HomeGuidesAPI Reference
API Reference
GuidesAPI ReferenceGitHubAirheads Developer Community
  1. Orchestrator REST APIs
  2. thirdPartyServices

Save HPE SSE tunnel settings

post
http://127.0.0.1:8080/thirdPartyServices/axis/tunnelSettings

Saves global IPsec/IKE tunnel settings for HPE SSE (Axis) VPN connections. These settings apply to all HPE SSE tunnels. Auto-corrections: when ikeVersion=2, idType is forced to 'address'; invalid ipSecSuiteB values default to 'none'; invalid ikePrf values default to 'auto'.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Body Params

IPsec/IKE tunnel configuration settings for third-party cloud security integration.

IPsec/IKE tunnel configuration settings for Zscaler Cloud Security integration. Defines cryptographic algorithms, timing parameters, and protocol options for secure tunnel establishment.

string
enum
required
Defaults to up

Administrative status of the tunnel interface. Controls whether the tunnel is operationally enabled.

Allowed:
string
enum
required
Defaults to ipsec_ip

Tunnel encapsulation mode. Specifies the passthrough tunnel protocol type.

Allowed:
boolean
required
Defaults to true

Enable automatic maximum bandwidth detection. When true, the system automatically determines optimal bandwidth limits.

string
enum
Defaults to none

IPsec Suite B cryptographic compliance level. Controls NSA Suite B algorithm requirements.

Allowed:
string

IKE pre-shared key for tunnel authentication. Must be configured to match the Zscaler portal settings.

string
enum
required
Defaults to sha256

IKE Phase 1 authentication (integrity) algorithm. Zscaler recommends sha256 for optimal security.

Allowed:
string
enum
required
Defaults to aes256

IKE Phase 1 encryption algorithm. Zscaler recommends aes256 for secure key exchange.

Allowed:
string
enum
Defaults to auto

IKE Pseudo-Random Function algorithm. Used for key derivation in IKEv2.

Allowed:
string
enum
required
Defaults to 2

Diffie-Hellman group for IKE key exchange. Group 2 (1024-bit MODP) is the Zscaler default.

integer
required
≥ 0
Defaults to 1440

IKE Phase 1 SA lifetime in minutes. Determines how often IKE keys are renegotiated.

integer
required
≥ 0
Defaults to 10

Dead Peer Detection (DPD) delay interval in seconds. Time between DPD keepalive messages.

integer
required
≥ 0
Defaults to 3

Dead Peer Detection retry count. Number of failed DPD probes before declaring peer dead.

string
enum
Defaults to ufqdn

IKE identifier type for tunnel authentication. Zscaler uses ufqdn (user FQDN/email) format.

Allowed:
string

IKE identifier string value. The actual identifier matching the idType (e.g., email address for ufqdn).

string
enum
required
Defaults to aggressive

IKE Phase 1 exchange mode. Aggressive mode is faster but less secure than main mode.

Allowed:
integer
enum
required
Defaults to 2

IKE protocol version. IKEv2 is recommended for improved security and performance.

Allowed:
string

Template format for generating local IKE identifier. Supports variables like %hostname%, %label%.

string

Template format for expected remote IKE identifier. Used for peer identity validation.

string
enum
required
Defaults to sha256

IPsec Phase 2 authentication (integrity) algorithm. Zscaler recommends sha256.

Allowed:
string
enum
required
Defaults to null

IPsec Phase 2 encryption algorithm. Zscaler default is null (no encryption) when GRE encapsulation provides security.

Allowed:
string
enum
required
Defaults to 1024

IPsec anti-replay protection window size. Prevents packet replay attacks; 1024 is recommended.

Allowed:
int64
required
≥ 0
Defaults to 0

IPsec SA lifetime in megabytes. 0 means unlimited data volume before rekeying.

integer
required
≥ 0
Defaults to 480

IPsec Phase 2 SA lifetime in minutes. Determines how often IPsec keys are renegotiated.

boolean
required
Defaults to false

Enable Perfect Forward Secrecy. When false, Phase 2 keys derive from Phase 1 keys.

string
enum
required
Defaults to 14

Perfect Forward Secrecy Diffie-Hellman group. Only used when pfs is enabled.

Responses
200

Tunnel settings saved successfully. The action is logged in the system audit log.

Updated about 11 hours ago

Did this page help you?
Language
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
text/plain

Updated about 11 hours ago

Did this page help you?