HomeGuidesAPI Reference
API Reference
GuidesAPI ReferenceGitHubAirheads Developer Community
  1. Orchestrator REST APIs
  2. thirdPartyServices

Update tunnel settings for a Service Provider

post
http://127.0.0.1:8080/thirdPartyServices/serviceOrchestration/tunnelSetting

Updates IPsec tunnel settings for a Service Provider. Validates settings against the oldest appliance version in the network for Suite B compliance. Invalid ipSecSuiteB values are auto-corrected to 'none', and invalid ikePrf values are auto-corrected to 'auto'. The ikeIdFormat and remoteIkeIdFormat fields must not exceed 64 bytes when encoded as UTF-8.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Query Params
integer
required

Unique identifier of the Service Provider. Must be a valid integer corresponding to an existing service provider entry.

Body Params

IPsec tunnel configuration settings to apply for the Service Provider. All IKE and IPsec parameters must be consistent with the selected ipSecSuiteB value when Suite B compliance is required.

IPsec/IKE tunnel configuration settings for Zscaler Cloud Security integration. Defines cryptographic algorithms, timing parameters, and protocol options for secure tunnel establishment.

string
enum
required
Defaults to up

Administrative status of the tunnel interface. Controls whether the tunnel is operationally enabled.

Allowed:
string
enum
required
Defaults to ipsec_ip

Tunnel encapsulation mode. Specifies the passthrough tunnel protocol type.

Allowed:
boolean
required
Defaults to true

Enable automatic maximum bandwidth detection. When true, the system automatically determines optimal bandwidth limits.

string
enum
Defaults to none

IPsec Suite B cryptographic compliance level. Controls NSA Suite B algorithm requirements.

Allowed:
string

IKE pre-shared key for tunnel authentication. Must be configured to match the Zscaler portal settings.

string
enum
required
Defaults to sha256

IKE Phase 1 authentication (integrity) algorithm. Zscaler recommends sha256 for optimal security.

Allowed:
string
enum
required
Defaults to aes256

IKE Phase 1 encryption algorithm. Zscaler recommends aes256 for secure key exchange.

Allowed:
string
enum
Defaults to auto

IKE Pseudo-Random Function algorithm. Used for key derivation in IKEv2.

Allowed:
string
enum
required
Defaults to 2

Diffie-Hellman group for IKE key exchange. Group 2 (1024-bit MODP) is the Zscaler default.

integer
required
≥ 0
Defaults to 1440

IKE Phase 1 SA lifetime in minutes. Determines how often IKE keys are renegotiated.

integer
required
≥ 0
Defaults to 10

Dead Peer Detection (DPD) delay interval in seconds. Time between DPD keepalive messages.

integer
required
≥ 0
Defaults to 3

Dead Peer Detection retry count. Number of failed DPD probes before declaring peer dead.

string
enum
Defaults to ufqdn

IKE identifier type for tunnel authentication. Zscaler uses ufqdn (user FQDN/email) format.

Allowed:
string

IKE identifier string value. The actual identifier matching the idType (e.g., email address for ufqdn).

string
enum
required
Defaults to aggressive

IKE Phase 1 exchange mode. Aggressive mode is faster but less secure than main mode.

Allowed:
integer
enum
required
Defaults to 2

IKE protocol version. IKEv2 is recommended for improved security and performance.

Allowed:
string

Template format for generating local IKE identifier. Supports variables like %hostname%, %label%.

string

Template format for expected remote IKE identifier. Used for peer identity validation.

string
enum
required
Defaults to sha256

IPsec Phase 2 authentication (integrity) algorithm. Zscaler recommends sha256.

Allowed:
string
enum
required
Defaults to null

IPsec Phase 2 encryption algorithm. Zscaler default is null (no encryption) when GRE encapsulation provides security.

Allowed:
string
enum
required
Defaults to 1024

IPsec anti-replay protection window size. Prevents packet replay attacks; 1024 is recommended.

Allowed:
int64
required
≥ 0
Defaults to 0

IPsec SA lifetime in megabytes. 0 means unlimited data volume before rekeying.

integer
required
≥ 0
Defaults to 480

IPsec Phase 2 SA lifetime in minutes. Determines how often IPsec keys are renegotiated.

boolean
required
Defaults to false

Enable Perfect Forward Secrecy. When false, Phase 2 keys derive from Phase 1 keys.

string
enum
required
Defaults to 14

Perfect Forward Secrecy Diffie-Hellman group. Only used when pfs is enabled.

Responses
200

Successfully updated tunnel settings for the Service Provider. Settings are applied to associated appliances during orchestration.

Updated about 11 hours ago

Did this page help you?
Language
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
text/plain

Updated about 11 hours ago

Did this page help you?