# Create CE Tunnel - CreateCETunnel

## Overview

Create CE Tunnel






## Definition

### Public Parameters

| Parameter Name | Type | Description Information | Required |
|:---|:---|:---|:---|
| **Action**     | string  | Corresponding API command name, the current API is `CreateCETunnel`.                      | **Yes** |
| **PublicKey**  | string  | The user's public key can be obtained from [Console](https://console.ckcloudai.com/uaccount/api_manage)                                             | **Yes** |
| **Signature**  | string  | User signature generated based on public key and API command, see [Signature Algorithm](/docs/api/summary/signature.md)  | **Yes** |

### Request Parameters

| Parameter Name | Type | Description Information | Required |
|:---|:---|:---|:---|
| **Region** | string | Region. See [Region and Zone List](/docs/api/summary/regionlist) |No|
| **Zone** | string | Zone. See [Region and Zone List](/docs/api/summary/regionlist) |No|
| **ProjectId** | string | Project ID. Leave it blank for the default project. Sub-accounts must fill in. Please refer to the [GetProjectList API](/docs/api/summary/get_project_list) |No|
| **VPNId** | string | CE gateway resource ID |**Yes**|
| **IKEConf.PreSharedKey** | string | IKE preshared key |**Yes**|
| **IKEConf.Version** | string | IKE version, take values: "ike v1", "ike v2" |**Yes**|
| **IKEConf.ExchangeMode** | string | IKE negotiation mode, main mode/aggressive mode. This parameter is not used in IKE V2. |**Yes**|
| **IKEConf.EncryptionAlgorithm** | string | IKE encryption algorithm, with possible values: "aes128", "aes192", "aes256", "aes512", "3des". |**Yes**|
| **IKEConf.AuthenticationAlgorithm** | string | IKE 认证算法，取值："md5", "sha1", "sha2-256" |**Yes**|
| **IKEConf.DhGroup** | string | DH group: Specifies the DH group used when exchanging keys with IKE. Values: "1", "2", "5", "14", "15", "16" |**Yes**|
| **IKEConf.LocalId** | string | Local identifier, with values: "auto" or "<ip-address>". |**Yes**|
| **IKEConf.RemoteId** | string | Remote identifier, with values: "auto" or "<ip-address>". |**Yes**|
| **IKEConf.SALifeTime** | string | IKE SA lifetime (in sec). Value range: 600-604800 |**Yes**|
| **IPSecConf.CENetwork.N** | string | The CIDR block on the data center side. This CIDR block is used in Phase 2 negotiations. |**Yes**|
| **IPSecConf.Protocol** | string | IPSec security protocol, values: "esp", "ah". |**Yes**|
| **IPSecConf.EncryptionAlgorithm** | string | The encryption algorithm that is used in Phase 2 negotiations. Valid values: aes, aes192, aes256, aes512, and 3des.（This value should be left blank when the security protocol is AH.） |**Yes**|
| **IPSecConf.AuthenticationAlgorithm** | string | The authentication algorithm that is used in Phase 2 negotiations. Valid values: md5, sha1, sha2-256.  |**Yes**|
| **IPSecConf.PFSDhGroup** | string | The Diffie-Hellman key exchange algorithm used in the second phase negotiation. Valid values:disabled、1、2、5、14、15、16. |**Yes**|
| **IPSecConf.SALifeTime** | string | The SA lifetime determined by Phase 2 negotiations. Unit: seconds. Valid values: 0 to 604800. |**Yes**|
| **IPSecConf.SALifetimeBytes** | string | The lifespan of the SA negotiated in the second phase. Unit: bytes (KB). Value range: 8000 – 20000000, default is the SALifeTime. |No|
| **CloseAction** | string | Actions after IPSec is disabled, enumerated values: restart, trap, none |**Yes**|
| **DPDConf.Enabled** | int | Enables/disables DPD (Peer Survival Detection). Values: 0 (Off), 1 (On) |**Yes**|
| **DPDConf.Action** | string | The action after a DPD timeout is effective when Enable is set to 1 (enabled). Possible values ​​are clear (disconnect), restart (retry), and trap (traffic-triggered). |No|
| **DPDConf.Delay** | int | DPD detection interval. Effective when dpdEnable is 1 (enabled). Unit is seconds, default is 10. |No|
| **DPDConf.Timeout** | int | DPD timeout. This is the time required to confirm the non-existence of the peer. Effective when dpdEnable is 1 (enabled). Unit is seconds. Value range is 30-60 (IKEv2 default is 0). |No|
| **Mode** | string | Routing mode, enumeration values: Flow、BGP |**Yes**|
| **BGPConf.TunnelCidr** | string | The CIDR block of the IPsec tunnel. The CIDR block must fall into 169.254.0.0/16 and the mask of the CIDR block must be 30 bits in length |No|
| **BGPConf.LocalAsn** | string | The ASN on the UCloud side. |No|
| **BGPConf.PeerAsn** | string | Peer BGP ASN number。 |No|
| **BGPConf.LocalIp** | string |  The BGP address on the UCloud side |No|
| **BGPConf.PeerIp** | string |  The BGP address on the CE side |No|
| **Name** | string | Resource name |No|
| **Remark** | string | Remark |No|

### Response Field

| Field Name | Type | Description Information | Required |
|:---|:---|:---|:---|
| **RetCode** | int | Return status code. If it is 0, it means successful return. If it is not 0, it means failure. |**Yes**|
| **Action** | string | Operation command name. |**Yes**|
| **Message** | string | Returns an error message, providing detailed description when `RetCode` is non-zero. |No|
| **VPNTunnelId** | string | VPN tunnel ID |**Yes**|




## Example

### Request Example
    
```
https://api.ckcloudai.com/?Action=CreateCETunnel
&Region=cn-zj
&Zone=cn-zj-01
&ProjectId=xSoaIKsJ
&VPNId=JhVdNQeQ
&IKEConf=usryUfSh
&IPSecConf=SjGpehyQ
&CloseAction=EMZCQOrh
&Name=vcivVuzG
&Remark=hwrnKXCX
&Mode=AlzyMkdg
&BGPConf=KokkBSCN
&DPDConf=toXwElzL
&IKEConf.Version=PjaZGnso
&IKEConf.ExchangeMode=iBYxZZIW
&IKEConf.EncryptionAlgorithm=iOeWjfYp
&IKEConf.AuthenticationAlgorithm=lskvPTRb
&IKEConf.DhGroup=zrezBbHT
&IKEConf.LocalId=oxCCnpqx
&IKEConf.RemoteId=brHEtpKM
&IKEConf.SALifeTime=wEHYDHmM
&IPSecConf.Protocol=bBsvzCyG
&IPSecConf.EncryptionAlgorithm=IpRaEzFh
&IPSecConf.AuthenticationAlgorithm=LxnxPVgH
&IPSecConf.PFSDhGroup=bATPVzoV
&IPSecConf.SALifeTime=MOTyUFGM
&IPSecConf.SALifetimeBytes=dOzYnWmp
&BGPConf.TunnelCidr=nqVRLSCg
&BGPConf.LocalAsn=YlpiiflJ
&BGPConf.PeerAsn=zLhVUWvm
&BGPConf.LocalIp=HlOvHeHu
&BGPConf.PeerIp=WzfVtTmh
&DPDConf.Enabled=6
&DPDConf.Action=Robhjgjd
&DPDConf.Delay=3
&DPDConf.Timeout=6
```

### Response Example
    
```json
{
  "Action": "CreateCETunnelResponse",
  "Message": "wbNHiKXA",
  "RetCode": 0,
  "VPNTunnelId": "qPTrrvmQ"
}
```