Chapter 77. vpn

<name>

Name for the endpoint group

-h, --help

Show this help message and exit

--description <description>

Description for the endpoint group

--type TYPE

Type of endpoints in group (e.g. subnet, cidr)

--value ENDPOINTS

Endpoint(s) for the group. must all be of the same type. (--value) option can be repeated

--project <project>

Owner’s project (name or id)

--project-domain <project-domain>

Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

-f {json,shell,table,value,yaml}, --format {json,shell,table,value,yaml}

the output format, defaults to table

-c COLUMN, --column COLUMN

specify the column(s) to include, can be repeated

--max-width <integer>

Maximum display width, <1 to disable. You can also use the CLIFF_MAX_TERM_WIDTH environment variable, but the parameter takes precedence.

--fit-width

Fit the table to the display width. implied if --max- width greater than 0. Set the environment variable CLIFF_FIT_WIDTH=1 to always enable

--print-empty

Print empty table if there is no data to show.

--noindent

Whether to disable indenting the json

--prefix PREFIX

Add a prefix to all variable names

<endpoint-group>

Endpoint group(s) to delete (name or id)

-h, --help

Show this help message and exit

-h, --help

Show this help message and exit

--long

List additional fields in output

-f {csv,json,table,value,yaml}, --format {csv,json,table,value,yaml}

the output format, defaults to table

-c COLUMN, --column COLUMN

specify the column(s) to include, can be repeated

--sort-column SORT_COLUMN

specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--max-width <integer>

Maximum display width, <1 to disable. You can also use the CLIFF_MAX_TERM_WIDTH environment variable, but the parameter takes precedence.

--fit-width

Fit the table to the display width. implied if --max- width greater than 0. Set the environment variable CLIFF_FIT_WIDTH=1 to always enable

--print-empty

Print empty table if there is no data to show.

--noindent

Whether to disable indenting the json

--quote {all,minimal,none,nonnumeric}

when to include quotes, defaults to nonnumeric

<endpoint-group>

Endpoint group to set (name or id)

-h, --help

Show this help message and exit

--description <description>

Description for the endpoint group

--name <name>

Set a name for the endpoint group

<endpoint-group>

Endpoint group to display (name or id)

-h, --help

Show this help message and exit

-f {json,shell,table,value,yaml}, --format {json,shell,table,value,yaml}

the output format, defaults to table

-c COLUMN, --column COLUMN

specify the column(s) to include, can be repeated

--max-width <integer>

Maximum display width, <1 to disable. You can also use the CLIFF_MAX_TERM_WIDTH environment variable, but the parameter takes precedence.

--fit-width

Fit the table to the display width. implied if --max- width greater than 0. Set the environment variable CLIFF_FIT_WIDTH=1 to always enable

--print-empty

Print empty table if there is no data to show.

--noindent

Whether to disable indenting the json

--prefix PREFIX

Add a prefix to all variable names

<name>

Name of the ike policy

-h, --help

Show this help message and exit

--description <description>

Description of the IKE policy

--auth-algorithm {sha1,sha256,sha384,sha512}

Authentication algorithm

--encryption-algorithm {aes-128,3des,aes-192,aes-256}

Encryption algorithm

--phase1-negotiation-mode {main}

IKE Phase1 negotiation mode

--ike-version {v1,v2}

IKE version for the policy

--pfs {group5,group2,group14}

Perfect Forward Secrecy

--lifetime units=UNITS,value=VALUE

IKE lifetime attributes. 'units'-seconds, default:seconds. 'value'-non negative integer, default:3600.

--project <project>

Owner’s project (name or id)

--project-domain <project-domain>

Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

-f {json,shell,table,value,yaml}, --format {json,shell,table,value,yaml}

the output format, defaults to table

-c COLUMN, --column COLUMN

specify the column(s) to include, can be repeated

--max-width <integer>

Maximum display width, <1 to disable. You can also use the CLIFF_MAX_TERM_WIDTH environment variable, but the parameter takes precedence.

--fit-width

Fit the table to the display width. implied if --max- width greater than 0. Set the environment variable CLIFF_FIT_WIDTH=1 to always enable

--print-empty

Print empty table if there is no data to show.

--noindent

Whether to disable indenting the json

--prefix PREFIX

Add a prefix to all variable names

<ike-policy>

Ike policy to delete (name or id)

-h, --help

Show this help message and exit

-h, --help

Show this help message and exit

--long

List additional fields in output

-f {csv,json,table,value,yaml}, --format {csv,json,table,value,yaml}

the output format, defaults to table

-c COLUMN, --column COLUMN

specify the column(s) to include, can be repeated

--sort-column SORT_COLUMN

specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--max-width <integer>

Maximum display width, <1 to disable. You can also use the CLIFF_MAX_TERM_WIDTH environment variable, but the parameter takes precedence.

