful operation","content":{"application/json":{"schema":{"type":"object","properties":{"peers":{"type":"array","items":{"type":"object","properties":{"peerId":{"type":"string","description":"The ID of the IPsec peer"},"name":{"type":"string","description":"The name of the VPN peer"},"publicIp":{"type":"string","description":"[optional] The public IP of the VPN peer"},"remoteId":{"type":"string","description":"[optional] The remote ID is used to identify the connecting VPN peer. This can either be a valid IPv4 Address, FQDN or User FQDN."},"localId":{"type":"string","description":"[optional] The local ID is used to identify the MX to the peer. This will apply to all MXs this peer applies to."},"secret":{"type":"string","description":"The shared secret with the VPN peer"},"privateSubnets":{"type":"array","items":{"type":"string"},"description":"The list of the private subnets of the VPN peer"},"ipsecPolicies":{"type":"object","properties":{"ikeCipherAlgo":{"type":"array","items":{"type":"string","enum":["aes128","aes192","aes256","des","tripledes"]},"description":"This is the cipher algorithm to be used in Phase 1. The value should be an array with one of the following algorithms: 'aes256', 'aes192', 'aes128', 'tripledes', 'des'"},"ikeAuthAlgo":{"type":"array","items":{"type":"string","enum":["md5","sha1","sha256"]},"description":"This is the authentication algorithm to be used in Phase 1. The value should be an array with one of the following algorithms: 'sha256', 'sha1', 'md5'"},"ikePrfAlgo":{"type":"array","items":{"type":"string","enum":["default","prfmd5","prfsha1","prfsha256"]},"description":"[optional] This is the pseudo-random function to be used in IKE_SA. The value should be an array with one of the following algorithms: 'prfsha256', 'prfsha1', 'prfmd5', 'default'. The 'default' option can be used to default to the Authentication algorithm."},"ikeDiffieHellmanGroup":{"type":"array","items":{"type":"string"},"description":"This is the Diffie-Hellman group to be used in Phase 1. The value should be an array with one of the following algorithms: 'group14', 'group5', 'group2', 'group1'"},"ikeLifetime":{"type":"integer","description":"The lifetime of the Phase 1 SA in seconds."},"childCipherAlgo":{"type":"array","items":{"type":"string","enum":["aes128","aes192","aes256","des","null","tripledes"]},"description":"This is the cipher algorithms to be used in Phase 2. The value should be an array with one or more of the following algorithms: 'aes256', 'aes192', 'aes128', 'tripledes', 'des', 'null'"},"childAuthAlgo":{"type":"array","items":{"type":"string","enum":["md5","sha1","sha256"]},"description":"This is the authentication algorithms to be used in Phase 2. The value should be an array with one of the following algorithms: 'sha256', 'sha1', 'md5'"},"childPfsGroup":{"type":"array","items":{"type":"string"},"description":"This is the Diffie-Hellman group to be used for Perfect Forward Secrecy in Phase 2. The value should be an array with one of the following values: 'disabled','group14', 'group5', 'group2', 'group1'"},"childLifetime":{"type":"integer","description":"The lifetime of the Phase 2 SA in seconds."}},"description":"Custom IPSec policies for the VPN peer. If not included and a preset has not been chosen, the default preset for IPSec policies will be used."},"slaPolicy":{"type":"object","properties":{"id":{"type":"string","description":"The ID of the SLA policy"}},"description":"[optional] Information about the SLA policy to be applied to the peer"},"ipsecPoliciesPreset":{"type":"string","enum":["aws","azure","default","secure","umbrella","umbrella_short_lived","zscaler"],"description":"One of the following available presets: 'default', 'aws', 'azure', 'umbrella', 'umbrella_short_lived', 'secure', 'zscaler'. If this is provided, the 'ipsecPolicies' parameter is ignored. Note that 'umbrella_short_lived' maps to the Dashboard UI label 'Umbrella', while 'umbrella' maps to the Dashboard UI label 'Umbrella (Deprecated)'."},"ikeVersion":{"type":"string","enum":["1","2"],"description":"[optional] The IKE version to be used for the IPsec VPN peer configuration. Defaults to '1' when omitted.","default":"1"},"networkTags":{"type":"array","items":{"type":"string"},"description":"A list of network tags that will connect with this peer. Use ['all'] for all networks. Use ['none'] for no networks. If not included, the default is ['all']."},"network":{"type":"object","properties":{"names":{"type":"array","items":{"type":"string"},"description":"[optional] A list of network Names. Supported only for MX 19.1 and above. The order of items matches the order of IDs."},"ids":{"type":"array","items":{"type":"string"},"description":"[optional] A list of network IDs."}},"description":"[optional] A list of network Names and IDs that will connect with this peer. Supported only for MX 19.1 and above."