import * as pulumi from "@pulumi/pulumi"; import * as inputs from "../types/input"; import * as outputs from "../types/output"; /** * This resource provides the Ipsec Connection Tunnel Management resource in Oracle Cloud Infrastructure Core service. * Api doc link for the resource: https://docs.oracle.com/iaas/api/#/en/iaas/latest/IpsecConnectionTunnelManagement * * Example terraform configs related to the resource : https://github.com/oracle/terraform-provider-oci/tree/master/examples/ * * Updates the specified tunnel. This operation lets you change tunnel attributes such as the * routing type (BGP dynamic routing or static routing). Here are some important notes: * * * If you change the tunnel's routing type or BGP session configuration, the tunnel will go * down while it's reprovisioned. * * * If you want to switch the tunnel's `routing` from `STATIC` to `BGP`, make sure the tunnel's * BGP session configuration attributes have been set (bgpSessionConfig). * * * If you want to switch the tunnel's `routing` from `BGP` to `STATIC`, make sure the * IPSecConnection already has at least one valid CIDR * static route. * * ** IMPORTANT ** * Destroying the `oci.Core.IpsecConnectionTunnelManagement` leaves the resource in its existing state. It will not destroy the tunnel and it will not return the tunnel to its default values. * * ## Example Usage * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as oci from "@pulumi/oci"; * * const testIpSecConnectionTunnel = new oci.core.IpsecConnectionTunnelManagement("test_ip_sec_connection_tunnel", { * ipsecId: testIpsec.id, * tunnelId: testIpSecConnectionTunnels.ipSecConnectionTunnels[0].id, * routing: ipSecConnectionTunnelManagementRouting, * bgpSessionInfo: { * customerBgpAsn: ipSecConnectionTunnelManagementBgpSessionInfoCustomerBgpAsn, * customerInterfaceIp: ipSecConnectionTunnelManagementBgpSessionInfoCustomerInterfaceIp, * oracleInterfaceIp: ipSecConnectionTunnelManagementBgpSessionInfoOracleInterfaceIp, * }, * displayName: ipSecConnectionTunnelManagementDisplayName, * encryptionDomainConfig: { * cpeTrafficSelectors: ipSecConnectionTunnelManagementEncryptionDomainConfigCpeTrafficSelector, * oracleTrafficSelectors: ipSecConnectionTunnelManagementEncryptionDomainConfigOracleTrafficSelector, * }, * sharedSecret: ipSecConnectionTunnelManagementSharedSecret, * ikeVersion: "V1", * }); * ``` */ export declare class IpsecConnectionTunnelManagement extends pulumi.CustomResource { /** * Get an existing IpsecConnectionTunnelManagement resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input, state?: IpsecConnectionTunnelManagementState, opts?: pulumi.CustomResourceOptions): IpsecConnectionTunnelManagement; /** * Returns true if the given object is an instance of IpsecConnectionTunnelManagement. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is IpsecConnectionTunnelManagement; /** * The list of virtual circuit [OCID](https://docs.cloud.oracle.com/iaas/Content/General/Concepts/identifiers.htm)s over which your network can reach this tunnel. */ readonly associatedVirtualCircuits: pulumi.Output; /** * Information for establishing a BGP session for the IPSec tunnel. Required if the tunnel uses BGP dynamic routing. * * If the tunnel instead uses static routing, you may optionally provide this object and set an IP address for one or both ends of the IPSec tunnel for the purposes of troubleshooting or monitoring the tunnel. */ readonly bgpSessionInfo: pulumi.Output; /** * The [OCID](https://docs.cloud.oracle.com/iaas/Content/General/Concepts/identifiers.htm) of the compartment containing the tunnel. */ readonly compartmentId: pulumi.Output; /** * The IP address of the CPE device's VPN headend. Example: `203.0.113.22` */ readonly cpeIp: pulumi.Output; /** * A user-friendly name. Does not have to be unique, and it's changeable. Avoid entering confidential information. */ readonly displayName: