Get IPSEC Profile (v2.1)

GET 
https://api.sase.paloaltonetworks.com/sdwan/v2.1/api/ipsecprofiles/:profile_id

List a specific IPsec Profile.

Request

Path Parameters

profile_id stringrequired

The ID of the IPsec profile.

Responses

200

Successful Operation

application/json

Schema

Schema

authentication IPSECAuthenticationV1required

The details of the authentication mode for the IPsec Profile.

certificatestring

The certificate authentication for the IPsec Profile.

certificate_profile_idstring

Certificate Profile Id

commentstring

Comment

ikev1_params IKEV1Params

Ikev1 Params: Valid

xauth_idstring

The xauth ID.

xauth_secretstring

The authentication secret. Length must be between 4-128.

xauth_secret_encryptedstring

The xauth secret. Value = True.

xauth_secret_hashstring

The xauth hash. Value = True.

xauth_typestringrequired

The xauth type.

Possible values: [NONE, SECRET]

local_ca_certificatestring

The local CA certificate uploaded for certificate authentication.

local_idstringrequired

The local ID type.

Possible values: [LOCAL_IP, DN, HOSTNAME, CUSTOM, NONE]

local_id_customstring

The custom local ID.

local_pa_certificate_idstring

Local Pa Certificate Id

pa_master_key_idstring

Pa Master Key Id

passphrasestring

Passphrase

passphrase_encryptedstring

Passphrase Encrypted: JsonIgnore(value = true)

peer_id_checkstring

Peer Id Check

Possible values: [EXACT, WILDCARD]

permit_peer_id_mismatchboolean

Permit Peer Id Mismatch

private_keystring

The private key file uploaded for certificate authentication.

private_key_encryptedstring

Private Key Encrypted: JsonIgnore(value = true)

remote_ca_certificatestring

The standard VPN endpoint CA certificate uploaded.

remote_idstring

The ID for the standard VPN endpoint in the Remote ID field.

secretstring

The password for PSK authentication.

secret_encryptedstring

Secret Encrypted: JsonIgnore(value = true)

secret_hashstring

Secret Hash: JsonIgnore(value = true)

strict_validation_peer_extended_key_useboolean

Strict Validation Peer Extended Key Use

typestringrequired

The authentication type = PSK or Certificates.

Possible values: [NONE, PSK, X509]

x509Objects X509Objects

X509Objects: JsonIgnore(value = true)

certHolderobject

certificatestring

Certificate

is_local_ca_cert_setboolean

Is Local Ca Cert Set

is_remote_ca_cert_setboolean

Is Remote Ca Cert Set

keyPairobject

local_ca_certificatestring

Local Ca Certificate

local_ca_certs_setobject[]

Local Ca Certs Set

passphrasestring

Passphrase

pkcs12_certificatestring

Pkcs12 Certificate

privateKeyjava.security.privatekey

PrivateKey

private_keystring

Private Key

remote_ca_certificatestring

Remote Ca Certificate

remote_ca_certs_setobject[]

Remote Ca Certs Set

description

The description of the IPsec profile. Max size = 256.

dpd_delayint32

The DPD delay time in seconds (should be between 1-60 seconds) for IKEv1.

dpd_enableboolean

If DPD is enabled for the IPsec profile.

dpd_timeoutint32

The configured DPD timeout period.

esp_group ESPGrouprequired

The ESP group defined for the IPsec profile.

force_encapsulationboolean

The type of encapsulation is force UDP. The type of encapsulation has to match the encapsulation configured at the standard VPN endpoint.

lifesize Lifesize

Lifesize

unitsstring

Units

valueint32

Value

lifetimeint32

The life time for the ESP Group. The default lifetime of an ESP Group is 24 hours.

lifetime_unitsstring

Lifetime Units

modestringrequired

The IPsec config ESP tunnel mode.

Possible values: [TUNNEL, TRANSPORT]

proposals Proposals[]required

Information on the IPsec proposals. Proposals is a list of crypto parameters to be used to secure the ESP sessions between the ION device and the endpoint.

Array [

dh_groupsstringrequired

The DH group values.

Possible values: [ECP224BP, ECP256, NONE, MODP8192, MODP1024S160, MODP3072, ECP384, MODP1024, MODP4096, MODP2048, ECP224, ECP192, ECP521, ECP256BP, ECP384BP, MODP2048S224, ECP512BP, MODP768, CURVE25519, MODP2048S256, MODP6144, MODP1536]

encryptionstringrequired

The encryption values.

