oci_core_ipsec

This resource provides the Ip Sec Connection resource in Oracle Cloud Infrastructure Core service.

Creates a new IPSec connection between the specified DRG and CPE with two default static tunnels. For more information, see Site-to-Site VPN Overview.

For the purposes of access control, you must provide the OCID of the compartment where you want the IPSec connection to reside. Notice that the IPSec connection doesn’t have to be in the same compartment as the DRG, CPE, or other Networking Service components. If you’re not sure which compartment to use, put the IPSec connection in the same compartment as the DRG. For more information about compartments and access control, see Overview of the IAM Service.

You may optionally specify a display name for the IPSec connection, otherwise a default is provided. It does not have to be unique, and you can change it. Avoid entering confidential information.

After creating the IPSec connection, you need to configure your on-premises router with tunnel-specific information. For tunnel status and the required configuration information, see:

To configure tunnel-specific information, use oci_core_ipsec_connection_tunnel_management to update the tunnels. If you configure at least one tunnel to use static routing, then in the oci_core_ipsec request you must provide at least one valid static route (you’re allowed a maximum of 10). For example: 10.0.0.0/16. If you configure both tunnels to use BGP dynamic routing, the static routes will be ignored. However, you must provide a static route in oci_core_ipsec even if you plan to use BGP routing because it defaults to two static tunnels. For more information, see the important note in IPSecConnection.

For each tunnel, you need the IP address of Oracle’s VPN headend and the shared secret (that is, the pre-shared key). For more information, see CPE Configuration.

To configure tunnel-specific information for private ipsec connection over fastconnect, use attribute tunnel_configuration. You can provide configuration for maximum of 2 tunnels. You can configure each tunnel with oracle_tunnel_ip, associated_virtual_circuits and drg_route_table_id at time of creation. These attributes cannot be updated using IPSec connection APIs. To update drg route table id, use oci_core_drg_attachment_management resource to update.

Example Usage

resource "oci_core_ipsec" "test_ip_sec_connection" {
	#Required
	compartment_id = var.compartment_id
	cpe_id = oci_core_cpe.test_cpe.id
	drg_id = oci_core_drg.test_drg.id
	static_routes = var.ip_sec_connection_static_routes

	#Optional
	cpe_local_identifier = var.ip_sec_connection_cpe_local_identifier
	cpe_local_identifier_type = var.ip_sec_connection_cpe_local_identifier_type
	defined_tags = {"Operations.CostCenter"= "42"}
	display_name = var.ip_sec_connection_display_name
	freeform_tags = {"Department"= "Finance"}
}

resource "oci_core_ipsec" "test_ip_sec_connection_over_fc" {
	#Required
	compartment_id = var.compartment_id
	cpe_id = oci_core_cpe.test_cpe.id
	drg_id = oci_core_drg.test_drg.id
	static_routes = var.ip_sec_connection_static_routes

	#Optional
	cpe_local_identifier = var.ip_sec_connection_cpe_local_identifier
	cpe_local_identifier_type = var.ip_sec_connection_cpe_local_identifier_type
	defined_tags = {"Operations.CostCenter"= "42"}
	display_name = var.ip_sec_connection_display_name
	freeform_tags = {"Department"= "Finance"}
	tunnel_configuration {
		oracle_tunnel_ip = "10.1.5.5"
		associated_virtual_circuits = [oci_core_virtual_circuit.test_ipsec_over_fc_virtual_circuit.id]
		drg_route_table_id = oci_core_drg_route_table.test_drg_ipsec_over_fc_route_table.id
	}
	tunnel_configuration {
		oracle_tunnel_ip = "10.1.7.7"
		associated_virtual_circuits = [oci_core_virtual_circuit.test_ipsec_over_fc_virtual_circuit.id]
		drg_route_table_id = oci_core_drg_route_table.test_drg_ipsec_over_fc_route_table.id
	}
}

Argument Reference

The following arguments are supported:

Example: tunnel_configuration { oracle_tunnel_ip = "10.1.5.5" associated_virtual_circuits = [oci_core_virtual_circuit.test_ipsec_over_fc_virtual_circuit.id] drg_route_table_id = oci_core_drg_route_table.test_drg_ipsec_over_fc_route_table.id }

** IMPORTANT ** Any change to a property that does not support update will force the destruction and recreation of the resource with the new property values

Attributes Reference

The following attributes are exported:

Timeouts

The timeouts block allows you to specify timeouts for certain operations: * create - (Defaults to 20 minutes), when creating the Ip Sec Connection * update - (Defaults to 20 minutes), when updating the Ip Sec Connection * delete - (Defaults to 20 minutes), when destroying the Ip Sec Connection

Import

IpSecConnections can be imported using the id, e.g.

$ terraform import oci_core_ipsec.test_ip_sec_connection "id"