HomeGuidesAPI Reference
API Reference
GuidesAPI ReferenceGitHubAirheads Developer Community
  1. Orchestrator REST APIs
  2. thirdPartyServices

Set Azure Virtual WAN tunnel settings

post
http://127.0.0.1:8080/thirdPartyServices/azure/tunnelSetting

Updates the IPsec/IKE tunnel settings for Azure Virtual WAN pass-through tunnels. Azure requires IKE Version 2 (mandatory). Invalid ipSecSuiteB values default to 'none'; invalid ikePrf values default to 'auto'. Suite B algorithms require specific parameter combinations enforced by validation.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Body Params

Azure Virtual WAN tunnel configuration settings to save.

IPsec/IKE tunnel configuration settings for Zscaler Cloud Security integration. Defines cryptographic algorithms, timing parameters, and protocol options for secure tunnel establishment.

string
enum
required
Defaults to up

Administrative status of the tunnel interface. Controls whether the tunnel is operationally enabled.

Allowed:
string
enum
required
Defaults to ipsec_ip

Tunnel encapsulation mode. Specifies the passthrough tunnel protocol type.

Allowed:
boolean
required
Defaults to true

Enable automatic maximum bandwidth detection. When true, the system automatically determines optimal bandwidth limits.

string
enum
Defaults to none

IPsec Suite B cryptographic compliance level. Controls NSA Suite B algorithm requirements.

Allowed:
string

IKE pre-shared key for tunnel authentication. Must be configured to match the Zscaler portal settings.

string
enum
required
Defaults to sha256

IKE Phase 1 authentication (integrity) algorithm. Zscaler recommends sha256 for optimal security.

Allowed:
string
enum
required
Defaults to aes256

IKE Phase 1 encryption algorithm. Zscaler recommends aes256 for secure key exchange.

Allowed:
string
enum
Defaults to auto

IKE Pseudo-Random Function algorithm. Used for key derivation in IKEv2.

Allowed:
string
enum
required
Defaults to 2

Diffie-Hellman group for IKE key exchange. Group 2 (1024-bit MODP) is the Zscaler default.

integer
required
≥ 0
Defaults to 1440

IKE Phase 1 SA lifetime in minutes. Determines how often IKE keys are renegotiated.

integer
required
≥ 0
Defaults to 10

Dead Peer Detection (DPD) delay interval in seconds. Time between DPD keepalive messages.

integer
required
≥ 0
Defaults to 3

Dead Peer Detection retry count. Number of failed DPD probes before declaring peer dead.

string
enum
Defaults to ufqdn

IKE identifier type for tunnel authentication. Zscaler uses ufqdn (user FQDN/email) format.

Allowed:
string

IKE identifier string value. The actual identifier matching the idType (e.g., email address for ufqdn).

string
enum
required
Defaults to aggressive

IKE Phase 1 exchange mode. Aggressive mode is faster but less secure than main mode.

Allowed:
integer
enum
required
Defaults to 2

IKE protocol version. IKEv2 is recommended for improved security and performance.

Allowed:
string

Template format for generating local IKE identifier. Supports variables like %hostname%, %label%.

string

Template format for expected remote IKE identifier. Used for peer identity validation.

string
enum
required
Defaults to sha256

IPsec Phase 2 authentication (integrity) algorithm. Zscaler recommends sha256.

Allowed:
string
enum
required
Defaults to null

IPsec Phase 2 encryption algorithm. Zscaler default is null (no encryption) when GRE encapsulation provides security.

Allowed:
string
enum
required
Defaults to 1024

IPsec anti-replay protection window size. Prevents packet replay attacks; 1024 is recommended.

Allowed:
int64
required
≥ 0
Defaults to 0

IPsec SA lifetime in megabytes. 0 means unlimited data volume before rekeying.

integer
required
≥ 0
Defaults to 480

IPsec Phase 2 SA lifetime in minutes. Determines how often IPsec keys are renegotiated.

boolean
required
Defaults to false

Enable Perfect Forward Secrecy. When false, Phase 2 keys derive from Phase 1 keys.

string
enum
required
Defaults to 14

Perfect Forward Secrecy Diffie-Hellman group. Only used when pfs is enabled.

Responses
200

Successfully saved Azure Virtual WAN tunnel settings. Configuration is persisted and will be applied to future Azure Virtual WAN connections.

401

Unauthorized - User not authenticated or session expired. Re-authenticate to obtain a valid session.

403

Forbidden - User lacks READ_WRITE permission for third-party services configuration.

500

Internal server error - Failed to save tunnel settings to storage. Check server logs for details.

Updated about 13 hours ago

Did this page help you?
Language
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
text/plain

Updated about 13 hours ago

Did this page help you?