Page History

...

SD-EWAN IPSec Restful API provides support to get/create/update/delete IPSec Site, Proposal.

IPSec Proposal

GET POST /cgi-bin/luci/sdewan/ipsec/v1/proposals

Lists all defined proposals

...

create a new proposal

Request:

• Request Parameters: same with PUT's response request

• Request Example: same with PUT's response example

Response

• Normal response codes: 200

Response Parameters

Name

In

Type

Description

proposalsbodyarraya dict of defined proposals

Response Example

{
    "proposals": [

        {

            "name": "proposal1",

            "encryption_algorithm": "aes128",

            "hash_algorithm": "sha256",

            "dh_group": "modp3072"

        }

    ]
}

...

• 201
• Error response codes: 400, 401

PUT /cgi-bin/luci/sdewan/ipsec/v1/proposals/{proposal-name}

update a proposal

Request:

• Request Parameters:

  Name	In	Type	Description
  proposal-name	path	string	proposal name
  encryption_algorithm	body	string	encryption algorithm
  hash_algorithm	body	string	hash algorithm
  dh_group	body	string	Diffie-Hellman group

  
  

• Request Example

  PUT /cgi-bin/luci/sdewan/ipsec/

...

• proposals/proposal1

  {

...

Get a proposal

Request: N/A

Request Parameters

...

Name

...

In

...

Type

...

Description

...

• "encryption_algorithm": "aes256",       "hash_algorithm": "sha256",       "dh_group": "modp4096" }

  
  

Response

• Normal response codes: 204
• Error response codes: 400, 401, 404

GET /cgi-bin/luci/sdewan/ipsec/v1/proposals

Lists all defined proposals

Request: N/A

...

Response

• Normal response codes: 200Error response code: 404

• Response Parameters

  Name	In	Type	Description

  name

  proposals

  body

  stringproposal nameencryption_algorithmbodystringencryption algorithmhash_algorithmbodystringhash algorithmdh_groupbodystringDiffie-Hellman group

  array

  a dict of defined proposals

  
  

• Response Example

  {     "proposals": [         {

  Response Example

  {

        

  "name": "proposal1",

       

  "encryption_algorithm": "aes128",

        

  "hash_algorithm": "sha256",

        

  "dh_group": "modp3072"         }

...

• ] }

  
  

GET /cgi-bin/luci/sdewan/ipsec/v1/proposals/{proposal-name}

Get a create a new proposal

Request: N/A

• Request Parameters: same with GET's response request

  Request Example: same with GET's response example

  Name	In	Type	Description
  proposal-name	path	string	proposal name

  
  

Response

• Normal response codes: 201200
• Error response codes: 400, 401

PUT /cgi-bin/luci/sdewan/ipsec/v1/proposals/{proposal-name}

update a proposal

Request:

• code: 404

• Response Parameters

  Request Parameters:

  Name

  Name

  In	Type	Description

  proposal-

  name

  path

  body	string	proposal name
  encryption_algorithm	body	string	encryption algorithm
  hash_algorithm	body	string	hash algorithm
  dh_group	body	string	Diffie-Hellman group

  
  

Normal response codes: 204
• Request

  Response ExamplePUT /cgi-bin/luci/sdewan/ipsec/proposals/proposal1

  {

        "encryption_algorithm

  "name": "

  aes256

  proposal1",       "encryption_algorithm": "aes128",       "hash_algorithm": "sha256",       "dh_group": "

  modp4096

  modp3072" }

Response

• Error response codes: 400, 401, 404

• 
  

DELETE /cgi-bin/luci/sdewan/ipsec/v1/proposals/{proposal-name}

...

• Normal response codes: 200
• Error response codes: 401, 404

IPSec Site

GET POST /cgi-bin/luci/sdewan/ipsec/v1/sitesLists all defined sites

create a new site

Request: N/A

• Request Parameters: same with PUT's response request

Response

• Normal response codes: 200201
• Error response codes: 400, 401

PUT /cgi-bin/luci/sdewan/ipsec/v1/sites/{site-name}

update a site

Request:

• Request Parameters:Response Parameters

  Name	In	Type	Description
  sitessite-name	bodypath	array	a list of defined sites	string	remote site name
  other params	body		Same with Get's response

  
  

• Request Example

  PUT /cgi-bin/luci/sdewan/ipsec/v1/sites/sites

  {

  Response Example

  {     "sites": [        {    "name": "site1",             "gateway": "10.1.0.1.2",            "authentication_methodname": "psksite1",                  "crypto_proposal": "proposal1",                  "connections": [                     {                "name": "connAsite_to_site"          ,                 "type": "tunnel"                          "local_subnet": "192.168.1.1/24",                         "remote_subnet": "192.168.0.1/24",                           "crypto_proposal": "proposal1"                     }            ]        }     ] } }

  
  

Response

• Normal response codes: 204
• Error response codes: 400, 401, 404

GET /cgi-bin/luci/sdewan/ipsec/v1/sites/{site-name}Get a site

Lists all defined sites

Request: N/A

Response

• Normal response codes: 200

• Response Request Parameters

  Name	In	Type	Description

  site-name

  sites

  path

  body

  stringremote site name

  array

  a list of defined sites

  
  