},"isRouteBased":{"type":"boolean","description":"[optional] If true, the VPN peer is route-based. If not included, the default is false. Supported only for MX 19.1 and above."},"ebgpNeighbor":{"type":"object","properties":{"neighborId":{"type":"integer","description":"ID of ebgp neighbor"},"neighborIp":{"type":"string","description":"IPv4/IPv6 address of the neighbor"},"ipVersion":{"type":"integer","enum":[4,6],"description":"The IP version of the neighbor"},"remoteAsNumber":{"type":"integer","description":"Remote ASN of the neighbor. The remote ASN must be an integer between 1 and 4294967295."},"ebgpHoldTimer":{"type":"integer","description":"The eBGP hold timer in seconds for each neighbor. The eBGP hold timer must be an integer between 12 and 240."},"ebgpMultihop":{"type":"integer","description":"Configure this if the neighbor is not adjacent. The eBGP multi-hop must be an integer between 1 and 255."},"sourceIp":{"type":"string","description":"Source IP of eBGP neighbor"},"vrf":{"type":"object","properties":{"id":{"type":"string","description":"VRF ID for the Catalyst BGP neighbor. Use 0 for the default VRF."},"name":{"type":"string","description":"VRF name for the Catalyst BGP neighbor."}},"description":"The VRF associated with the BGP neighbor. Required for Catalyst BGP peers, including an explicit default VRF (id 0); optional for existing MX peers, which use the default VRF when omitted.","x-release-stage":"general_availability"},"ttlSecurity":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether BGP TTL security is enabled. Supported only for MX 26.2 and above"}},"description":"Settings for BGP TTL security to protect BGP peering sessions from forged IP attacks. Supported only for MX 26.2 and above","x-release-stage":"general_availability"},"authentication":{"type":"object","properties":{"password":{"type":"string","description":"Password to configure MD5 authentication between BGP peers. Supported only for MX 26.2 and above"}},"description":"Authentication settings between BGP peers. Supported only for MX 26.2 and above","x-release-stage":"general_availability"},"allowTransit":{"type":"boolean","description":"Whether the appliance will advertise routes learned from other Autonomous Systems. Supported only for MX 26.2 and above","x-release-stage":"general_availability"},"receiveLimit":{"type":"integer","description":"Maximum number of prefixes accepted from the remote peer. Must be an integer between 0 and 2147483647. Supported only for MX 26.2 and above"},"explicitOutboundRouteAdvertisement":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether explicit outbound routes are advertised to the eBGP neighbor. Supported only for MX 26.2 and above","nullable":true}},"description":"Settings for explicit outbound route advertisement to an eBGP neighbor","x-release-stage":"general_availability","nullable":true},"filter":{"type":"object","properties":{"out":{"type":"array","items":{"type":"string"},"description":"Filters routes advertised to an eBGP neighbor. Each entry must be an IPv4 CIDR string. Supported only for MX 26.2 and above","nullable":true}},"description":"Filters routes for an eBGP neighbor.","x-release-stage":"general_availability"},"filterIn":{"type":"array","items":{"type":"string"},"description":"Filters routes received from an eBGP neighbor. Each entry must be an IPv4 CIDR string. Supported only for MX 26.2 and above","x-release-stage":"general_availability"},"communityOut":{"type":"array","items":{"type":"string"},"description":"List of BGP communities tagged to the routes advertised to an eBGP neighbor. Supported only for MX 26.2 and above","x-release-stage":"general_availability"},"pathPrepend":{"type":"array","items":{"type":"integer"},"description":"Prepends the AS_PATH BGP Attribute associated with routes received from the remote peer. Configurable value of ASNs to prepend. Length of the array may not exceed 10, and each ASN in the array must be an integer between 1 and 4294967295. AS_PATH is 4th in the decision tree when identical routes from multiple peers exist."},"multiExitDiscriminator":{"type":"integer","description":"Configures the local metric associated with routes received from the remote peer. Routes from peers with lower metrics are will be preferred. Must be an integer between 0 and 4294967295. MED is 6th in the decision tree when identical routes from multiple peers exist."},"weight":{"type":"integer","description":"Configures the local metric associated with routes received from the remote peer. Routes from peers with lower metrics are will be preferred. Must be an integer between 0 and 4294967295. MED is 6th in the decision tree when identical routes from multiple peers exist."}},"description":"[optional] The BGP neighbor configuration for the VPN peer. Supported only for MX 19.1 and above."