azurermVpnServerConfiguration

Manages a VPN Server Configuration.

Example Usage

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as azurerm from "./.gen/providers/azurerm";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: azurerm.
For a more precise conversion please use the --provider flag in convert.*/
const azurermResourceGroupExample = new azurerm.resourceGroup.ResourceGroup(
  this,
  "example",
  {
    location: "West Europe",
    name: "example-resources",
  }
);
new azurerm.vpnServerConfiguration.VpnServerConfiguration(this, "test", {
  client_root_certificate: [
    {
      name: "DigiCert-Federated-ID-Root-CA",
      public_cert_data:
        "MIIDuzCCAqOgAwIBAgIQCHTZWCM+IlfFIRXIvyKSrjANBgkqhkiG9w0BAQsFADBn\nMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3\nd3cuZGlnaWNlcnQuY29tMSYwJAYDVQQDEx1EaWdpQ2VydCBGZWRlcmF0ZWQgSUQg\nUm9vdCBDQTAeFw0xMzAxMTUxMjAwMDBaFw0zMzAxMTUxMjAwMDBaMGcxCzAJBgNV\nBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdp\nY2VydC5jb20xJjAkBgNVBAMTHURpZ2lDZXJ0IEZlZGVyYXRlZCBJRCBSb290IENB\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvAEB4pcCqnNNOWE6Ur5j\nQPUH+1y1F9KdHTRSza6k5iDlXq1kGS1qAkuKtw9JsiNRrjltmFnzMZRBbX8Tlfl8\nzAhBmb6dDduDGED01kBsTkgywYPxXVTKec0WxYEEF0oMn4wSYNl0lt2eJAKHXjNf\nGTwiibdP8CUR2ghSM2sUTI8Nt1Omfc4SMHhGhYD64uJMbX98THQ/4LMGuYegou+d\nGTiahfHtjn7AboSEknwAMJHCh5RlYZZ6B1O4QbKJ+34Q0eKgnI3X6Vc9u0zf6DH8\nDk+4zQDYRRTqTnVO3VT8jzqDlCRuNtq6YvryOWN74/dq8LQhUnXHvFyrsdMaE1X2\nDwIDAQABo2MwYTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNV\nHQ4EFgQUGRdkFnbGt1EWjKwbUne+5OaZvRYwHwYDVR0jBBgwFoAUGRdkFnbGt1EW\njKwbUne+5OaZvRYwDQYJKoZIhvcNAQELBQADggEBAHcqsHkrjpESqfuVTRiptJfP\n9JbdtWqRTmOf6uJi2c8YVqI6XlKXsD8C1dUUaaHKLUJzvKiazibVuBwMIT84AyqR\nQELn3e0BtgEymEygMU569b01ZPxoFSnNXc7qDZBDef8WfqAV/sxkTi8L9BkmFYfL\nuGLOhRJOFprPdoDIUBB+tmCl3oDcBy3vnUeOEioz8zAkprcb3GHwHAK+vHmmfgcn\nWsfMLH4JCLa/tRYL+Rw/N3ybCkDp00s0WUZ+AoDywSl0Q/ZEnNY0MsFiw6LyIdbq\nM/s/1JRtO3bDSzD9TazRVzn2oBqzSa8VgIo5C1nOnoAKJTlsClJKvIhnRlaLQqk=\n",
    },
  ],
  location: azurermResourceGroupExample.location,
  name: "example-config",
  resource_group_name: azurermResourceGroupExample.name,
  vpn_authentication_types: ["Certificate"],
});

Argument Reference

The following arguments are supported:

name - (Required) The Name which should be used for this VPN Server Configuration. Changing this forces a new resource to be created.
resourceGroupName - (Required) The Name of the Resource Group in which this VPN Server Configuration should be created. Changing this forces a new resource to be created.
location - (Required) The Azure location where this VPN Server Configuration should be created. Changing this forces a new resource to be created.
vpnAuthenticationTypes - (Required) A list of Authentication Types applicable for this VPN Server Configuration. Possible values are aad (Azure Active Directory), certificate and radius.

ipsecPolicy - (Optional) A ipsecPolicy block as defined below.
vpnProtocols - (Optional) A list of VPN Protocols to use for this Server Configuration. Possible values are ikeV2 and openVpn.
tags - (Optional) A mapping of tags to assign to the resource.

When vpnAuthenticationTypes contains aad the following arguments are supported:

azureActiveDirectoryAuthentication - (Required) A azureActiveDirectoryAuthentication block as defined below.

