Documentation for `scw s2s-vpn`
The CLI documentation pages are currently under construction
The content is up to date. We're making improvements to the site over the next few weeks for a better experience.
This API allows you to manage your Site-to-Site VPN.
A connection represents the IPsec tunnel between VPN gateway and customer gateway.
A connection represents the IPsec tunnel between VPN gateway and customer gateway.
Create a connection
Create a connection.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| project-id | Project ID to use. If none is passed the default project ID will be used | |
| name | Name of the connection | Required |
| tags.{index} | List of tags to apply to the connection | |
| is-ipv6 | Defines IP version of the IPSec Tunnel | |
| initiation-policy | Who initiates the IPsec tunnel | Required One of: unknown_initiation_policy, vpn_gateway, customer_gateway |
| ikev2-ciphers.{index}.encryption | One of: unknown_encryption, aes128, aes192, aes256, aes128gcm, aes192gcm, aes256gcm, aes128ccm, aes256ccm, chacha20poly1305 | |
| ikev2-ciphers.{index}.integrity | One of: unknown_integrity, sha256, sha384, sha512 | |
| ikev2-ciphers.{index}.dh-group | One of: unknown_dhgroup, modp2048, modp3072, modp4096, ecp256, ecp384, ecp521, curve25519 | |
| esp-ciphers.{index}.encryption | One of: unknown_encryption, aes128, aes192, aes256, aes128gcm, aes192gcm, aes256gcm, aes128ccm, aes256ccm, chacha20poly1305 | |
| esp-ciphers.{index}.integrity | One of: unknown_integrity, sha256, sha384, sha512 | |
| esp-ciphers.{index}.dh-group | One of: unknown_dhgroup, modp2048, modp3072, modp4096, ecp256, ecp384, ecp521, curve25519 | |
| enable-route-propagation | Defines whether route propagation is enabled or not. | |
| secret.id | ||
| secret.revision | ||
| vpn-gateway-id | ID of the VPN gateway to attach to the connection | Required |
| customer-gateway-id | ID of the customer gateway to attach to the connection | Required |
| bgp-config-ipv4.routing-policy-id | ||
| bgp-config-ipv4.private-ip | ||
| bgp-config-ipv4.peer-private-ip | ||
| bgp-config-ipv6.routing-policy-id | ||
| bgp-config-ipv6.private-ip | ||
| bgp-config-ipv6.peer-private-ip | ||
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw |
Delete a connection
Delete an existing connection, specified by its connection ID.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| connection-id | ID of the connection to delete | Required |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw |
Detach a routing policy
Detach an existing routing policy from a connection, specified by its connection ID.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| connection-id | ID of the connection from which routing policy is being detached | Required |
| routing-policy-v4 | ID of the routing policy to detach from the BGP IPv4 session | |
| routing-policy-v6 | ID of the routing policy to detach from the BGP IPv6 session | |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw |
Disable route propagation
Prevent any prefixes from being announced in the BGP session. Traffic will not be able to flow over the VPN Gateway until route propagation is re-enabled.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| connection-id | ID of the connection on which to disable route propagation | Required |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw |
Enable route propagation
Enable all allowed prefixes (defined in a routing policy) to be announced in the BGP session. This allows traffic to flow between the attached VPC and the on-premises infrastructure along the announced routes. Note that by default, even when route propagation is enabled, all routes are blocked. It is essential to attach a routing policy to define the ranges of routes to announce.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| connection-id | ID of the connection on which to enable route propagation | Required |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw |
Get a connection
Get a connection for the given connection ID. The response object includes information about the connection's various configuration details.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| connection-id | ID of the requested connection | Required |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw |
List connections
List all your connections. A number of filters are available, including Project ID, name, tags and status.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| order-by | Order in which to return results | One of: created_at_asc, created_at_desc, name_asc, name_desc, status_asc, status_desc |
| project-id | Project ID to filter for | |
| name | Connection name to filter for | |
| tags.{index} | Tags to filter for | |
| statuses.{index} | Connection statuses to filter for | One of: unknown_status, active, limited_connectivity, down, locked |
| is-ipv6 | Filter connections with IP version of IPSec tunnel | |
| routing-policy-ids.{index} | Filter for connections using these routing policies | |
| route-propagation-enabled | Filter for connections with route propagation enabled | |
| vpn-gateway-ids.{index} | Filter for connections attached to these VPN gateways | |
| customer-gateway-ids.{index} | Filter for connections attached to these customer gateways | |
| organization-id | Organization ID to filter for | |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw, all |
Renew pre-shared key
Renew pre-shared key for a given connection.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| connection-id | ID of the connection to renew the PSK | Required |
| generate-revision | Generate a new revision or update to the latest existing one | Default: true |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw |
Set a new routing policy
Set a new routing policy on a connection, overriding the existing one if present, specified by its connection ID.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| connection-id | ID of the connection whose routing policy is being updated | Required |