• Response Example

• Normal response codes: 200
• Error response code: 404

Response Parameters

Name

In

Type

Required

Description

namebody stringYSite namegatewaybodystringYThe corresponding responderpre_shared_keybodystringNOptional, only if using the PSK authentication modelocal_public_cert        bodystringNOptional, only if using the public key authentication mode. Public key used for auth.local_private_certbodystringNOptional, only if using the public key authentication mode. Private key used for auth.shared_cabodystringNOptional, only if using the public key authentication mode. CA informationauthentication_methodbodystringYEither 'psk' or 'pubkey' as the authentication method.local_identifier body  string NThe identifier for localhostremote_identifier body  string NThe identifier for remote counter partycrypto_proposal body  listYProposal names used for ike processforce_crypto_proposal body  boolean NThe flag on forcing the proposal or notconnectionsbody listYList of connectionArray 

connectionArray:

NameInTypeRequiredDescriptionnamebodystringYConnection nametype body string YType of connection. Either "tunnel" or "transport" mode body  string YMode used for connection. Either 'add', 'route' or 'start'local_subnet body string NDefines the local subnet. local_natbody string NDefines the local nat, if exists, replace the local_subnetlocal_sourceip body string NDefines the local source iplocal_updown body string NDefines the local iptable rules.local_firewall body string NFlag used to determine whether to enable the local firewall rules or notremote_subnet body string NDefines the subnet of the counter partyremote_sourceip body string NDefines the source ip of the counter partyremote_updown body string NDefines the iptable rules applied for the counter partyremote_firewallbodystring NFlag used to determine whether to enable the remote firewall rules or notcrypto_proposal body string NCrypto proposal used for ESP

Response Example

{

     "name": "site1",

     "gateway":"10.1.0.2",

     "crypto_proposal": "proposal1"

     "connections": [

      {

         "name": "site_to_site",

         "type": "tunnel",

         "local_subnet":

         "remote_subnet":

          "crypto_proposal": "proposal2"

      }

    ]

}

POST /cgi-bin/luci/sdewan/ipsec/v1/sites

create a new site

Request:

• Request Parameters: same with PUT's response request

Response

• Normal response codes: 201
• Error response codes: 400, 401

PUT /cgi-bin/luci/sdewan/ipsec/v1/sites/{site-name}

update a site

Request:

• {     "sites": [        {    "name": "site1",             "gateway":"10.0.1.2",             "authentication_method": "psk",             "crypto_proposal": "proposal1",             "connections": [               {                 "name": "connA"                 "type": "tunnel"                 "local_subnet": "192.168.1.1/24",                 "remote_subnet": "192.168.0.1/24",                 "crypto_proposal": "proposal1"               }            ]        }     ] }

  
  

GET /cgi-bin/luci/sdewan/ipsec/v1/sites/{site-name}

Get a site

Request: N/A

• Request Parameters

  Name	In	Type	Description
  site-name	path	string	remote site name

  
  

Response

• Normal response codes: 200
• Error response code: 404

• Response Parameters

  Name	In	Type	Required	Description
  name	body	string	Y	Site name
  gateway	body	string	Y	The corresponding responder
  pre_shared_key	body	string	N	Optional, only if using the PSK authentication mode
  local_public_cert	body	string	N	Optional, only if using the public key authentication mode. Public key used for auth.
  local_private_cert	body	string	N	Optional, only if using the public key authentication mode. Private key used for auth.
  shared_ca	body	string	N	Optional, only if using the public key authentication mode. CA information
  authentication_method	body	string	Y	Either 'psk' or 'pubkey' as the authentication method.
  local_identifier	body	string	N	The identifier for localhost
  remote_identifier	body	string	N	The identifier for remote counter party
  crypto_proposal	body	list	Y	Proposal names used for ike process
  force_crypto_proposal	body	boolean	N	The flag on forcing the proposal or not
  connections	body	list	Y	List of connectionArray

  connectionArray:

  Name	In	Type	Required	Description
  name	body	string	Y	Connection name
  type	body	string	Y	Type of connection. Either "tunnel" or "transport"
  mode	body	string	Y	Mode used for connection. Either 'add', 'route' or 'start'
  local_subnet	body	string	N	Defines the local subnet.
  local_nat	body	string	N	Defines the local nat, if exists, replace the local_subnet
  local_sourceip	body	string	N	Defines the local source ip
  local_updown	body	string	N	Defines the local iptable rules.
  local_firewall	body	string	N	Flag used to determine whether to enable the local firewall rules or not
  remote_subnet	body	string	N	Defines the subnet of the counter party
  remote_sourceip	body	string	N	Defines the source ip of the counter party
  remote_updown	body	string	N	Defines the iptable rules applied for the counter party
  remote_firewall	body	string	N	Flag used to determine whether to enable the remote firewall rules or not
  crypto_proposal	body	string	N	Crypto proposal used for ESP

  
  

• Normal response codes: 204
Error response codes: 400, 401, 404

• Response Example

  {      "name": "site1",

  Request Parameters:

  Name

  In

  Type

  Description

  site-namepathstringremote site nameother paramsbodySame with Get's responseRequest Example

  PUT /cgi-bin/luci/sdewan/ipsec/v1/sites/sites

  {

  "gateway":"10.1.0.2",

       "name": "site1",

  "crypto_proposal": "proposal1"      "connections": [       {          "name": "site_to_site",          "type": "tunnel",          "local_subnet":          "remote_subnet":           "crypto_proposal": "

  proposal1

  proposal2"       }     ] }

Response

DELETE /cgi-bin/luci/sdewan/ipsec/v1/sites/{site-name}

...