--fit-width

Fit the table to the display width. implied if --max- width greater than 0. Set the environment variable CLIFF_FIT_WIDTH=1 to always enable

--print-empty

Print empty table if there is no data to show.

--noindent

Whether to disable indenting the json

--quote {all,minimal,none,nonnumeric}

when to include quotes, defaults to nonnumeric

<ike-policy>

Ike policy to set (name or id)

-h, --help

Show this help message and exit

--description <description>

Description of the IKE policy

--auth-algorithm {sha1,sha256,sha384,sha512}

Authentication algorithm

--encryption-algorithm {aes-128,3des,aes-192,aes-256}

Encryption algorithm

--phase1-negotiation-mode {main}

IKE Phase1 negotiation mode

--ike-version {v1,v2}

IKE version for the policy

--pfs {group5,group2,group14}

Perfect Forward Secrecy

--lifetime units=UNITS,value=VALUE

IKE lifetime attributes. 'units'-seconds, default:seconds. 'value'-non negative integer, default:3600.

--name <name>

Name of the ike policy

<ike-policy>

Ike policy to display (name or id)

-h, --help

Show this help message and exit

-f {json,shell,table,value,yaml}, --format {json,shell,table,value,yaml}

the output format, defaults to table

-c COLUMN, --column COLUMN

specify the column(s) to include, can be repeated

--max-width <integer>

Maximum display width, <1 to disable. You can also use the CLIFF_MAX_TERM_WIDTH environment variable, but the parameter takes precedence.

--fit-width

Fit the table to the display width. implied if --max- width greater than 0. Set the environment variable CLIFF_FIT_WIDTH=1 to always enable

--print-empty

Print empty table if there is no data to show.

--noindent

Whether to disable indenting the json

--prefix PREFIX

Add a prefix to all variable names

<name>

Name of the ipsec policy

-h, --help

Show this help message and exit

--description <description>

Description of the IPsec policy

--auth-algorithm {sha1,sha256,sha384,sha512}

Authentication algorithm for IPsec policy

--encapsulation-mode {tunnel,transport}

Encapsulation mode for IPsec policy

--encryption-algorithm {3des,aes-128,aes-192,aes-256}

Encryption algorithm for IPsec policy

--lifetime units=UNITS,value=VALUE

IPsec lifetime attributes. 'units'-seconds, default:seconds. 'value'-non negative integer, default:3600.

--pfs {group2,group5,group14}

Perfect Forward Secrecy for IPsec policy

--transform-protocol {esp,ah,ah-esp}

Transform protocol for IPsec policy

--project <project>

Owner’s project (name or id)

--project-domain <project-domain>

Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

-f {json,shell,table,value,yaml}, --format {json,shell,table,value,yaml}

the output format, defaults to table

-c COLUMN, --column COLUMN

specify the column(s) to include, can be repeated

--max-width <integer>

Maximum display width, <1 to disable. You can also use the CLIFF_MAX_TERM_WIDTH environment variable, but the parameter takes precedence.

--fit-width

Fit the table to the display width. implied if --max- width greater than 0. Set the environment variable CLIFF_FIT_WIDTH=1 to always enable

--print-empty

Print empty table if there is no data to show.

--noindent

Whether to disable indenting the json

--prefix PREFIX

Add a prefix to all variable names

<ipsec-policy>

Ipsec policy to delete (name or id)

-h, --help

Show this help message and exit

-h, --help

Show this help message and exit

--long

List additional fields in output

-f {csv,json,table,value,yaml}, --format {csv,json,table,value,yaml}

the output format, defaults to table

-c COLUMN, --column COLUMN

specify the column(s) to include, can be repeated

--sort-column SORT_COLUMN

specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--max-width <integer>

Maximum display width, <1 to disable. You can also use the CLIFF_MAX_TERM_WIDTH environment variable, but the parameter takes precedence.

--fit-width

Fit the table to the display width. implied if --max- width greater than 0. Set the environment variable CLIFF_FIT_WIDTH=1 to always enable

--print-empty

Print empty table if there is no data to show.

--noindent

Whether to disable indenting the json

--quote {all,minimal,none,nonnumeric}

when to include quotes, defaults to nonnumeric

<ipsec-policy>

Ipsec policy to set (name or id)

-h, --help

Show this help message and exit

--description <description>

Description of the IPsec policy

--auth-algorithm {sha1,sha256,sha384,sha512}

Authentication algorithm for IPsec policy

--encapsulation-mode {tunnel,transport}

Encapsulation mode for IPsec policy

--encryption-algorithm {3des,aes-128,aes-192,aes-256}

Encryption algorithm for IPsec policy

--lifetime units=UNITS,value=VALUE

IPsec lifetime attributes. 'units'-seconds, default:seconds. 'value'-non negative integer, default:3600.