Possible values: [AES256CCM64, NONE, AES192GMAC, TWOFISH192, AES256GCM16, AES192CTR, AES256CTR, BLOWFISH256, AES128CCM128, AES256CCM128, AES256GCM128, AES192GCM128, AES256CCM96, AES192CCM64, CAMELLIA192, AES128GCM64, AES256, AES128GCM96, TWOFISH256, AES192GCM64, AES256GMAC, SERPENT192, AES128CCM64, BLOWFISH192, AES192CCM128, TRIPLEDES, AES192, AES256GCM64, SERPENT128, AES256GCM96, CAMELLIA128, AES128GCM128, AES128CCM16, AES128, AES128CTR, AES192CCM96, AES192GCM96, CAMELLIA256, AES128GMAC, AES128CCM96, SERPENT256, BLOWFISH128, AES128GCM16, TWOFISH128]

hashstringrequired

The hash values.

Possible values: [NONE, AES192GMAC, SHA1, AES256GMAC, SHA512, AESXCBC, MD5, SHA256_96, AES128GMAC, SHA384, SHA256]

prfstring

Prf: ValidateEnum(enumClass = classOf[IPSECHash], error = IPSECCONFIG_INVALID_HASH: Invalid hashing algorithm specified., nullAllowed = true)

Possible values: [MD5, SHA1, SHA256, SHA384, SHA512, SHA256_96, AESXCBC, AES128GMAC, AES192GMAC, AES256GMAC, NONE]

]

responder_sase_proposals ResponderSaseProposals

Responder Sase Proposals

dh_groupstring[]

Dh Group

Possible values: [NONE, MODP768, MODP1024, MODP1536, MODP2048, MODP3072, MODP4096, MODP6144, MODP8192, MODP1024S160, MODP2048S224, MODP2048S256, ECP192, ECP224, ECP256, ECP384, ECP521, ECP224BP, ECP256BP, ECP384BP, ECP512BP, CURVE25519]

encryptionstring[]

The encryption values.

Possible values: [NONE, AES128, AES192, AES256, AES128CTR, AES192CTR, AES256CTR, AES128CCM16, AES128CCM64, AES192CCM64, AES256CCM64, AES128CCM96, AES192CCM96, AES256CCM96, AES128CCM128, AES192CCM128, AES256CCM128, AES128GCM16, AES128GCM64, AES192GCM64, AES256GCM16, AES256GCM64, AES128GCM96, AES192GCM96, AES256GCM96, AES128GCM128, AES192GCM128, AES256GCM128, AES128GMAC, AES192GMAC, AES256GMAC, TRIPLEDES, BLOWFISH128, BLOWFISH192, BLOWFISH256, CAMELLIA128, CAMELLIA192, CAMELLIA256, SERPENT128, SERPENT192, SERPENT256, TWOFISH128, TWOFISH192, TWOFISH256]

hashstring[]

The hash values.

Possible values: [MD5, SHA1, SHA256, SHA384, SHA512, SHA256_96, AESXCBC, AES128GMAC, AES192GMAC, AES256GMAC, NONE]

idstring

The ID of the IPsec profile.

ike_group IKEGrouprequired

The IKE group defined on the IPsec profile.

aggressiveboolean

If aggressive mode is selecetd, the source interface or endpoint is behind NAT or there are multiple tunnels to the same remote endpoint.

authentication_multipleinteger

Authentication Multiple

key_exchangestringrequired

The key exchange for the IKE group = IKEv1 or IKEv2.

Possible values: [IKEV1, IKEV2]

lifetimeint32

The life time for the IKE Group. The default lifetime of an IKE Group is 72 hours.

lifetime_unitsstring

Lifetime Units

portint32

The port number of the communication port. The default port is 500. The port number configured in the IKE group has to be the same as the port number configured in the standard VPN endpoint IKE group.

proposals Proposals[]required

Information on the IPsec proposals. Proposals is a list of crypto parameters to be used to secure the IKE sessions between the ION device and the endpoint.

Array [

dh_groupsstringrequired

The DH group values.

Possible values: [ECP224BP, ECP256, NONE, MODP8192, MODP1024S160, MODP3072, ECP384, MODP1024, MODP4096, MODP2048, ECP224, ECP192, ECP521, ECP256BP, ECP384BP, MODP2048S224, ECP512BP, MODP768, CURVE25519, MODP2048S256, MODP6144, MODP1536]

encryptionstringrequired

The encryption values.

