Create an IPsec policy

security ipsec policy create

Parameters

Name	Type	In	Required	Description
return_records	boolean	query	False	The default is false. If set to true, the records are returned. Default value:

Name

Type

In

Required

Description

return_records

boolean

query

False

The default is false. If set to true, the records are returned.

Default value:

Request Body

Name	Type	Description
action	string	Action for the IPsec policy.
authentication_method	string	Authentication method for the IPsec policy.
certificate	certificate	Certificate for the IPsec policy.
enabled	boolean	Indicates whether or not the policy is enabled.
ipspace	ipspace	Applies to both SVM and cluster-scoped objects. Either the UUID or name may be supplied on input.
local_endpoint	local_endpoint	Local endpoint for the IPsec policy.
local_identity	string	Local Identity
name	string	IPsec policy name.
protocol	string	Lower layer protocol to be covered by the IPsec policy.
remote_endpoint	remote_endpoint	Remote endpoint for the IPsec policy.
remote_identity	string	Remote Identity
scope	string	Set to "svm" for interfaces owned by an SVM. Otherwise, set to "cluster".
secret_key	string	Pre-shared key for IKE negotiation.
svm	svm
uuid	string	Unique identifier of the IPsec policy.

Name

Type

Description

action

string

Action for the IPsec policy.

authentication_method

string

Authentication method for the IPsec policy.

certificate

Certificate for the IPsec policy.

enabled

boolean

Indicates whether or not the policy is enabled.

ipspace

Applies to both SVM and cluster-scoped objects. Either the UUID or name may be supplied on input.

local_endpoint

Local endpoint for the IPsec policy.

local_identity

string

Local Identity

name

string

IPsec policy name.

protocol

string

Lower layer protocol to be covered by the IPsec policy.

remote_endpoint

Remote endpoint for the IPsec policy.

remote_identity

string

Remote Identity

scope

string

Set to "svm" for interfaces owned by an SVM. Otherwise, set to "cluster".

secret_key

string

Pre-shared key for IKE negotiation.

svm

uuid

string

Unique identifier of the IPsec policy.

Example request

{
  "action": "string",
  "authentication_method": "string",
  "certificate": {
    "_links": {
      "self": {
        "href": "/api/resourcelink"
      }
    },
    "name": "cert1",
    "uuid": "1cd8a442-86d1-11e0-ae1c-123478563412"
  },
  "ipspace": {
    "_links": {
      "self": {
        "href": "/api/resourcelink"
      }
    },
    "name": "exchange",
    "uuid": "1cd8a442-86d1-11e0-ae1c-123478563412"
  },
  "local_endpoint": {
    "address": "10.10.10.7",
    "family": "string",
    "netmask": "24",
    "port": "23"
  },
  "local_identity": "string",
  "name": "string",
  "protocol": "17",
  "remote_endpoint": {
    "address": "10.10.10.7",
    "family": "string",
    "netmask": "24",
    "port": "23"
  },
  "remote_identity": "string",
  "scope": "string",
  "secret_key": "string",
  "svm": {
    "_links": {
      "self": {
        "href": "/api/resourcelink"
      }
    },
    "name": "svm1",
    "uuid": "02c9e252-41be-11e9-81d5-00a0986138f7"
  },
  "uuid": "1cd8a442-86d1-11e0-ae1c-123478563412"
}

Response

Status: 201, Created

Name	Type	Description
_links	_links
error	error
num_records	integer	Number of records
records	array[records]

Name

Type

Description

_links

error

num_records

integer

Number of records

records

array[records]

Example response

{
  "_links": {
    "next": {
      "href": "/api/resourcelink"
    },
    "self": {
      "href": "/api/resourcelink"
    }
  },
  "error": {
    "arguments": [
      {
        "code": "string",
        "message": "string"
      }
    ],
    "code": "4",
    "message": "entry doesn't exist",
    "target": "uuid"
  },
  "num_records": 1,
  "records": [
    {
      "action": "string",
      "authentication_method": "string",
      "certificate": {
        "_links": {
          "self": {
            "href": "/api/resourcelink"
          }
        },
        "name": "cert1",
        "uuid": "1cd8a442-86d1-11e0-ae1c-123478563412"
      },
      "ipspace": {
        "_links": {
          "self": {
            "href": "/api/resourcelink"
          }
        },
        "name": "exchange",
        "uuid": "1cd8a442-86d1-11e0-ae1c-123478563412"
      },
      "local_endpoint": {
        "address": "10.10.10.7",
        "family": "string",
        "netmask": "24",
        "port": "23"
      },
      "local_identity": "string",
      "name": "string",
      "protocol": "17",
      "remote_endpoint": {
        "address": "10.10.10.7",
        "family": "string",
        "netmask": "24",
        "port": "23"
      },
      "remote_identity": "string",
      "scope": "string",
      "secret_key": "string",
      "svm": {
        "_links": {
          "self": {
            "href": "/api/resourcelink"
          }
        },
        "name": "svm1",
        "uuid": "02c9e252-41be-11e9-81d5-00a0986138f7"
      },
      "uuid": "1cd8a442-86d1-11e0-ae1c-123478563412"
    }
  ]
}

