Operation: | Add Failover Group IPSEC Connection / Edit IPSEC Connection
Description: | To Create/Edit IPSEC Connection for secure VPN communication at the IP Layer.To edit IPSec connections.

Sample Configuration
    	<VPNIPSecConnection>
    		<Configuration>
    			<Name>name</Name>
    			<Description>Text</Description>
    			<ConnectionType>RemoteAccess/SiteToSite/HostToHost</ConnectionType>
    			<Policy>DefaultRemoteAccess</Policy>
    			<ActionOnVPNRestart>Disable/RespondOnly/Initiate</ActionOnVPNRestart>
    			<AuthenticationType>PresharedKey/DigitalCertificate/RSAKey</AuthenticationType>

    			<!-- For preshared Key -->
    			<PresharedKey>key</PresharedKey>

    			<!-- For Certificate -->
    			<LocalCertificate>ApplianceCertificate</LocalCertificate>
    			<RemoteCertificate>ExternalCertificate</RemoteCertificate>

    			<!-- For Network Detail IP Family -->
    			<SubnetFamily>IPv4/IPv6</SubnetFamily>

    			<!-- For Endpoint Detail IP Family -->
    			<EndpointFamily>IPv4/IPv6</EndpointFamily>

    			<!-- For RSA Key -->
    			<RemoteRSAKey>Text</RemoteRSAKey>
    			<LocalWANPort>PortB</LocalWANPort>
    			<!-- For alias wan port -->
    			<AliasLocalWANPort>PortB:0</AliasLocalWANPort>
    			<RemoteHost>Host</RemoteHost>
    			<LocalSubnet>Host</LocalSubnet>

    			<!-- only for site-to-site -->
    			<NATedLAN>Host</NATedLAN>
    			<LocalIDType>DNS/IP Address/Email/DER ASN1 DN (X.509)</LocalIDType>
    			<LocalID>localid</LocalID>

    			<!-- only for RemoteAccess & Host-to-Host -->
    			<AllowNATTraversal>Enable/Disable</AllowNATTraversal>
    			<RemoteNetwork>
    				<Network>Network</Network>
    			</RemoteNetwork>
    			<RemoteIDType>DNS/IP Address/Email/DER ASN1 DN (X.509)</RemoteIDType>
    			<RemoteID>remoteid</RemoteID>
    			<UserAuthenticationMode>Disable/AsServer/AsClient</UserAuthenticationMode>

    			<!-- for AsClient -->
    			<Username>username</Username>
    			<Password>password</Password>

    			<!-- for AsServer -->
    			<AllowedUser>
    				<User>username</User>
    				:
    			</AllowedUser>
    			<Protocol>ALL/UDP/TCP/ICMP</Protocol>
    			<LocalPort>Number</LocalPort>
    			<RemotePort>Number</RemotePort>
    			<DisconnectOnIdleInterval>600</DisconnectOnIdleInterval>
    			<Status>Active/Deactive</Status>
    		</Configuration>
    	 <!-- these four tags will work only after the connection is created-->
    		<Active><Name>connectionname</Name></Active>
    		<DeActive><Name>connectionname</Name></DeActive>
    		<Connection><Name>connectionname</Name></Connection>
    		<DisConnection><Name>connectionname</Name></DisConnection>
    	</VPNIPSecConnection>

Attribute/Parameter Information :

