# Update IPSec Tunnel - UpdateCETunnel

## Overview

Update IPSec Tunnel






## Definition

### Public Parameters

| Parameter Name | Type | Description Information | Required |
|:---|:---|:---|:---|
| **Action**     | string  | Corresponding API command name, the current API is `UpdateCETunnel`.                      | **Yes** |
| **PublicKey**  | string  | The user's public key can be obtained from [Console](https://console.zosoc.com/uaccount/api_manage)                                             | **Yes** |
| **Signature**  | string  | User signature generated based on public key and API command, see [Signature Algorithm](/docs/api/summary/signature.md)  | **Yes** |

### Request Parameters

| Parameter Name | Type | Description Information | Required |
|:---|:---|:---|:---|
| **Region** | string | Region. See [Region and Zone List](/docs/api/summary/regionlist) |No|
| **Zone** | string | Zone. See [Region and Zone List](/docs/api/summary/regionlist) |No|
| **ProjectId** | string | Project ID. Leave it blank for the default project. Sub-accounts must fill in. Please refer to the [GetProjectList API](/docs/api/summary/get_project_list) |No|
| **VPNTunnelId** | string | VPN tunnel ID |**Yes**|
| **IKEConf.PreSharedKey** | string | IKE preshared key |**Yes**|
| **IKEConf.Version** | string | IKE version, take values: "ike v1", "ike v2" |**Yes**|
| **IKEConf.ExchangeMode** | string | IKE negotiation mode, main mode/aggressive mode. This parameter is not used in IKE V2. |**Yes**|
| **IKEConf.EncryptionAlgorithm** | string | IKE encryption algorithm, with possible values: "aes128", "aes192", "aes256", "aes512", "3des". |**Yes**|
| **IKEConf.AuthenticationAlgorithm** | string | IKE 认证算法，取值："md5", "sha1", "sha2-256" |**Yes**|
| **IKEConf.DhGroup** | string | DH group: Specifies the DH group used when exchanging keys with IKE. Values: "1", "2", "5", "14", "15", "16" |**Yes**|
| **IKEConf.LocalId** | string | Local identifier, with values: "auto" or "<ip-address>". |**Yes**|
| **IKEConf.RemoteId** | string | Remote identifier, with values: "auto" or "<ip-address>". |**Yes**|
| **IKEConf.SALifeTime** | string | IKE SA lifetime (in sec). Value range: 600-604800 |**Yes**|
| **IPSecConf.CENetwork.N** | string | The CIDR block on the data center side. This CIDR block is used in Phase 2 negotiations. |**Yes**|
| **IPSecConf.Protocol** | string | IPSec security protocol, values: "esp", "ah". |**Yes**|
| **IPSecConf.EncryptionAlgorithm** | string | the encryption algorithm that is used in Phase 2 negotiations. Valid values: aes, aes192, aes256, aes512, and 3des.（This value should be left blank when the security protocol is AH.） |**Yes**|
| **IPSecConf.AuthenticationAlgorithm** | string | the authentication algorithm that is used in Phase 2 negotiations. Valid values: md5, sha1, sha2-256. |**Yes**|
| **IPSecConf.PFSDhGroup** | string | he Diffie-Hellman key exchange algorithm used in the second phase negotiation. Valid values:disabled、1、2、5、14、15、16. |**Yes**|
| **IPSecConf.SALifeTime** | string | the SA lifetime determined by Phase 2 negotiations. Unit: seconds. Valid values: 0 to 604800. |**Yes**|
| **IPSecConf.SALifetimeBytes** | string | The lifespan of the SA negotiated in the second phase. Unit: bytes (KB). Value range: 8000 – 20000000, default is the SALifeTime. |No|
| **CloseAction** | string | Actions after IPSec is disabled, enumerated values: restart, trap, none |No|
| **DPDConf.Enabled** | string | Enables/disables DPD (Peer Survival Detection). Values: 0 (Off), 1 (On) |No|
| **DPDConf.Action** | string | The action after a DPD timeout is effective when Enable is set to 1 (enabled). Possible values ​​are clear (disconnect), restart (retry), and trap (traffic-triggered). |No|
| **DPDConf.Delay** | string | DPD detection interval. Effective when dpdEnable is 1 (enabled). Unit is seconds, default is 10. |No|
| **DPDConf.Timeout** | string | DPD timeout. This is the time required to confirm the non-existence of the peer. Effective when dpdEnable is 1 (enabled). Unit is seconds. Value range is 30-60 (IKEv2 default is 0). |No|
| **BGPConf.TunnelCidr** | string | The CIDR block of the IPsec tunnel. The CIDR block must fall into 169.254.0.0/16 and the mask of the CIDR block must be 30 bits in length |No|
| **BGPConf.LocalAsn** | string | The ASN on the UCloud side. |No|
| **BGPConf.PeerAsn** | string | Peer BGP ASN number。 |No|
| **BGPConf.LocalIp** | string | The BGP address on the UCloud side |No|
| **BGPConf.PeerIp** | string | The BGP address on the CE side |No|

### Response Field

| Field Name | Type | Description Information | Required |
|:---|:---|:---|:---|
| **RetCode** | int | Return status code. If it is 0, it means successful return. If it is not 0, it means failure. |**Yes**|
| **Action** | string | Operation command name. |**Yes**|
| **Message** | string | Returns an error message, providing detailed description when `RetCode` is non-zero. |No|




## Example

### Request Example
    
```
https://api.zosoc.com/?Action=UpdateCETunnel
&Region=cn-zj
&Zone=cn-zj-01
&ProjectId=FMbiUzZs
&VPNTunnelId=dSbEYQFf
&IKEConf=orNmZLvc
&IPSecConf=sAStYCJH
&CloseAction=ioZxlfKH
&BGPConf=ZYDIPESM
&Mode=Nqrjdgyq
&DPDConf=luczSaPu
&IKEConf.Version=diLvEWLr
&IKEConf.ExchangeMode=DXogsrUv
&IKEConf.EncryptionAlgorithm=dxznsFHs
&IKEConf.AuthenticationAlgorithm=avwzsIdv
&IKEConf.DhGroup=GSSTqIxd
&IKEConf.LocalId=dwEGDCJE
&IKEConf.RemoteId=wvRVnWov
&IKEConf.SALifeTime=WJReGHpG
&IPSecConf.CENetwork.N=sXwWHqxV
&IPSecConf.EncryptionAlgorithm=pEQrytMC
&IPSecConf.AuthenticationAlgorithm=owvNXFgv
&IPSecConf.PFSDhGroup=JIWgmZyP
&IPSecConf.SALifeTime=msAnFFGt
&IPSecConf.SALifetimeBytes=TdQZZGJm
&DPDConf.Action=kbZIrpEg
&DPDConf.Delay=MyeUCMAV
&DPDConf.Timeout=EqhvCysu
&BGPConf.LocalAsn=uwTMpspL
&BGPConf.PeerAsn=taMnpTjz
&BGPConf.LocalIp=KYXTeUfW
&BGPConf.PeerIp=cRiUBzyF
```

### Response Example
    
```json
{
  "Action": "UpdateCETunnelResponse",
  "Message": "fqcBBpSp",
  "RetCode": 0
}
```