},"ecmpUplinkConfigs":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","description":"ID of the ECMP uplink configuration"},"wan":{"type":"string","enum":["WAN 1","WAN 2","WAN 3","WAN 4"],"description":"The WAN uplink associated with this ECMP configuration."},"privateSubnets":{"type":"array","items":{"type":"string"},"description":"The private subnets associated with this ECMP uplink configuration."},"ebgpNeighbor":{"type":"object","properties":{"neighborIp":{"type":"string","description":"IPv4/IPv6 address of the neighbor"},"sourceIp":{"type":"string","description":"Source IP of eBGP neighbor"}},"description":"[optional] The eBGP neighbor configuration associated with this ECMP uplink configuration. Catalyst uplinks inherit the VRF association from the parent ebgpNeighbor."}}},"description":"[optional] The ECMP per-uplink BGP-over-IPsec configuration for the VPN peer."},"priorityInGroup":{"type":"integer","description":"[optional] Represents the order of peer inside a group."},"group":{"type":"object","properties":{"number":{"type":"integer","description":"[optional] Represents the ordering of primary and backup tunnels group. primary and backup tunnels are grouped by this number. Peers containing same group number belongs to same group."},"failover":{"type":"object","properties":{"directToInternet":{"type":"boolean","description":"[optional] When both primary and backup tunnels are down, direct traffic to the internet. Traffic will be routed via the WAN"}},"description":"[optional] Contains the failover configuration for the group."},"activeActiveTunnel":{"type":"boolean","description":"[optional] Both primary and backup tunnels are active."}},"description":"[optional] Contains the mapping between primary tunnel and backup tunnels."}}},"description":"The list of VPN peers"}}},"example":{"peers":[{"peerId":"1234","name":"Peer Name","publicIp":"123.123.123.1","remoteId":"miles@meraki.com","localId":"myMXId@meraki.com","secret":"secret","privateSubnets":["192.168.1.0/24","192.168.128.0/24"],"ipsecPolicies":{"ikeCipherAlgo":["tripledes"],"ikeAuthAlgo":["sha1"],"ikePrfAlgo":["prfsha1"],"ikeDiffieHellmanGroup":["group2"],"ikeLifetime":28800,"childCipherAlgo":["aes128"],"childAuthAlgo":["sha1"],"childPfsGroup":["disabled"],"childLifetime":28800},"slaPolicy":{"id":"1234"},"ipsecPoliciesPreset":"default","ikeVersion":"1","networkTags":["all"],"network":{"names":["Network 1","Location 2","Network 3"],"ids":["N_1","L_2","N_3"]},"isRouteBased":true,"ebgpNeighbor":{"neighborId":1234,"neighborIp":"10.10.10.22","ipVersion":4,"remoteAsNumber":64343,"ebgpHoldTimer":180,"ebgpMultihop":2,"sourceIp":"10.10.10.22","vrf":{"id":"12345","name":"VRF Blue"},"ttlSecurity":{"enabled":false},"authentication":{"password":"abc123"},"allowTransit":true,"receiveLimit":100,"explicitOutboundRouteAdvertisement":{"enabled":true},"filter":{"out":["10.0.0.0/8","172.16.0.0/12"]},"filterIn":["10.0.0.0/8","172.16.0.0/12"],"communityOut":["64515:100","NO_EXPORT"],"pathPrepend":[1,2],"multiExitDiscriminator":1,"weight":10},"ecmpUplinkConfigs":[{"id":"7890","wan":"WAN 1","privateSubnets":["169.254.10.0/30"],"ebgpNeighbor":{"neighborIp":"169.254.10.2","sourceIp":"169.254.10.1"}}],"priorityInGroup":1,"group":{"number":1,"failover":{"directToInternet":true},"activeActiveTunnel":true}}]}}}}},"security":[{"oauth2":["sdwan:config:write"]}],"summary":"Update the third party VPN peers for an organization","tags":["appliance","configure","vpn","thirdPartyVPNPeers"],"__originalOperationId":"updateOrganizationApplianceVpnThirdPartyVPNPeers","method":"put","path":"/organizations/{organizationId}/appliance/vpn/thirdPartyVPNPeers","sampleCode":{"Meraki Python Library":{"code":"import meraki\n\n# Defining your API key as a variable in source code is discouraged.\n# This API key is for a read-only docs-specific environment.\n# In your own code, use an environment variable as shown under the Usage section\n# @ https://github.com/meraki/dashboard-api-python/\n\nAPI_KEY = 'your-key-here'\n\ndashboard = meraki.DashboardAPI(API_KEY)\n\norganization_id = '549236'\npeers = [{'name': 'Peer Name', 'publicIp': '123.123.123.1', 'publicHostname': 'example.com', 'privateSubnets': ['192.168.1.0/24', '192.168.128.0/24'], 'localId': 'myMXId@meraki.com', 'remoteId': 'miles@meraki.com', 'ipsecPolicies': {'ikeCipherAlgo': ['tripledes'], 'ikeAuthAlgo': ['sha1'], 'ikePrfAlgo': ['prfsha1'], 'ikeDiffieHellmanGroup': ['group2'], 'ikeLifetime': 28800, 'childCipherAlgo': ['aes128'], 'childAuthAlgo': ['sha1'], 'childPfsGroup': ['disabled'], 'childLifetime': 28800}, 'ipsecPoliciesPreset': 'default', 'secret': 'Sample Password', 'ikeVersion': '2', 'networkTags': ['none']}]\n\nresponse = dashboard.appliance.updateOrganizationApplianceVpnThirdPartyVPNPeers(\n organization_id, peers\n)\n\nprint(response)","highlight":"python"}}}}