Parameter | Mandatory | Default | Description
--- | --- | --- | ---
Name | Yes |  | Description: Specify a name to identify IPSec connection. Name confines to: Type is 'ARRAY'. Datatype is 'STRING'. First character is to be alphabet (a-zA-Z). Alphanumeric (a-zA-Z0-9) and underscore (_) to be allowed for the remaining characters. Maximum characters allowed are 100. Multiple values are allowed.
Description | No |  | Description: Specify description for the IPSEC connection. Description confines to: Type is 'SCALAR'. Datatype is 'STRING'. Maximum characters allowed are 255.
ConnectionType | Yes |  | Description: Select Connection type for VPN IPSEC connection from the available options: Remote Access, Site to Site or Host to Host. ConnectionType confines to: Type is 'SCALAR'. Datatype is 'STRING'. Only 'rw', 'ntn', 'hth' are allowed.
Policy | Yes |  | Description: Select Policy to be used for connection from the available options: Default Policy, DefaultHeadOffice, DefaultRemoteAccess, AES128_MD5, DefaultBranchOffice or DefaultL2TP. Policy confines to: Type is 'SCALAR'. Datatype is 'STRING'.
ActionOnVPNRestart | No |  | Description: Select action to be taken when VPN Services restarts from the available options: Disable or Respond Only. ActionOnVPNRestart confines to: Type is 'SCALAR'. Datatype is 'STRING'. Only 'ignore', 'add', 'start' are allowed.
AuthenticationType | No |  | Description: Select Authentication type based on the Connection type. AuthenticationType confines to: Type is 'SCALAR'. Datatype is 'STRING'. Only 'psk', 'cert', 'rsa' are allowed.
LocalCertificate/PresharedKey | Yes |  | Description: Specify Preshared key or Select Local Certificate to be used by Appliance for authentication based on the Authentication type selected. LocalCertificate/PresharedKey confines to: Type is 'SCALAR'. Datatype is 'STRING'. Maximum characters allowed are 50. Minimum characters allowed are 5.
RemoteRSAKey/RemoteCertificate | No |  | Description: Select Remote Certificate or Specify RSA Key to be used by remote peer for authentication based on the Authentication type selected. RemoteRSAKey/RemoteCertificate confines to: Type is 'SCALAR'. Datatype is 'STRING'. Note: This options are available if Connection type selected is Site-to-Site or Host-to-Host..
AliasLocalWANPort | Yes |  | Description: Select local WAN port from the list. AliasLocalWANPort confines to: Type is 'ARRAY'. Datatype is 'STRING'. Multiple values are allowed. Duplicate values will not be ignored.
RemoteHost | Yes |  | Description: Specify IP Address/Domain name of the remote peer. RemoteHost confines to: Type is 'ARRAY'. Datatype is 'STRING'. Multiple values are allowed. Duplicate values will not be ignored. If Authentication type is 'RSAKey' then character (*) is not allowed.
Failover Group Name | Yes |  | Description: Specify a name for Failover Group. Failover Group Name confines to: Type is 'SCALAR'. Datatype is 'STRING'. First character is to be alphabet (a-zA-Z). Alphanumeric (a-zA-Z0-9) and underscore (_) to be allowed for the remaining characters.
Failover Mail Notification | No |  | Description: Enable to trigger Email notifications to Administrator at failover events. Failover Mail Notification confines to: Type is 'SCALAR'. Datatype is 'STRING'. Only 'y', 'n' are allowed.
Protocol | No |  | Description: Select Protocol. Protocol confines to: Type is 'ARRAY'. Datatype is 'STRING'. Only 'ping', 'tcp', '' are allowed. Multiple values are allowed. Duplicate values will not be ignored.
Port | No |  | Description: Select Port. Port confines to: Type is 'ARRAY'. Datatype is 'STRING'. Multiple values are allowed. Allowed numbers: 1 to 65535.
LocalSubnet | Yes |  | Description: Select Local LAN subnet. LocalSubnet confines to: Type is 'ARRAY'. Datatype is 'STRING'. First character is to be hash(#) or comma(,). Maximum characters allowed are 60. Multiple values are allowed. Duplicate values will be ignored.
NATedLAN | No |  | Description: If NAT Local LAN is selected for Site-to-Site Connection type, select IP Host or Network Host from the list. NATedLAN confines to: Type is 'ARRAY'. Datatype is 'STRING'. First character is to be hash(#) or comma(,). Maximum characters allowed are 60. Multiple values are allowed. Duplicate values will not be ignored.
LocalIDType | Yes |  | Description: Select ID type for Preshared Key and RSA Key. LocalIDType confines to: Type is 'SCALAR'. Datatype is 'STRING'. Only 'fqdn', 'ip', 'email', 'x509' are allowed.