When vpnAuthenticationTypes contains certificate the following arguments are supported:

clientRootCertificate - (Required) One or more clientRootCertificate blocks as defined below.
clientRevokedCertificate - (Optional) One or more clientRevokedCertificate blocks as defined below.

When vpnAuthenticationTypes contains radius the following arguments are supported:

radiusServer - (Optional / Deprecated) A radiusServer block as defined below.
radius - (Optional) A radius block as defined below.

A azureActiveDirectoryAuthentication block supports the following:

audience - (Required) The Audience which should be used for authentication.
issuer - (Required) The Issuer which should be used for authentication.
tenant - (Required) The Tenant which should be used for authentication.

A clientRevokedCertificate block supports the following:

name - (Required) A name used to uniquely identify this certificate.
thumbprint - (Required) The Thumbprint of the Certificate.

A clientRootCertificate block at the root of the resource supports the following:

name - (Required) A name used to uniquely identify this certificate.
publicCertData - (Required) The Public Key Data associated with the Certificate.

A clientRootCertificate block nested within the radiusServer block supports the following:

name - (Required) A name used to uniquely identify this certificate.
thumbprint - (Required) The Thumbprint of the Certificate.

A ipsecPolicy block supports the following:

dhGroup - (Required) The DH Group, used in IKE Phase 1. Possible values include dhGroup1, dhGroup2, dhGroup14, dhGroup24, dhGroup2048, ecp256, ecp384 and none.
ikeEncryption - (Required) The IKE encryption algorithm, used for IKE Phase 2. Possible values include aes128, aes192, aes256, des, des3, gcmaes128 and gcmaes256.
ikeIntegrity - (Required) The IKE encryption integrity algorithm, used for IKE Phase 2. Possible values include gcmaes128, gcmaes256, md5, sha1, sha256 and sha384.
ipsecEncryption - (Required) The IPSec encryption algorithm, used for IKE phase 1. Possible values include aes128, aes192, aes256, des, des3, gcmaes128, gcmaes192, gcmaes256 and none.
ipsecIntegrity - (Required) The IPSec integrity algorithm, used for IKE phase 1. Possible values include gcmaes128, gcmaes192, gcmaes256, md5, sha1 and sha256.
pfsGroup - (Required) The Pfs Group, used in IKE Phase 2. Possible values include ecp256, ecp384, pfs1, pfs2, pfs14, pfs24, pfs2048, pfsmm and none.
saLifetimeSeconds - (Required) The IPSec Security Association lifetime in seconds for a Site-to-Site VPN tunnel.
saDataSizeKilobytes - (Required) The IPSec Security Association payload size in KB for a Site-to-Site VPN tunnel.

A radiusServer (Deprecated) block is Used to configure single Radius Server. The block supports the following:

address - (Required) The Address of the Radius Server.
secret - (Required) The Secret used to communicate with the Radius Server.
clientRootCertificate - (Optional) One or more clientRootCertificate blocks as defined above.
serverRootCertificate - (Required) One or more serverRootCertificate blocks as defined below.

A radius block supports the following:

server - (Required) One or more server blocks as defined below.
clientRootCertificate - (Optional) One or more clientRootCertificate blocks as defined above.
serverRootCertificate - (Optional) One or more serverRootCertificate blocks as defined below.

A server nested within the radius block supports the following::

address - (Required) The Address of the Radius Server.
secret - (Required) The Secret used to communicate with the Radius Server.
score - (Required) The Score of the Radius Server determines the priority of the server. Ranges from 1 to 30.

A serverRootCertificate block supports the following:

name - (Required) A name used to uniquely identify this certificate.
publicCertData - (Required) The Public Key Data associated with the Certificate.

Attributes Reference

In addition to the arguments above, the following attributes are exported:

id - The ID of the VPN Server Configuration.

Timeouts

The timeouts block allows you to specify timeouts for certain actions:

create - (Defaults to 90 minutes) Used when creating the VPN Server Configuration.
update - (Defaults to 90 minutes) Used when updating the VPN Server Configuration.
read - (Defaults to 5 minutes) Used when retrieving the VPN Server Configuration.
delete - (Defaults to 90 minutes) Used when deleting the VPN Server Configuration.

Import

VPN Server Configurations can be imported using the resourceId, e.g.

terraform import azurerm_vpn_server_configuration.config1 /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/group1/providers/Microsoft.Network/vpnServerConfigurations/config1