pulumi.Output; readonly dpdConfigs: pulumi.Output; /** * Dead peer detection (DPD) mode set on the Oracle side of the connection. */ readonly dpdMode: pulumi.Output; /** * DPD timeout in seconds. */ readonly dpdTimeoutInSec: pulumi.Output; /** * Configuration information used by the encryption domain policy. Required if the tunnel uses POLICY routing. */ readonly encryptionDomainConfig: pulumi.Output; /** * Internet Key Exchange protocol version. */ readonly ikeVersion: pulumi.Output; /** * The OCID of the IPSec connection. */ readonly ipsecId: pulumi.Output; /** * By default (the `AUTO` setting), IKE sends packets with a source and destination port set to 500, and when it detects that the port used to forward packets has changed (most likely because a NAT device is between the CPE device and the Oracle VPN headend) it will try to negotiate the use of NAT-T. * * The `ENABLED` option sets the IKE protocol to use port 4500 instead of 500 and forces encapsulating traffic with the ESP protocol inside UDP packets. * * The `DISABLED` option directs IKE to completely refuse to negotiate NAT-T even if it senses there may be a NAT device in use. */ readonly natTranslationEnabled: pulumi.Output; /** * Indicates whether Oracle can only respond to a request to start an IPSec tunnel from the CPE device (`RESPONDER_ONLY`), or both respond to and initiate requests (`INITIATOR_OR_RESPONDER`). */ readonly oracleCanInitiate: pulumi.Output; /** * Configuration details for IKE phase one (ISAKMP) configuration parameters. * * See [PhaseOneConfigDetails](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/datatypes/PhaseOneConfigDetails) for allowed values but note naming scheme follows [TunnelPhaseOneDetails](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/datatypes/TunnelPhaseOneDetails). */ readonly phaseOneDetails: pulumi.Output; /** * Configuration details for IPSec phase two configuration parameters. * * See [PhaseTwoConfigDetails](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/datatypes/PhaseTwoConfigDetails) for allowed values, but note naming scheme follows [TunnelPhaseTwoDetails](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/datatypes/TunnelPhaseTwoDetails). */ readonly phaseTwoDetails: pulumi.Output; /** * The type of routing to use for this tunnel (either BGP dynamic routing, STATIC routing or POLICY routing). */ readonly routing: pulumi.Output; /** * The shared secret (pre-shared key) to use for the IPSec tunnel. If you don't provide a value, Oracle generates a value for you. You can specify your own shared secret later if you like with [UpdateIPSecConnectionTunnelSharedSecret](https://docs.cloud.oracle.com/iaas/api/#/en/iaas/20160918/IPSecConnectionTunnelSharedSecret/UpdateIPSecConnectionTunnelSharedSecret). Example: `EXAMPLEToUis6j1c.p8G.dVQxcmdfMO0yXMLi.lZTbYCMDGu4V8o` */ readonly sharedSecret: pulumi.Output; /** * The IPSec connection's tunnel's lifecycle state. */ readonly state: pulumi.Output; /** * The tunnel's current state. */ readonly status: pulumi.Output; /** * The date and time the IPSec connection tunnel was created, in the format defined by RFC3339. Example: `2016-08-25T21:10:29.600Z` */ readonly timeCreated: pulumi.Output; /** * When the status of the tunnel last changed, in the format defined by RFC3339. Example: `2016-08-25T21:10:29.600Z` */ readonly timeStatusUpdated: pulumi.Output; /** * The OCID of the IPSec connection's tunnel. */ readonly tunnelId: pulumi.Output; /** * The IP address of Oracle's VPN headend. Example: `129.146.17.50` */ readonly vpnIp: pulumi.Output; /** * Create a IpsecConnectionTunnelManagement resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ constructor(name: string, args: IpsecConnectionTunnelManagementArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering IpsecConnectionTunnelManagement resources. */ export interface IpsecConnectionTunnelManagementState { /** * The