| routing-policy-v4 | ID of the routing policy to set for the BGP IPv4 session | |
| routing-policy-v6 | ID of the routing policy to set for the BGP IPv6 session | |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw |
Update a connection
Update an existing connection, specified by its connection ID.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| connection-id | ID of the connection to update | Required |
| name | Name of the connection | |
| tags.{index} | List of tags to apply to the connection | |
| initiation-policy | Who initiates the IPsec tunnel | One of: unknown_initiation_policy, vpn_gateway, customer_gateway |
| ikev2-ciphers.{index}.encryption | One of: unknown_encryption, aes128, aes192, aes256, aes128gcm, aes192gcm, aes256gcm, aes128ccm, aes256ccm, chacha20poly1305 | |
| ikev2-ciphers.{index}.integrity | One of: unknown_integrity, sha256, sha384, sha512 | |
| ikev2-ciphers.{index}.dh-group | One of: unknown_dhgroup, modp2048, modp3072, modp4096, ecp256, ecp384, ecp521, curve25519 | |
| esp-ciphers.{index}.encryption | One of: unknown_encryption, aes128, aes192, aes256, aes128gcm, aes192gcm, aes256gcm, aes128ccm, aes256ccm, chacha20poly1305 | |
| esp-ciphers.{index}.integrity | One of: unknown_integrity, sha256, sha384, sha512 | |
| esp-ciphers.{index}.dh-group | One of: unknown_dhgroup, modp2048, modp3072, modp4096, ecp256, ecp384, ecp521, curve25519 | |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw |
A customer gateway represents a Scaleway client's device that communicates with a VPN gateway.
A customer gateway represents a Scaleway client's device that communicates with a VPN gateway.
Create a customer gateway
Create a customer gateway.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| project-id | Project ID to use. If none is passed the default project ID will be used | |
| name | Name of the customer gateway | Required |
| tags.{index} | List of tags to apply to the customer gateway | |
| ipv4-public | Public IPv4 address of the customer gateway | |
| ipv6-public | Public IPv6 address of the customer gateway | |
| asn | AS Number of the customer gateway | Required |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw |
Delete a customer gateway
Delete an existing customer gateway, specified by its customer gateway ID.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| gateway-id | ID of the customer gateway to delete | Required |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw |
Get a customer gateway
Get a customer gateway for the given customer gateway ID.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| gateway-id | ID of the requested customer gateway | Required |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw |
List customer gateways
List all your customer gateways. A number of filters are available, including Project ID, name, and tags.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| order-by | Order in which to return results | One of: created_at_asc, created_at_desc, name_asc, name_desc |
| project-id | Project ID to filter for | |
| name | Customer gateway name to filter for | |
| tags.{index} | Tags to filter for | |
| organization-id | Organization ID to filter for | |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw, all |
Update a customer gateway
Update an existing customer gateway, specified by its customer gateway ID. You can update its name, tags, public IPv4 & IPv6 address and AS Number.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| gateway-id | ID of the customer gateway to update | Required |
| name | Name of the customer gateway | |
| tags.{index} | List of tags to apply to the customer gateway | |
| ipv4-public | Public IPv4 address of the customer gateway | |
| ipv6-public | Public IPv6 address of the customer gateway | |
| asn | AS Number of the customer gateway | |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw |
By default, all routes across the Site-to-Site VPN (between VPN gateway and customer gateway) are blocked. Routing policies allow you to set filters to define the IP prefixes to allow.
By default, all routes across the Site-to-Site VPN (between VPN gateway and customer gateway) are blocked. Routing policies allow you to set filters to define the IP prefixes to allow.
Create a routing policy
Create a routing policy. Routing policies allow you to set IP prefix filters to define the incoming route announcements to accept from the customer gateway, and the outgoing routes to announce to the customer gateway.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| project-id | Project ID to use. If none is passed the default project ID will be used | |
| name | Name of the routing policy | Required |
| tags.{index} | List of tags to apply to the routing policy | |
| is-ipv6 | IP prefixes version of the routing policy | |
| prefix-filter-in.{index} | IP prefixes to accept from the peer (ranges of route announcements to accept) | |
| prefix-filter-out.{index} | IP prefix filters to advertise to the peer (ranges of routes to advertise) | |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw |
Delete a routing policy
Delete an existing routing policy, specified by its routing policy ID.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| routing-policy-id | ID of the routing policy to delete | Required |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw |
Get routing policy
Get a routing policy for the given routing policy ID. The response object gives information including the policy's name, tags and prefix filters.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| routing-policy-id | ID of the routing policy to get | Required |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw |
List routing policies
List all routing policies in a given region. A routing policy can be attached to one or multiple connections (S2S VPN connections).