LocalID | Yes |  | Description: Specify the value as per selected Local ID type. LocalID confines to: Type is 'SCALAR'. Datatype is 'STRING'.
AllowNATTraversal | No |  | Description: Enable NAT Traversal if a NAT device is located between VPN end points. AllowNATTraversal confines to: Type is 'SCALAR'. Datatype is 'STRING'. Only 'y', 'n' are allowed.
RemoteIDType | Yes |  | Description: Select Remote ID type. RemoteIDType confines to: Type is 'SCALAR'. Datatype is 'STRING'. Only 'fqdn', 'ip', 'email', 'x509' are allowed.
RemoteID | Yes |  | Description: Specify the value as per selected Remote ID type. RemoteID confines to: Type is 'SCALAR'. Datatype is 'STRING'.
UserAuthenticationMode | No |  | Description: Select mode for User Authentication if required at time of connection. UserAuthenticationMode confines to: Type is 'SCALAR'. Datatype is 'STRING'. Only '0', '1', '2' are allowed.
Username | Yes |  | Description: Specify Username if User Authentication mode is enabled as Client. Username confines to: Type is 'SCALAR'. Datatype is 'STRING'. Maximum characters allowed are 50.
Password | No |  | Description: Specify Password if User Authentication mode is enabled as Client. Password confines to: Type is 'SCALAR'. Datatype is 'STRING'.
User | No |  | Description: Add all the users which are allowed to connect if authentication mode is enabled as Server. User confines to: Type is 'ARRAY'. Datatype is 'STRING'. Maximum characters allowed are 50. Multiple values are allowed. Duplicate values will be ignored.
Protocol | No |  | Description: Select Protocol to be allowed for negotiations. Protocol confines to: Type is 'SCALAR'. Datatype is 'STRING'. Only '*', '1', '17', '6' are allowed.
LocalPort | Yes |  | Description: Specify local port number that local VPN peer will use to transport traffic. LocalPort confines to: Type is 'SCALAR'. Datatype is 'STRING'. Allowed: Number between 1 to 65535 or any port with Character (*). Maximum characters allowed are 5.
RemotePort | Yes |  | Description: Specify remote port number that remote VPN peer will use to transport traffic. RemotePort confines to: Type is 'SCALAR'. Datatype is 'STRING'. Allowed: Number between 1 to 65535 or any port with Character (*). Maximum characters allowed are 5.
DisconnectOnIdleInterval | No | 0 | Description: Disconnect on idle interval. DisconnectOnIdleInterval confines to: Type is 'SCALAR'. Datatype is 'INTEGER'. Range 120 to 999 is allowed. Maximum digits allowed are 3.
Local IP Address | No |  | Description: Local IP Address for Interface Binding. Local IP Address confines to: Type is 'SCALAR'. Datatype is 'IPADDRESS'. Maximum characters allowed are 15.
Remote IP Address | No |  | Description: Remote IP Address for Interface Binding. Remote IP Address confines to: Type is 'SCALAR'. Datatype is 'IPADDRESS'. Maximum characters allowed are 15.
SubnetFamily | No |  | Description: IP Family Selection for Network Detail. SubnetFamily confines to: Type is 'SCALAR'. Datatype is 'STRING'. Only '0', '1' are allowed.
Bind with Interface | No |  | Description: Enable or Disable Selection for Interface Binding. Bind with Interface confines to: Type is 'SCALAR'. Datatype is 'INTEGER'. Only '0', '1' are allowed.
Network | Yes |  | Description: Specify the remote LAN network. Network confines to: Type is 'ARRAY'. Datatype is 'STRING'. First character is to be hash(#) or comma(,). Maximum characters allowed are 60. Multiple values are allowed. Duplicate values will not be ignored.

Status Message Information :

Operation | Status | Message
--- | --- | ---
Edit IPSEC Connection | 200 |
Edit IPSEC Connection | 201 |
Edit IPSEC Connection | 500 |
Edit IPSEC Connection | 502 |
Edit IPSEC Connection | 503 |
Edit IPSEC Connection | 505 |
Edit IPSEC Connection | 545 |
Edit IPSEC Connection | 546 |
Add Failover Group IPSEC Connection | 200 |
Add Failover Group IPSEC Connection | 500 |
Add Failover Group IPSEC Connection | 502 |
Add Failover Group IPSEC Connection | 503 |
Add Failover Group IPSEC Connection | 504 |
Add Failover Group IPSEC Connection | 541 |
Add Failover Group IPSEC Connection | 542 |
Add Failover Group IPSEC Connection | 543 |
Add Failover Group IPSEC Connection | 544 |
Add Failover Group IPSEC Connection | 545 |
Add Failover Group IPSEC Connection | 546 |

) Copyright 2017 Sophos Limited. All rights reserved.
Sophos is registered trademarks of Sophos Limited and Sophos Group. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.