Error

Status: Default

ONTAP Error Response Codes

Error Code	Description
66257099	Only one protocol can be specified.
66257100	Only one local port can be specified.
66257101	Only one remote port can be specified.
66257104	IPsec policy with same name already exists in this SVM.
66257107	The specified pre-shared key is not a valid hexadecimal string.
66257109	The specified pre-shared key is not a valid Base64 encoded binary string.
66257110	Failed to a create policy sequencing value.
66257111	The IPsec policy with action ESP TRANSPORT provides packet protection and requires a secret key for authentication.
66257112	The IPsec policy with the action specified does not provide packet protection and the authentication method provided for the policy will be ignored.
66257113	Only one local IP subnet can be specified.
66257114	Only one remote IP subnet can be specified.
66257115	Port ranges containing more than one port are not supported.
66257117	IPsec is not supported on the SVM specified in the policy, IPsec is supported on data SVMs only.
66257120	The subnet selector must be a host address (An IPv4 address with a 32-bit netmask or an IPv6 address with a 128-bit netmask).
66257121	The maximum limit of IPsec Policies has reached for the specified SVM.
66257125	The local_endpoint.address must be specified with local_endpoint.netmask.
66257126	The remote_endpoint.address must be specified with remote_endpoint.netmask.
66257132	Invalid value for port field. Value should be in range <1-65535>.
66257139	Certificate with the specified UUID was not found.
66257140	Only certificates with a client or server type are supported.

Name	Type	Description
error	error

Name

Type

Description

error

Example error

{
  "error": {
    "arguments": [
      {
        "code": "string",
        "message": "string"
      }
    ],
    "code": "4",
    "message": "entry doesn't exist",
    "target": "uuid"
  }
}

Definitions

See Definitions

href

Name	Type	Description
href	string

Name

Type

Description

href

string

_links

Name	Type	Description
self	href

Name

Type

Description

self

href

certificate

Certificate for the IPsec policy.

Name	Type	Description
_links	_links
name	string	Certificate name
uuid	string	Certificate UUID

Name

Type

Description

_links

name

string

Certificate name

uuid

string

Certificate UUID

ipspace

Applies to both SVM and cluster-scoped objects. Either the UUID or name may be supplied on input.

Name	Type	Description
_links	_links
name	string	IPspace name
uuid	string	IPspace UUID

Name

Type

Description

_links

name

string

IPspace name

uuid

string

IPspace UUID

local_endpoint

Local endpoint for the IPsec policy.

Name	Type	Description
address	string	IPv4 or IPv6 address
family	string	IPv4 or IPv6
netmask	string	Input as netmask length (16) or IPv4 mask (255.255.0.0). For IPv6, the default value is 64 with a valid range of 1 to 127. Output is always netmask length.
port	string	Application port to be covered by the IPsec policy

Name

Type

Description

address

string

IPv4 or IPv6 address

family

string

IPv4 or IPv6

netmask

string

Input as netmask length (16) or IPv4 mask (255.255.0.0). For IPv6, the default value is 64 with a valid range of 1 to 127. Output is always netmask length.

port

string

Application port to be covered by the IPsec policy

remote_endpoint

Remote endpoint for the IPsec policy.

Name	Type	Description
address	string	IPv4 or IPv6 address
family	string	IPv4 or IPv6
netmask	string	Input as netmask length (16) or IPv4 mask (255.255.0.0). For IPv6, the default value is 64 with a valid range of 1 to 127. Output is always netmask length.
port	string	Application port to be covered by the IPsec policy

Name

Type

Description

address

string

IPv4 or IPv6 address

family

string

IPv4 or IPv6

netmask

string

Input as netmask length (16) or IPv4 mask (255.255.0.0). For IPv6, the default value is 64 with a valid range of 1 to 127. Output is always netmask length.

port

string

Application port to be covered by the IPsec policy

svm

Name	Type	Description
_links	_links
name	string	The name of the SVM.
uuid	string	The unique identifier of the SVM.

Name

Type

Description

_links

name

string

The name of the SVM.

uuid

string

The unique identifier of the SVM.

ipsec_policy

IPsec policy object.