--pfs {group2,group5,group14}

Perfect Forward Secrecy for IPsec policy

--transform-protocol {esp,ah,ah-esp}

Transform protocol for IPsec policy

--name <name>

Name of the ipsec policy

<ipsec-policy>

Ipsec policy to display (name or id)

-h, --help

Show this help message and exit

-f {json,shell,table,value,yaml}, --format {json,shell,table,value,yaml}

the output format, defaults to table

-c COLUMN, --column COLUMN

specify the column(s) to include, can be repeated

--max-width <integer>

Maximum display width, <1 to disable. You can also use the CLIFF_MAX_TERM_WIDTH environment variable, but the parameter takes precedence.

--fit-width

Fit the table to the display width. implied if --max- width greater than 0. Set the environment variable CLIFF_FIT_WIDTH=1 to always enable

--print-empty

Print empty table if there is no data to show.

--noindent

Whether to disable indenting the json

--prefix PREFIX

Add a prefix to all variable names

<name>

Set friendly name for the connection

-h, --help

Show this help message and exit

--description <description>

Description for the connection

--dpd action=ACTION,interval=INTERVAL,timeout=TIMEOUT

Ipsec connection Dead Peer Detection attributes. 'action'-hold,clear,disabled,restart,restart-by-peer. 'interval' and 'timeout' are non negative integers. 'interval' should be less than 'timeout' value. 'action', default:hold 'interval', default:30, 'timeout', default:120.

--mtu MTU

Mtu size for the connection

--initiator {bi-directional,response-only}

Initiator state

--peer-cidr PEER_CIDRS

Remote subnet(s) in CIDR format. Cannot be specified when using endpoint groups. Only applicable, if subnet provided for VPN service.

--local-endpoint-group LOCAL_ENDPOINT_GROUP

Local endpoint group (name or ID) with subnet(s) for IPsec connection

--peer-endpoint-group PEER_ENDPOINT_GROUP

Peer endpoint group (name or ID) with CIDR(s) for IPSec connection

--enable

Enable ipsec site connection

--disable

Disable ipsec site connection

--local-id LOCAL_ID

An id to be used instead of the external ip address for a virtual router

--peer-id PEER_ID

Peer router identity for authentication. can be IPv4/IPv6 address, e-mail address, key id, or FQDN

--peer-address PEER_ADDRESS

Peer gateway public IPv4/IPv6 address or FQDN

--psk PSK

Pre-shared key string.

--vpnservice VPNSERVICE

VPN service instance associated with this connection (name or ID)

--ikepolicy IKEPOLICY

IKE policy associated with this connection (name or ID)

--ipsecpolicy IPSECPOLICY

IPsec policy associated with this connection (name or ID)

--project <project>

Owner’s project (name or id)

--project-domain <project-domain>

Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

-f {json,shell,table,value,yaml}, --format {json,shell,table,value,yaml}

the output format, defaults to table

-c COLUMN, --column COLUMN

specify the column(s) to include, can be repeated

--max-width <integer>

Maximum display width, <1 to disable. You can also use the CLIFF_MAX_TERM_WIDTH environment variable, but the parameter takes precedence.

--fit-width

Fit the table to the display width. implied if --max- width greater than 0. Set the environment variable CLIFF_FIT_WIDTH=1 to always enable

--print-empty

Print empty table if there is no data to show.

--noindent

Whether to disable indenting the json

--prefix PREFIX

Add a prefix to all variable names

<ipsec-site-connection>

IPsec site connection to delete (name or ID)

-h, --help

Show this help message and exit

-h, --help

Show this help message and exit

--long

List additional fields in output

-f {csv,json,table,value,yaml}, --format {csv,json,table,value,yaml}

the output format, defaults to table

-c COLUMN, --column COLUMN

specify the column(s) to include, can be repeated

--sort-column SORT_COLUMN

specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--max-width <integer>

Maximum display width, <1 to disable. You can also use the CLIFF_MAX_TERM_WIDTH environment variable, but the parameter takes precedence.

--fit-width

Fit the table to the display width. implied if --max- width greater than 0. Set the environment variable CLIFF_FIT_WIDTH=1 to always enable

--print-empty

Print empty table if there is no data to show.

--noindent

Whether to disable indenting the json

--quote {all,minimal,none,nonnumeric}

when to include quotes, defaults to nonnumeric

<ipsec-site-connection>

IPsec site connection to set (name or ID)

-h, --help

Show this help message and exit

--description <description>

Description for the connection

--dpd action=ACTION,interval=INTERVAL,timeout=TIMEOUT

Ipsec connection Dead Peer Detection attributes. 'action'-hold,clear,disabled,restart,restart-by-peer. 'interval' and 'timeout' are non negative integers. 'interval' should be less than 'timeout' value. 'action', default:hold 'interval', default:30, 'timeout', default:120.

