oci_core_ipsec_connection_tunnel_management

This resource provides the Ip Sec Connection Tunnel Management resource in Oracle Cloud Infrastructure Core service.

Updates the specified tunnel. This operation lets you change tunnel attributes such as the routing type (BGP dynamic routing or static routing). Here are some important notes:

* If you change the tunnel's routing type or BGP session configuration, the tunnel will go
down while it's reprovisioned.

* If you want to switch the tunnel's `routing` from `STATIC` to `BGP`, make sure the tunnel's
BGP session configuration attributes have been set ([bgpSessionConfig](#/en/iaas/20160918/datatypes/BgpSessionInfo)).

* If you want to switch the tunnel's `routing` from `BGP` to `STATIC`, make sure the
[IPSecConnection](#/en/iaas/20160918/IPSecConnection/) already has at least one valid CIDR
static route.

** IMPORTANT ** Destroying the oci_core_ipsec_connection_tunnel_management leaves the resource in its existing state. It will not destroy the tunnel and it will not return the tunnel to its default values.

Example Usage

resource "oci_core_ipsec_connection_tunnel_management" "test_ip_sec_connection_tunnel" {
	#Required
	ipsec_id = oci_core_ipsec.test_ipsec.id
	tunnel_id = data.oci_core_ipsec_connection_tunnels.test_ip_sec_connection_tunnels.ip_sec_connection_tunnels[0].id
	#Optional
	routing = var.ip_sec_connection_tunnel_management_routing
	bgp_session_info {
		#Optional
		customer_bgp_asn = var.ip_sec_connection_tunnel_management_bgp_session_info_customer_bgp_asn
		customer_interface_ip = var.ip_sec_connection_tunnel_management_bgp_session_info_customer_interface_ip
		oracle_interface_ip = var.ip_sec_connection_tunnel_management_bgp_session_info_oracle_interface_ip
	}
	display_name = var.ip_sec_connection_tunnel_management_display_name

    encryption_domain_config {
		#Optional
		cpe_traffic_selector = var.ip_sec_connection_tunnel_management_encryption_domain_config_cpe_traffic_selector
		oracle_traffic_selector = var.ip_sec_connection_tunnel_management_encryption_domain_config_oracle_traffic_selector
	}
	shared_secret = var.ip_sec_connection_tunnel_management_shared_secret
    ike_version = "V1"
}

Argument Reference

The following arguments are supported:

The ENABLED option sets the IKE protocol to use port 4500 instead of 500 and forces encapsulating traffic with the ESP protocol inside UDP packets.

The DISABLED option directs IKE to completely refuse to negotiate NAT-T even if it senses there may be a NAT device in use. * oracle_can_initiate - (Optional) Indicates whether Oracle can only respond to a request to start an IPSec tunnel from the CPE device (RESPONDER_ONLY), or both respond to and initiate requests (INITIATOR_OR_RESPONDER). * phase_one_details- (Optional) Configuration details for IKE phase one (ISAKMP) configuration parameters.

See [PhaseOneConfigDetails](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/datatypes/PhaseOneConfigDetails) for allowed values but note naming scheme follows [TunnelPhaseOneDetails](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/datatypes/TunnelPhaseOneDetails).

Attributes Reference

The following attributes are exported:

The ENABLED option sets the IKE protocol to use port 4500 instead of 500 and forces encapsulating traffic with the ESP protocol inside UDP packets.

The DISABLED option directs IKE to completely refuse to negotiate NAT-T even if it senses there may be a NAT device in use. * oracle_can_initiate - Indicates whether Oracle can only respond to a request to start an IPSec tunnel from the CPE device, or both respond to and initiate requests. * phase_one_details- (Optional) IPSec tunnel details specific to ISAKMP phase one. See TunnelPhaseOneDetails. * custom_authentication_algorithm - The proposed custom authentication algorithm. * custom_dh_group - The proposed custom authentication algorithm. * custom_encryption_algorithm - The proposed custom encryption algorithm. * is_custom_phase_one_config - Indicates whether custom phase one configuration is enabled. If this option is not enabled, default settings are proposed. * lifetime - The total configured lifetime of the IKE security association. * is_ike_established - Indicates whether IKE phase one is established. * negotiated_authentication_algorithm - The negotiated authentication algorithm. * negotiated_dh_group - The negotiated Diffie-Hellman group. * negotiated_encryption_algorithm - The negotiated encryption algorithm. * remaining_lifetime_int - The remaining lifetime before the key is refreshed. * remaining_lifetime_last_retrieved - The date and time we retrieved the remaining lifetime, in the format defined by RFC3339. Example: 2016-08-25T21:10:29.600Z * phase_two_details - (IPsec tunnel detail information specific to phase two. See TunnelPhaseTwoDetails. * custom_authentication_algorithm - Phase two authentication algorithm proposed during tunnel negotiation. * custom_encryption_algorithm - The proposed custom phase two encryption algorithm. * dh_group - The proposed Diffie-Hellman group. * is_custom_phase_two_config - Indicates whether custom phase two configuration is enabled. If this option is not enabled, default settings are proposed. * is_pfs_enabled - Indicates that PFS (perfect forward secrecy) is enabled. * lifetime - The total configured lifetime of the IKE security association. * is_esp_established - Indicates that ESP phase two is established. * negotiated_authentication_algorithm - The negotiated phase two authentication algorithm. * negotiated_dh_group - The negotiated Diffie-Hellman group. * negotiated_encryption_algorithm - The negotiated encryption algorithm. * remaining_lifetime_int - The remaining lifetime before the key is refreshed. * remaining_lifetime_last_retrieved - The date and time the remaining lifetime was last retrieved, in the format defined by RFC3339. Example: 2016-08-25T21:10:29.600Z