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| order-by | Order in which to return results | One of: created_at_asc, created_at_desc, name_asc, name_desc |
| project-id | Project ID to filter for | |
| name | Routing policy name to filter for | |
| tags.{index} | Tags to filter for | |
| ipv6 | Filter for the routing policies based on IP prefixes version | |
| organization-id | Organization ID to filter for | |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw, all |
Update a routing policy
Update an existing routing policy, specified by its routing policy ID. Its name, tags and incoming/outgoing prefix filters can be updated.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| routing-policy-id | ID of the routing policy to update | Required |
| name | Name of the routing policy | |
| tags.{index} | List of tags to apply to the routing policy | |
| prefix-filter-in.{index} | IP prefixes to accept from the peer (ranges of route announcements to accept) | |
| prefix-filter-out.{index} | IP prefix filters for routes to advertise to the peer (ranges of routes to advertise) | |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw |
A VPN gateway is an IPsec peer managed by Scaleway. It can support multiple connections to customer gateways.
A VPN gateway is an IPsec peer managed by Scaleway. It can support multiple connections to customer gateways.
Create VPN gateway
Create VPN gateway.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| project-id | Project ID to use. If none is passed the default project ID will be used | |
| name | Name of the VPN gateway | Required |
| tags.{index} | List of tags to apply to the VPN gateway | |
| gateway-type | VPN gateway type (commercial offer type) | Required |
| public-config.ipam-ipv4-id | ||
| public-config.ipam-ipv6-id | ||
| private-network-id | ID of the Private Network to attach to the VPN gateway | Required |
| public-tunnel-config.single-ipv4-tunnel.ipam-id | ||
| public-tunnel-config.single-ipv6-tunnel.ipam-id | ||
| public-tunnel-config.dual-ipv4v6-tunnel.ipam-ipv4-id | ||
| public-tunnel-config.dual-ipv4v6-tunnel.ipam-ipv6-id | ||
| ipam-private-ipv4-id | ID of the IPAM private IPv4 address to attach to the VPN gateway | |
| ipam-private-ipv6-id | ID of the IPAM private IPv6 address to attach to the VPN gateway | |
| zone | Availability Zone where the VPN gateway should be provisioned. If no zone is specified, the VPN gateway will be automatically placed. | |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw |
Delete a VPN gateway
Delete an existing VPN gateway, specified by its VPN gateway ID.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| gateway-id | ID of the VPN gateway to delete | Required |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw |
Get a VPN gateway
Get a VPN gateway for the given VPN gateway ID.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| gateway-id | ID of the requested VPN gateway | Required |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw |
List VPN gateways
List all your VPN gateways. A number of filters are available, including Project ID, name, tags and status.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| order-by | Order in which to return results | One of: created_at_asc, created_at_desc, name_asc, name_desc, type_asc, type_desc, status_asc, status_desc |
| project-id | Project ID to filter for | |
| name | VPN gateway name to filter for | |
| tags.{index} | Tags to filter for | |
| statuses.{index} | VPN gateway statuses to filter for | One of: unknown_status, configuring, failed, provisioning, active, deprovisioning, locked |
| gateway-types.{index} | Filter for VPN gateways of these types | |
| private-network-ids.{index} | Filter for VPN gateways attached to these private networks | |
| organization-id | Organization ID to filter for | |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw, all |
Update a VPN gateway
Update an existing VPN gateway, specified by its VPN gateway ID. Only its name and tags can be updated.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| gateway-id | ID of the VPN gateway to update | Required |
| name | Name of the VPN gateway | |
| tags.{index} | List of tags to apply to the VPN Gateway | |
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw |
VPN gateways come in various shapes, sizes and prices, which are described by VPN gateway types. They represent the different commercial offer types for VPN gateways available at Scaleway.
VPN gateways come in various shapes, sizes and prices, which are described by VPN gateway types. They represent the different commercial offer types for VPN gateways available at Scaleway.
List VPN gateway types
List the different VPN gateway commercial offer types available at Scaleway. The response is an array of objects describing the name and technical details of each available VPN gateway type.
Usage:
Code
Arguments:
| Name | Description | Argument Specifications |
|---|---|---|
| region | Region to target. If none is passed will use default region from the config | Default: fr-parOne of: fr-par, it-mil, nl-ams, pl-waw, all |