Possible values: [AES256CCM64, NONE, AES192GMAC, TWOFISH192, AES256GCM16, AES192CTR, AES256CTR, BLOWFISH256, AES128CCM128, AES256CCM128, AES256GCM128, AES192GCM128, AES256CCM96, AES192CCM64, CAMELLIA192, AES128GCM64, AES256, AES128GCM96, TWOFISH256, AES192GCM64, AES256GMAC, SERPENT192, AES128CCM64, BLOWFISH192, AES192CCM128, TRIPLEDES, AES192, AES256GCM64, SERPENT128, AES256GCM96, CAMELLIA128, AES128GCM128, AES128CCM16, AES128, AES128CTR, AES192CCM96, AES192GCM96, CAMELLIA256, AES128GMAC, AES128CCM96, SERPENT256, BLOWFISH128, AES128GCM16, TWOFISH128]

hashstringrequired

The hash values.

Possible values: [NONE, AES192GMAC, SHA1, AES256GMAC, SHA512, AESXCBC, MD5, SHA256_96, AES128GMAC, SHA384, SHA256]

prfstring

Prf: ValidateEnum(enumClass = classOf[IPSECHash], error = IPSECCONFIG_INVALID_HASH: Invalid hashing algorithm specified., nullAllowed = true)

Possible values: [MD5, SHA1, SHA256, SHA384, SHA512, SHA256_96, AESXCBC, AES128GMAC, AES192GMAC, AES256GMAC, NONE]

]

reauthboolean

The mode for IKEv2. If selected, then a new tunnel has to be re-negotiated when the lifetime is reached.

namestringrequired

The name of the IPsec profile. Max size = 128.

tagsstring[]

An information field that can be added to identify the IPsec profile. Maximum 10 unique tags of length 1024 each are allowed.

Example (auto)

{
  "authentication": {
    "certificate": "string",
    "certificate_profile_id": "string",
    "comment": "string",
    "ikev1_params": {
      "xauth_id": "string",
      "xauth_secret": "string",
      "xauth_secret_encrypted": "string",
      "xauth_secret_hash": "string",
      "xauth_type": "NONE"
    },
    "local_ca_certificate": "string",
    "local_id": "LOCAL_IP",
    "local_id_custom": "string",
    "local_pa_certificate_id": "string",
    "pa_master_key_id": "string",
    "passphrase": "string",
    "passphrase_encrypted": "string",
    "peer_id_check": "EXACT",
    "permit_peer_id_mismatch": true,
    "private_key": "string",
    "private_key_encrypted": "string",
    "remote_ca_certificate": "string",
    "remote_id": "string",
    "secret": "string",
    "secret_encrypted": "string",
    "secret_hash": "string",
    "strict_validation_peer_extended_key_use": true,
    "type": "NONE",
    "x509Objects": {
      "certHolder": {},
      "certificate": "string",
      "is_local_ca_cert_set": true,
      "is_remote_ca_cert_set": true,
      "keyPair": {},
      "local_ca_certificate": "string",
      "local_ca_certs_set": [
        {}
      ],
      "passphrase": "string",
      "pkcs12_certificate": "string",
      "private_key": "string",
      "remote_ca_certificate": "string",
      "remote_ca_certs_set": [
        {}
      ]
    }
  },
  "dpd_delay": 0,
  "dpd_enable": true,
  "dpd_timeout": 0,
  "esp_group": {
    "force_encapsulation": true,
    "lifesize": {
      "units": "string",
      "value": 0
    },
    "lifetime": 0,
    "lifetime_units": "string",
    "mode": "TUNNEL",
    "proposals": [
      {
        "dh_groups": "ECP224BP",
        "encryption": "AES256CCM64",
        "hash": "NONE",
        "prf": "MD5"
      }
    ],
    "responder_sase_proposals": {
      "dh_group": [
        "NONE"
      ],
      "encryption": [
        "NONE"
      ],
      "hash": [
        "MD5"
      ]
    }
  },
  "id": "string",
  "ike_group": {
    "aggressive": true,
    "authentication_multiple": 0,
    "key_exchange": "IKEV1",
    "lifetime": 0,
    "lifetime_units": "string",
    "port": 0,
    "proposals": [
      {
        "dh_groups": "ECP224BP",
        "encryption": "AES256CCM64",
        "hash": "NONE",
        "prf": "MD5"
      }
    ],
    "reauth": true
  },
  "name": "string",
  "tags": [
    "string"
  ]
}

• curl
• python
• go
• nodejs
• csharp
• php

• CURL

curl -L 'https://api.sase.paloaltonetworks.com/sdwan/v2.1/api/ipsecprofiles/:profile_id' \
-H 'Accept: application/json'

Request Collapse all

Base URL

https://api.sase.paloaltonetworks.com

Parameters

profile_id — pathrequired

ResponseClear

Click the Send API Request button above and see the response here!