--mtu MTU

Mtu size for the connection

--initiator {bi-directional,response-only}

Initiator state

--peer-cidr PEER_CIDRS

Remote subnet(s) in CIDR format. Cannot be specified when using endpoint groups. Only applicable, if subnet provided for VPN service.

--local-endpoint-group LOCAL_ENDPOINT_GROUP

Local endpoint group (name or ID) with subnet(s) for IPsec connection

--peer-endpoint-group PEER_ENDPOINT_GROUP

Peer endpoint group (name or ID) with CIDR(s) for IPSec connection

--enable

Enable ipsec site connection

--disable

Disable ipsec site connection

--local-id LOCAL_ID

An id to be used instead of the external ip address for a virtual router

--peer-id PEER_ID

Peer router identity for authentication. can be IPv4/IPv6 address, e-mail address, key id, or FQDN

--peer-address PEER_ADDRESS

Peer gateway public IPv4/IPv6 address or FQDN

--name <name>

Set friendly name for the connection

<ipsec-site-connection>

IPsec site connection to display (name or ID)

-h, --help

Show this help message and exit

-f {json,shell,table,value,yaml}, --format {json,shell,table,value,yaml}

the output format, defaults to table

-c COLUMN, --column COLUMN

specify the column(s) to include, can be repeated

--max-width <integer>

Maximum display width, <1 to disable. You can also use the CLIFF_MAX_TERM_WIDTH environment variable, but the parameter takes precedence.

--fit-width

Fit the table to the display width. implied if --max- width greater than 0. Set the environment variable CLIFF_FIT_WIDTH=1 to always enable

--print-empty

Print empty table if there is no data to show.

--noindent

Whether to disable indenting the json

--prefix PREFIX

Add a prefix to all variable names

<name>

Name for the vpn service

-h, --help

Show this help message and exit

--description <description>

Description for the VPN service

--subnet <subnet>

Local private subnet (name or id)

--flavor <flavor>

Flavor for the vpn service (name or id)

--enable

Enable vpn service

--disable

Disable vpn service

--router ROUTER

Router for the vpn service (name or id)

--project <project>

Owner’s project (name or id)

--project-domain <project-domain>

Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

-f {json,shell,table,value,yaml}, --format {json,shell,table,value,yaml}

the output format, defaults to table

-c COLUMN, --column COLUMN

specify the column(s) to include, can be repeated

--max-width <integer>

Maximum display width, <1 to disable. You can also use the CLIFF_MAX_TERM_WIDTH environment variable, but the parameter takes precedence.

--fit-width

Fit the table to the display width. implied if --max- width greater than 0. Set the environment variable CLIFF_FIT_WIDTH=1 to always enable

--print-empty

Print empty table if there is no data to show.

--noindent

Whether to disable indenting the json

--prefix PREFIX

Add a prefix to all variable names

<vpn-service>

Vpn service to delete (name or id)

-h, --help

Show this help message and exit

-h, --help

Show this help message and exit

--long

List additional fields in output

-f {csv,json,table,value,yaml}, --format {csv,json,table,value,yaml}

the output format, defaults to table

-c COLUMN, --column COLUMN

specify the column(s) to include, can be repeated

--sort-column SORT_COLUMN

specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--max-width <integer>

Maximum display width, <1 to disable. You can also use the CLIFF_MAX_TERM_WIDTH environment variable, but the parameter takes precedence.

--fit-width

Fit the table to the display width. implied if --max- width greater than 0. Set the environment variable CLIFF_FIT_WIDTH=1 to always enable

--print-empty

Print empty table if there is no data to show.

--noindent

Whether to disable indenting the json

--quote {all,minimal,none,nonnumeric}

when to include quotes, defaults to nonnumeric

<vpn-service>

Vpn service to modify (name or id)

-h, --help

Show this help message and exit

--description <description>

Description for the VPN service

--subnet <subnet>

Local private subnet (name or id)

--flavor <flavor>

Flavor for the vpn service (name or id)

--enable

Enable vpn service

--disable

Disable vpn service

--name <name>

Name for the vpn service

<vpn-service>

Vpn service to display (name or id)

-h, --help

Show this help message and exit

-f {json,shell,table,value,yaml}, --format {json,shell,table,value,yaml}

the output format, defaults to table

-c COLUMN, --column COLUMN

specify the column(s) to include, can be repeated

--max-width <integer>

Maximum display width, <1 to disable. You can also use the CLIFF_MAX_TERM_WIDTH environment variable, but the parameter takes precedence.

--fit-width

Fit the table to the display width. implied if --max- width greater than 0. Set the environment variable CLIFF_FIT_WIDTH=1 to always enable

--print-empty

Print empty table if there is no data to show.

--noindent

Whether to disable indenting the json

--prefix PREFIX

Add a prefix to all variable names