Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Routeros Provider
  3. API Docs
  4. IpIpsecProfile
routeros 1.83.1 published on Monday, Apr 28, 2025 by terraform-routeros
terraform-routeros/terraform-provider-routeros

routeros.IpIpsecProfile

Explore with Pulumi AI

routeros logo
routeros 1.83.1 published on Monday, Apr 28, 2025 by terraform-routeros
terraform-routeros/terraform-provider-routeros

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as routeros from "@pulumi/routeros";

const test = new routeros.IpIpsecProfile("test", {
    dhGroups: [
        "ecp384",
        "ecp521",
    ],
    encAlgorithms: [
        "aes-192",
        "aes-256",
    ],
    hashAlgorithm: "sha256",
    natTraversal: false,
});

    import pulumi
import pulumi_routeros as routeros

test = routeros.IpIpsecProfile("test",
    dh_groups=[
        "ecp384",
        "ecp521",
    ],
    enc_algorithms=[
        "aes-192",
        "aes-256",
    ],
    hash_algorithm="sha256",
    nat_traversal=False)

    package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/routeros/routeros"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := routeros.NewIpIpsecProfile(ctx, "test", &routeros.IpIpsecProfileArgs{
			DhGroups: pulumi.StringArray{
				pulumi.String("ecp384"),
				pulumi.String("ecp521"),
			},
			EncAlgorithms: pulumi.StringArray{
				pulumi.String("aes-192"),
				pulumi.String("aes-256"),
			},
			HashAlgorithm: pulumi.String("sha256"),
			NatTraversal:  pulumi.Bool(false),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Routeros = Pulumi.Routeros;

return await Deployment.RunAsync(() => 
{
    var test = new Routeros.IpIpsecProfile("test", new()
    {
        DhGroups = new[]
        {
            "ecp384",
            "ecp521",
        },
        EncAlgorithms = new[]
        {
            "aes-192",
            "aes-256",
        },
        HashAlgorithm = "sha256",
        NatTraversal = false,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.routeros.IpIpsecProfile;
import com.pulumi.routeros.IpIpsecProfileArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var test = new IpIpsecProfile("test", IpIpsecProfileArgs.builder()
            .dhGroups(            
                "ecp384",
                "ecp521")
            .encAlgorithms(            
                "aes-192",
                "aes-256")
            .hashAlgorithm("sha256")
            .natTraversal(false)
            .build());

    }
}

    resources:
  test:
    type: routeros:IpIpsecProfile
    properties:
      dhGroups:
        - ecp384
        - ecp521
      encAlgorithms:
        - aes-192
        - aes-256
      hashAlgorithm: sha256
      natTraversal: false

    Create IpIpsecProfile Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new IpIpsecProfile(name: string, args?: IpIpsecProfileArgs, opts?: CustomResourceOptions);
    @overload
def IpIpsecProfile(resource_name: str,
                   args: Optional[IpIpsecProfileArgs] = None,
                   opts: Optional[ResourceOptions] = None)

@overload
def IpIpsecProfile(resource_name: str,
                   opts: Optional[ResourceOptions] = None,
                   ___id_: Optional[float] = None,
                   ___path_: Optional[str] = None,
                   dh_groups: Optional[Sequence[str]] = None,
                   dpd_interval: Optional[str] = None,
                   dpd_maximum_failures: Optional[float] = None,
                   enc_algorithms: Optional[Sequence[str]] = None,
                   hash_algorithm: Optional[str] = None,
                   ip_ipsec_profile_id: Optional[str] = None,
                   lifebytes: Optional[float] = None,
                   lifetime: Optional[str] = None,
                   name: Optional[str] = None,
                   nat_traversal: Optional[bool] = None,
                   prf_algorithm: Optional[str] = None,
                   proposal_check: Optional[str] = None)
    func NewIpIpsecProfile(ctx *Context, name string, args *IpIpsecProfileArgs, opts ...ResourceOption) (*IpIpsecProfile, error)
    public IpIpsecProfile(string name, IpIpsecProfileArgs? args = null, CustomResourceOptions? opts = null)
    public IpIpsecProfile(String name, IpIpsecProfileArgs args)
public IpIpsecProfile(String name, IpIpsecProfileArgs args, CustomResourceOptions options)

    type: routeros:IpIpsecProfile
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args IpIpsecProfileArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args IpIpsecProfileArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args IpIpsecProfileArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args IpIpsecProfileArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args IpIpsecProfileArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    IpIpsecProfile Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The IpIpsecProfile resource accepts the following input properties:

    DhGroups List<string>
    Diffie-Hellman group (cipher strength).
    DpdInterval string
    Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
    DpdMaximumFailures double
    Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
    EncAlgorithms List<string>
    List of encryption algorithms that will be used by the peer.
    HashAlgorithm string
    Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
    IpIpsecProfileId string
    Lifebytes double
    Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
    Lifetime string
    Phase 1 lifetime: specifies how long the SA will be valid.
    Name string
    NatTraversal bool
    Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
    PrfAlgorithm string
    ProposalCheck string
    Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

    • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.
    ___id_ double
    Resource ID type (.id / name). This is an internal service field, setting a value is not required.
    ___path_ string
    Resource path for CRUD operations. This is an internal service field, setting a value is not required.
    DhGroups []string
    Diffie-Hellman group (cipher strength).
    DpdInterval string
    Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
    DpdMaximumFailures float64
    Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
    EncAlgorithms []string
    List of encryption algorithms that will be used by the peer.
    HashAlgorithm string
    Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
    IpIpsecProfileId string
    Lifebytes float64
    Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
    Lifetime string
    Phase 1 lifetime: specifies how long the SA will be valid.
    Name string
    NatTraversal bool
    Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
    PrfAlgorithm string
    ProposalCheck string
    Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

    • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.
    ___id_ float64
    Resource ID type (.id / name). This is an internal service field, setting a value is not required.
    ___path_ string
    Resource path for CRUD operations. This is an internal service field, setting a value is not required.
    ___id_ Double
    Resource ID type (.id / name). This is an internal service field, setting a value is not required.
    ___path_ String
    Resource path for CRUD operations. This is an internal service field, setting a value is not required.
    dhGroups List<String>
    Diffie-Hellman group (cipher strength).
    dpdInterval String
    Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
    dpdMaximumFailures Double
    Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
    encAlgorithms List<String>
    List of encryption algorithms that will be used by the peer.
    hashAlgorithm String
    Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
    ipIpsecProfileId String
    lifebytes Double
    Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
    lifetime String
    Phase 1 lifetime: specifies how long the SA will be valid.
    name String
    natTraversal Boolean
    Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
    prfAlgorithm String
    proposalCheck String
    Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

    • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.
    ___id_ number
    Resource ID type (.id / name). This is an internal service field, setting a value is not required.
    ___path_ string
    Resource path for CRUD operations. This is an internal service field, setting a value is not required.
    dhGroups string[]
    Diffie-Hellman group (cipher strength).
    dpdInterval string
    Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
    dpdMaximumFailures number
    Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
    encAlgorithms string[]
    List of encryption algorithms that will be used by the peer.
    hashAlgorithm string
    Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
    ipIpsecProfileId string
    lifebytes number
    Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
    lifetime string
    Phase 1 lifetime: specifies how long the SA will be valid.
    name string
    natTraversal boolean
    Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
    prfAlgorithm string
    proposalCheck string
    Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

    • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.
    ___id_ float
    Resource ID type (.id / name). This is an internal service field, setting a value is not required.
    ___path_ str
    Resource path for CRUD operations. This is an internal service field, setting a value is not required.
    dh_groups Sequence[str]
    Diffie-Hellman group (cipher strength).
    dpd_interval str
    Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
    dpd_maximum_failures float
    Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
    enc_algorithms Sequence[str]
    List of encryption algorithms that will be used by the peer.
    hash_algorithm str
    Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
    ip_ipsec_profile_id str
    lifebytes float
    Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
    lifetime str
    Phase 1 lifetime: specifies how long the SA will be valid.
    name str
    nat_traversal bool
    Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
    prf_algorithm str
    proposal_check str
    Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

    • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.
    ___id_ Number
    Resource ID type (.id / name). This is an internal service field, setting a value is not required.
    ___path_ String
    Resource path for CRUD operations. This is an internal service field, setting a value is not required.
    dhGroups List<String>
    Diffie-Hellman group (cipher strength).
    dpdInterval String
    Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
    dpdMaximumFailures Number
    Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
    encAlgorithms List<String>
    List of encryption algorithms that will be used by the peer.
    hashAlgorithm String
    Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
    ipIpsecProfileId String
    lifebytes Number
    Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
    lifetime String
    Phase 1 lifetime: specifies how long the SA will be valid.
    name String
    natTraversal Boolean
    Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
    prfAlgorithm String
    proposalCheck String
    Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

    • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the IpIpsecProfile resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing IpIpsecProfile Resource

    Get an existing IpIpsecProfile resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: IpIpsecProfileState, opts?: CustomResourceOptions): IpIpsecProfile
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        ___id_: Optional[float] = None,
        ___path_: Optional[str] = None,
        dh_groups: Optional[Sequence[str]] = None,
        dpd_interval: Optional[str] = None,
        dpd_maximum_failures: Optional[float] = None,
        enc_algorithms: Optional[Sequence[str]] = None,
        hash_algorithm: Optional[str] = None,
        ip_ipsec_profile_id: Optional[str] = None,
        lifebytes: Optional[float] = None,
        lifetime: Optional[str] = None,
        name: Optional[str] = None,
        nat_traversal: Optional[bool] = None,
        prf_algorithm: Optional[str] = None,
        proposal_check: Optional[str] = None) -> IpIpsecProfile
    func GetIpIpsecProfile(ctx *Context, name string, id IDInput, state *IpIpsecProfileState, opts ...ResourceOption) (*IpIpsecProfile, error)
    public static IpIpsecProfile Get(string name, Input<string> id, IpIpsecProfileState? state, CustomResourceOptions? opts = null)
    public static IpIpsecProfile get(String name, Output<String> id, IpIpsecProfileState state, CustomResourceOptions options)
    resources:  _:    type: routeros:IpIpsecProfile    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    DhGroups List<string>
    Diffie-Hellman group (cipher strength).
    DpdInterval string
    Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
    DpdMaximumFailures double
    Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
    EncAlgorithms List<string>
    List of encryption algorithms that will be used by the peer.
    HashAlgorithm string
    Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
    IpIpsecProfileId string
    Lifebytes double
    Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
    Lifetime string
    Phase 1 lifetime: specifies how long the SA will be valid.
    Name string
    NatTraversal bool
    Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
    PrfAlgorithm string
    ProposalCheck string
    Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

    • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.
    ___id_ double
    Resource ID type (.id / name). This is an internal service field, setting a value is not required.
    ___path_ string
    Resource path for CRUD operations. This is an internal service field, setting a value is not required.
    DhGroups []string
    Diffie-Hellman group (cipher strength).
    DpdInterval string
    Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
    DpdMaximumFailures float64
    Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
    EncAlgorithms []string
    List of encryption algorithms that will be used by the peer.
    HashAlgorithm string
    Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
    IpIpsecProfileId string
    Lifebytes float64
    Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
    Lifetime string
    Phase 1 lifetime: specifies how long the SA will be valid.
    Name string
    NatTraversal bool
    Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
    PrfAlgorithm string
    ProposalCheck string
    Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

    • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.
    ___id_ float64
    Resource ID type (.id / name). This is an internal service field, setting a value is not required.
    ___path_ string
    Resource path for CRUD operations. This is an internal service field, setting a value is not required.
    ___id_ Double
    Resource ID type (.id / name). This is an internal service field, setting a value is not required.
    ___path_ String
    Resource path for CRUD operations. This is an internal service field, setting a value is not required.
    dhGroups List<String>
    Diffie-Hellman group (cipher strength).
    dpdInterval String
    Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
    dpdMaximumFailures Double
    Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
    encAlgorithms List<String>
    List of encryption algorithms that will be used by the peer.
    hashAlgorithm String
    Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
    ipIpsecProfileId String
    lifebytes Double
    Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
    lifetime String
    Phase 1 lifetime: specifies how long the SA will be valid.
    name String
    natTraversal Boolean
    Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
    prfAlgorithm String
    proposalCheck String
    Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

    • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.
    ___id_ number
    Resource ID type (.id / name). This is an internal service field, setting a value is not required.
    ___path_ string
    Resource path for CRUD operations. This is an internal service field, setting a value is not required.
    dhGroups string[]
    Diffie-Hellman group (cipher strength).
    dpdInterval string
    Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
    dpdMaximumFailures number
    Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
    encAlgorithms string[]
    List of encryption algorithms that will be used by the peer.
    hashAlgorithm string
    Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
    ipIpsecProfileId string
    lifebytes number
    Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
    lifetime string
    Phase 1 lifetime: specifies how long the SA will be valid.
    name string
    natTraversal boolean
    Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
    prfAlgorithm string
    proposalCheck string
    Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

    • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.
    ___id_ float
    Resource ID type (.id / name). This is an internal service field, setting a value is not required.
    ___path_ str
    Resource path for CRUD operations. This is an internal service field, setting a value is not required.
    dh_groups Sequence[str]
    Diffie-Hellman group (cipher strength).
    dpd_interval str
    Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
    dpd_maximum_failures float
    Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
    enc_algorithms Sequence[str]
    List of encryption algorithms that will be used by the peer.
    hash_algorithm str
    Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
    ip_ipsec_profile_id str
    lifebytes float
    Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
    lifetime str
    Phase 1 lifetime: specifies how long the SA will be valid.
    name str
    nat_traversal bool
    Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
    prf_algorithm str
    proposal_check str
    Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

    • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.
    ___id_ Number
    Resource ID type (.id / name). This is an internal service field, setting a value is not required.
    ___path_ String
    Resource path for CRUD operations. This is an internal service field, setting a value is not required.
    dhGroups List<String>
    Diffie-Hellman group (cipher strength).
    dpdInterval String
    Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
    dpdMaximumFailures Number
    Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
    encAlgorithms List<String>
    List of encryption algorithms that will be used by the peer.
    hashAlgorithm String
    Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
    ipIpsecProfileId String
    lifebytes Number
    Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
    lifetime String
    Phase 1 lifetime: specifies how long the SA will be valid.
    name String
    natTraversal Boolean
    Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
    prfAlgorithm String
    proposalCheck String
    Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

    • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.

    Import

    #The ID can be found via API or the terminal

    #The command for the terminal is -> :put [/ip/ipsec/profile get [print show-ids]]

    $ pulumi import routeros:index/ipIpsecProfile:IpIpsecProfile test *3

    #Or you can import a resource using one of its attributes

    $ pulumi import routeros:index/ipIpsecProfile:IpIpsecProfile test "name=test-profile"

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    routeros terraform-routeros/terraform-provider-routeros
    License
    Notes
    This Pulumi package is based on the routeros Terraform Provider.
    routeros logo
    routeros 1.83.1 published on Monday, Apr 28, 2025 by terraform-routeros
    terraform-routeros/terraform-provider-routeros