list of virtual circuit [OCID](https://docs.cloud.oracle.com/iaas/Content/General/Concepts/identifiers.htm)s over which your network can reach this tunnel. */ associatedVirtualCircuits?: pulumi.Input[] | undefined>; /** * Information for establishing a BGP session for the IPSec tunnel. Required if the tunnel uses BGP dynamic routing. * * If the tunnel instead uses static routing, you may optionally provide this object and set an IP address for one or both ends of the IPSec tunnel for the purposes of troubleshooting or monitoring the tunnel. */ bgpSessionInfo?: pulumi.Input; /** * The [OCID](https://docs.cloud.oracle.com/iaas/Content/General/Concepts/identifiers.htm) of the compartment containing the tunnel. */ compartmentId?: pulumi.Input; /** * The IP address of the CPE device's VPN headend. Example: `203.0.113.22` */ cpeIp?: pulumi.Input; /** * A user-friendly name. Does not have to be unique, and it's changeable. Avoid entering confidential information. */ displayName?: pulumi.Input; dpdConfigs?: pulumi.Input[] | undefined>; /** * Dead peer detection (DPD) mode set on the Oracle side of the connection. */ dpdMode?: pulumi.Input; /** * DPD timeout in seconds. */ dpdTimeoutInSec?: pulumi.Input; /** * Configuration information used by the encryption domain policy. Required if the tunnel uses POLICY routing. */ encryptionDomainConfig?: pulumi.Input; /** * Internet Key Exchange protocol version. */ ikeVersion?: pulumi.Input; /** * The OCID of the IPSec connection. */ ipsecId?: pulumi.Input; /** * By default (the `AUTO` setting), IKE sends packets with a source and destination port set to 500, and when it detects that the port used to forward packets has changed (most likely because a NAT device is between the CPE device and the Oracle VPN headend) it will try to negotiate the use of NAT-T. * * The `ENABLED` option sets the IKE protocol to use port 4500 instead of 500 and forces encapsulating traffic with the ESP protocol inside UDP packets. * * The `DISABLED` option directs IKE to completely refuse to negotiate NAT-T even if it senses there may be a NAT device in use. */ natTranslationEnabled?: pulumi.Input; /** * Indicates whether Oracle can only respond to a request to start an IPSec tunnel from the CPE device (`RESPONDER_ONLY`), or both respond to and initiate requests (`INITIATOR_OR_RESPONDER`). */ oracleCanInitiate?: pulumi.Input; /** * Configuration details for IKE phase one (ISAKMP) configuration parameters. * * See [PhaseOneConfigDetails](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/datatypes/PhaseOneConfigDetails) for allowed values but note naming scheme follows [TunnelPhaseOneDetails](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/datatypes/TunnelPhaseOneDetails). */ phaseOneDetails?: pulumi.Input; /** * Configuration details for IPSec phase two configuration parameters. * * See [PhaseTwoConfigDetails](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/datatypes/PhaseTwoConfigDetails) for allowed values, but note naming scheme follows [TunnelPhaseTwoDetails](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/datatypes/TunnelPhaseTwoDetails). */ phaseTwoDetails?: pulumi.Input; /** * The type of routing to use for this tunnel (either BGP dynamic routing, STATIC routing or POLICY routing). */ routing?: pulumi.Input; /** * The shared secret (pre-shared key) to use for the IPSec tunnel. If you don't provide a value, Oracle generates a value for you. You can specify your own shared secret later if you like with [UpdateIPSecConnectionTunnelSharedSecret](https://docs.cloud.oracle.com/iaas/api/#/en/iaas/20160918/IPSecConnectionTunnelSharedSecret/UpdateIPSecConnectionTunnelSharedSecret). Example: `EXAMPLEToUis6j1c.p8G.dVQxcmdfMO0yXMLi.lZTbYCMDGu4V8o` */ sharedSecret?: pulumi.Input; /** * The IPSec connection's tunnel's lifecycle state. */ state?: pulumi.Input; /** * The tunnel's current state. */ status?: pulumi.Input; /** * The date and time the IPSec connection tunnel was created, in the format defined by RFC3339. Example: `2016-08-25T21:10:29.600Z` */ timeCreated?: pulumi.Input; /** * When the status of the tunnel last changed, in the format defined by RFC3339. Example: `2016-08-25T21:10:29.600Z` */ timeStatusUpdated?: pulumi.Input; /** * The OCID of the IPSec connection's tunnel. */ tunnelId?: pulumi.Input; /** * The IP address of Oracle's VPN headend. Example: `129.146.17.50` */ vpnIp?: pulumi.Input; } /** * The set of arguments for constructing a IpsecConnectionTunnelManagement resource. */ export interface IpsecConnectionTunnelManagementArgs { /** * Information for establishing a BGP session for the IPSec tunnel. Required if the tunnel uses BGP dynamic routing. * * If the tunnel instead uses static routing, you may optionally provide this object and set an IP address for one or both ends of the IPSec tunnel for the purposes of troubleshooting or monitoring the tunnel. */ bgpSessionInfo?: pulumi.Input; /** * A user-friendly name. Does not have to be unique, and it's changeable. Avoid entering confidential information. */ displayName?: pulumi.Input; dpdConfigs?: pulumi.Input[] | undefined>; /** * Configuration information used by the encryption domain policy. Required if the tunnel uses POLICY routing. */ encryptionDomainConfig?: pulumi.Input; /** * Internet Key Exchange protocol version. */ ikeVersion?: pulumi.Input; /** * The OCID of the IPSec connection. */ ipsecId: pulumi.Input; /** * By default (the `AUTO` setting), IKE sends packets with a source and destination port set to 500, and when it detects that the port used to forward packets has changed (most likely because a NAT device is between the CPE device and the Oracle VPN headend) it will try to negotiate the use of NAT-T. * * The `ENABLED` option sets the IKE protocol to use port 4500 instead of 500 and forces encapsulating traffic with the ESP protocol inside UDP packets. * * The `DISABLED` option directs IKE to completely refuse to negotiate NAT-T even if it senses there may be a NAT device in use. */ natTranslationEnabled?: pulumi.Input; /** * Indicates whether Oracle can only respond to a request to start an IPSec tunnel from the CPE device (`RESPONDER_ONLY`), or both respond to and initiate requests (`INITIATOR_OR_RESPONDER`). */ oracleCanInitiate?: pulumi.Input; /** * Configuration details for IKE phase one (ISAKMP) configuration parameters. * * See [PhaseOneConfigDetails](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/datatypes/PhaseOneConfigDetails) for allowed values but note naming scheme follows [TunnelPhaseOneDetails](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/datatypes/TunnelPhaseOneDetails). */ phaseOneDetails?: pulumi.Input; /** * Configuration details for IPSec phase two configuration parameters. * * See [PhaseTwoConfigDetails](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/datatypes/PhaseTwoConfigDetails) for allowed values, but note naming scheme follows [TunnelPhaseTwoDetails](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/datatypes/TunnelPhaseTwoDetails). */ phaseTwoDetails?: pulumi.Input; /** * The type of routing to use for this tunnel (either BGP dynamic routing, STATIC routing or POLICY routing). */ routing?: pulumi.Input; /** * The shared secret (pre-shared key) to use for the IPSec tunnel. If you don't provide a value, Oracle generates a value for you. You can specify your own shared secret later if you like with [UpdateIPSecConnectionTunnelSharedSecret](https://docs.cloud.oracle.com/iaas/api/#/en/iaas/20160918/IPSecConnectionTunnelSharedSecret/UpdateIPSecConnectionTunnelSharedSecret). Example: `EXAMPLEToUis6j1c.p8G.dVQxcmdfMO0yXMLi.lZTbYCMDGu4V8o` */ sharedSecret?: pulumi.Input; /** * The OCID of the IPSec connection's tunnel. */ tunnelId: pulumi.Input; } //# sourceMappingURL=ipsecConnectionTunnelManagement.d.ts.map