Name	Type	Description
action	string	Action for the IPsec policy.
authentication_method	string	Authentication method for the IPsec policy.
certificate	certificate	Certificate for the IPsec policy.
enabled	boolean	Indicates whether or not the policy is enabled.
ipspace	ipspace	Applies to both SVM and cluster-scoped objects. Either the UUID or name may be supplied on input.
local_endpoint	local_endpoint	Local endpoint for the IPsec policy.
local_identity	string	Local Identity
name	string	IPsec policy name.
protocol	string	Lower layer protocol to be covered by the IPsec policy.
remote_endpoint	remote_endpoint	Remote endpoint for the IPsec policy.
remote_identity	string	Remote Identity
scope	string	Set to "svm" for interfaces owned by an SVM. Otherwise, set to "cluster".
secret_key	string	Pre-shared key for IKE negotiation.
svm	svm
uuid	string	Unique identifier of the IPsec policy.

Name

Type

Description

action

string

Action for the IPsec policy.

authentication_method

string

Authentication method for the IPsec policy.

certificate

Certificate for the IPsec policy.

enabled

boolean

Indicates whether or not the policy is enabled.

ipspace

Applies to both SVM and cluster-scoped objects. Either the UUID or name may be supplied on input.

local_endpoint

Local endpoint for the IPsec policy.

local_identity

string

Local Identity

name

string

IPsec policy name.

protocol

string

Lower layer protocol to be covered by the IPsec policy.

remote_endpoint

Remote endpoint for the IPsec policy.

remote_identity

string

Remote Identity

scope

string

Set to "svm" for interfaces owned by an SVM. Otherwise, set to "cluster".

secret_key

string

Pre-shared key for IKE negotiation.

svm

uuid

string

Unique identifier of the IPsec policy.

_links

Name	Type	Description
next	href
self	href

Name

Type

Description

self

href

error_arguments

Name	Type	Description
code	string	Argument code
message	string	Message argument

Name

Type

Description

code

string

Argument code

message

string

Message argument

error

Name	Type	Description
arguments	array[error_arguments]	Message arguments
code	string	Error code
message	string	Error message
target	string	The target parameter that caused the error.

Name

Type

Description

arguments

array[error_arguments]

Message arguments

code

string

Error code

message

string

Error message

target

string

The target parameter that caused the error.

svm

SVM, applies only to SVM-scoped objects.

Name	Type	Description
_links	_links
name	string	The name of the SVM.
uuid	string	The unique identifier of the SVM.

Name

Type

Description

_links

name

string

The name of the SVM.

uuid

string

The unique identifier of the SVM.

records

IPsec policy object.

Name	Type	Description
action	string	Action for the IPsec policy.
authentication_method	string	Authentication method for the IPsec policy.
certificate	certificate	Certificate for the IPsec policy.
enabled	boolean	Indicates whether or not the policy is enabled.
ipspace	ipspace	Applies to both SVM and cluster-scoped objects. Either the UUID or name may be supplied on input.
local_endpoint	local_endpoint	Local endpoint for the IPsec policy.
local_identity	string	Local Identity
name	string	IPsec policy name.
protocol	string	Lower layer protocol to be covered by the IPsec policy.
remote_endpoint	remote_endpoint	Remote endpoint for the IPsec policy.
remote_identity	string	Remote Identity
scope	string	Set to "svm" for interfaces owned by an SVM. Otherwise, set to "cluster".
secret_key	string	Pre-shared key for IKE negotiation.
svm	svm	SVM, applies only to SVM-scoped objects.
uuid	string	Unique identifier of the IPsec policy.

Name

Type

Description

action

string

Action for the IPsec policy.

authentication_method

string

Authentication method for the IPsec policy.

certificate

Certificate for the IPsec policy.

enabled

boolean

Indicates whether or not the policy is enabled.

ipspace

Applies to both SVM and cluster-scoped objects. Either the UUID or name may be supplied on input.

local_endpoint

Local endpoint for the IPsec policy.

local_identity

string

Local Identity

name

string

IPsec policy name.

protocol

string

Lower layer protocol to be covered by the IPsec policy.

remote_endpoint

Remote endpoint for the IPsec policy.

remote_identity

string

Remote Identity

scope

string

Set to "svm" for interfaces owned by an SVM. Otherwise, set to "cluster".

secret_key

string

Pre-shared key for IKE negotiation.

svm

SVM, applies only to SVM-scoped objects.

uuid

string

Unique identifier of the IPsec policy.

Create an IPsec policy

Creating your file...

Related ONTAP commands

Parameters

Request Body

Response

Error

Definitions