Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Routeros Provider
  3. API Docs
  4. IpIpsecProfile
routeros 1.83.0 published on Wednesday, Apr 16, 2025 by terraform-routeros
terraform-routeros/terraform-provider-routeros

routeros.IpIpsecProfile

Explore with Pulumi AI

routeros 1.83.0 published on Wednesday, Apr 16, 2025 by terraform-routeros
terraform-routeros/terraform-provider-routeros

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as routeros from "@pulumi/routeros";

const test = new routeros.IpIpsecProfile("test", {
    dhGroups: [
        "ecp384",
        "ecp521",
    ],
    encAlgorithms: [
        "aes-192",
        "aes-256",
    ],
    hashAlgorithm: "sha256",
    natTraversal: false,
});
Copy
import pulumi
import pulumi_routeros as routeros

test = routeros.IpIpsecProfile("test",
    dh_groups=[
        "ecp384",
        "ecp521",
    ],
    enc_algorithms=[
        "aes-192",
        "aes-256",
    ],
    hash_algorithm="sha256",
    nat_traversal=False)
Copy
package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/routeros/routeros"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := routeros.NewIpIpsecProfile(ctx, "test", &routeros.IpIpsecProfileArgs{
			DhGroups: pulumi.StringArray{
				pulumi.String("ecp384"),
				pulumi.String("ecp521"),
			},
			EncAlgorithms: pulumi.StringArray{
				pulumi.String("aes-192"),
				pulumi.String("aes-256"),
			},
			HashAlgorithm: pulumi.String("sha256"),
			NatTraversal:  pulumi.Bool(false),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Copy
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Routeros = Pulumi.Routeros;

return await Deployment.RunAsync(() => 
{
    var test = new Routeros.IpIpsecProfile("test", new()
    {
        DhGroups = new[]
        {
            "ecp384",
            "ecp521",
        },
        EncAlgorithms = new[]
        {
            "aes-192",
            "aes-256",
        },
        HashAlgorithm = "sha256",
        NatTraversal = false,
    });

});
Copy
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.routeros.IpIpsecProfile;
import com.pulumi.routeros.IpIpsecProfileArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var test = new IpIpsecProfile("test", IpIpsecProfileArgs.builder()
            .dhGroups(            
                "ecp384",
                "ecp521")
            .encAlgorithms(            
                "aes-192",
                "aes-256")
            .hashAlgorithm("sha256")
            .natTraversal(false)
            .build());

    }
}
Copy
resources:
  test:
    type: routeros:IpIpsecProfile
    properties:
      dhGroups:
        - ecp384
        - ecp521
      encAlgorithms:
        - aes-192
        - aes-256
      hashAlgorithm: sha256
      natTraversal: false
Copy

Create IpIpsecProfile Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new IpIpsecProfile(name: string, args?: IpIpsecProfileArgs, opts?: CustomResourceOptions);
@overload
def IpIpsecProfile(resource_name: str,
                   args: Optional[IpIpsecProfileArgs] = None,
                   opts: Optional[ResourceOptions] = None)

@overload
def IpIpsecProfile(resource_name: str,
                   opts: Optional[ResourceOptions] = None,
                   ___id_: Optional[float] = None,
                   ___path_: Optional[str] = None,
                   dh_groups: Optional[Sequence[str]] = None,
                   dpd_interval: Optional[str] = None,
                   dpd_maximum_failures: Optional[float] = None,
                   enc_algorithms: Optional[Sequence[str]] = None,
                   hash_algorithm: Optional[str] = None,
                   ip_ipsec_profile_id: Optional[str] = None,
                   lifebytes: Optional[float] = None,
                   lifetime: Optional[str] = None,
                   name: Optional[str] = None,
                   nat_traversal: Optional[bool] = None,
                   prf_algorithm: Optional[str] = None,
                   proposal_check: Optional[str] = None)
func NewIpIpsecProfile(ctx *Context, name string, args *IpIpsecProfileArgs, opts ...ResourceOption) (*IpIpsecProfile, error)
public IpIpsecProfile(string name, IpIpsecProfileArgs? args = null, CustomResourceOptions? opts = null)
public IpIpsecProfile(String name, IpIpsecProfileArgs args)
public IpIpsecProfile(String name, IpIpsecProfileArgs args, CustomResourceOptions options)

type: routeros:IpIpsecProfile
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name This property is required. string
The unique name of the resource.
args IpIpsecProfileArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name This property is required. str
The unique name of the resource.
args IpIpsecProfileArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name This property is required. string
The unique name of the resource.
args IpIpsecProfileArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name This property is required. string
The unique name of the resource.
args IpIpsecProfileArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name This property is required. String
The unique name of the resource.
args This property is required. IpIpsecProfileArgs
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

IpIpsecProfile Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The IpIpsecProfile resource accepts the following input properties:

DhGroups List<string>
Diffie-Hellman group (cipher strength).
DpdInterval string
Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
DpdMaximumFailures double
Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
EncAlgorithms List<string>
List of encryption algorithms that will be used by the peer.
HashAlgorithm string
Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
IpIpsecProfileId string
Lifebytes double
Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
Lifetime string
Phase 1 lifetime: specifies how long the SA will be valid.
Name string
NatTraversal bool
Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
PrfAlgorithm string
ProposalCheck string
Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

  • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.
___id_ double
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
DhGroups []string
Diffie-Hellman group (cipher strength).
DpdInterval string
Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
DpdMaximumFailures float64
Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
EncAlgorithms []string
List of encryption algorithms that will be used by the peer.
HashAlgorithm string
Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
IpIpsecProfileId string
Lifebytes float64
Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
Lifetime string
Phase 1 lifetime: specifies how long the SA will be valid.
Name string
NatTraversal bool
Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
PrfAlgorithm string
ProposalCheck string
Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

  • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.
___id_ float64
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___id_ Double
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
dhGroups List<String>
Diffie-Hellman group (cipher strength).
dpdInterval String
Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
dpdMaximumFailures Double
Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
encAlgorithms List<String>
List of encryption algorithms that will be used by the peer.
hashAlgorithm String
Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
ipIpsecProfileId String
lifebytes Double
Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
lifetime String
Phase 1 lifetime: specifies how long the SA will be valid.
name String
natTraversal Boolean
Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
prfAlgorithm String
proposalCheck String
Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

  • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.
___id_ number
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
dhGroups string[]
Diffie-Hellman group (cipher strength).
dpdInterval string
Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
dpdMaximumFailures number
Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
encAlgorithms string[]
List of encryption algorithms that will be used by the peer.
hashAlgorithm string
Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
ipIpsecProfileId string
lifebytes number
Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
lifetime string
Phase 1 lifetime: specifies how long the SA will be valid.
name string
natTraversal boolean
Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
prfAlgorithm string
proposalCheck string
Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

  • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.
___id_ float
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ str
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
dh_groups Sequence[str]
Diffie-Hellman group (cipher strength).
dpd_interval str
Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
dpd_maximum_failures float
Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
enc_algorithms Sequence[str]
List of encryption algorithms that will be used by the peer.
hash_algorithm str
Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
ip_ipsec_profile_id str
lifebytes float
Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
lifetime str
Phase 1 lifetime: specifies how long the SA will be valid.
name str
nat_traversal bool
Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
prf_algorithm str
proposal_check str
Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

  • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.
___id_ Number
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
dhGroups List<String>
Diffie-Hellman group (cipher strength).
dpdInterval String
Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
dpdMaximumFailures Number
Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
encAlgorithms List<String>
List of encryption algorithms that will be used by the peer.
hashAlgorithm String
Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
ipIpsecProfileId String
lifebytes Number
Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
lifetime String
Phase 1 lifetime: specifies how long the SA will be valid.
name String
natTraversal Boolean
Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
prfAlgorithm String
proposalCheck String
Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

  • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.

Outputs

All input properties are implicitly available as output properties. Additionally, the IpIpsecProfile resource produces the following output properties:

Id string
The provider-assigned unique ID for this managed resource.
Id string
The provider-assigned unique ID for this managed resource.
id String
The provider-assigned unique ID for this managed resource.
id string
The provider-assigned unique ID for this managed resource.
id str
The provider-assigned unique ID for this managed resource.
id String
The provider-assigned unique ID for this managed resource.

Look up Existing IpIpsecProfile Resource

Get an existing IpIpsecProfile resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: IpIpsecProfileState, opts?: CustomResourceOptions): IpIpsecProfile
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        ___id_: Optional[float] = None,
        ___path_: Optional[str] = None,
        dh_groups: Optional[Sequence[str]] = None,
        dpd_interval: Optional[str] = None,
        dpd_maximum_failures: Optional[float] = None,
        enc_algorithms: Optional[Sequence[str]] = None,
        hash_algorithm: Optional[str] = None,
        ip_ipsec_profile_id: Optional[str] = None,
        lifebytes: Optional[float] = None,
        lifetime: Optional[str] = None,
        name: Optional[str] = None,
        nat_traversal: Optional[bool] = None,
        prf_algorithm: Optional[str] = None,
        proposal_check: Optional[str] = None) -> IpIpsecProfile
func GetIpIpsecProfile(ctx *Context, name string, id IDInput, state *IpIpsecProfileState, opts ...ResourceOption) (*IpIpsecProfile, error)
public static IpIpsecProfile Get(string name, Input<string> id, IpIpsecProfileState? state, CustomResourceOptions? opts = null)
public static IpIpsecProfile get(String name, Output<String> id, IpIpsecProfileState state, CustomResourceOptions options)
resources:  _:    type: routeros:IpIpsecProfile    get:      id: ${id}
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
The following state arguments are supported:
DhGroups List<string>
Diffie-Hellman group (cipher strength).
DpdInterval string
Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
DpdMaximumFailures double
Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
EncAlgorithms List<string>
List of encryption algorithms that will be used by the peer.
HashAlgorithm string
Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
IpIpsecProfileId string
Lifebytes double
Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
Lifetime string
Phase 1 lifetime: specifies how long the SA will be valid.
Name string
NatTraversal bool
Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
PrfAlgorithm string
ProposalCheck string
Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

  • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.
___id_ double
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
DhGroups []string
Diffie-Hellman group (cipher strength).
DpdInterval string
Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
DpdMaximumFailures float64
Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
EncAlgorithms []string
List of encryption algorithms that will be used by the peer.
HashAlgorithm string
Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
IpIpsecProfileId string
Lifebytes float64
Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
Lifetime string
Phase 1 lifetime: specifies how long the SA will be valid.
Name string
NatTraversal bool
Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
PrfAlgorithm string
ProposalCheck string
Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

  • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.
___id_ float64
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
___id_ Double
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
dhGroups List<String>
Diffie-Hellman group (cipher strength).
dpdInterval String
Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
dpdMaximumFailures Double
Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
encAlgorithms List<String>
List of encryption algorithms that will be used by the peer.
hashAlgorithm String
Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
ipIpsecProfileId String
lifebytes Double
Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
lifetime String
Phase 1 lifetime: specifies how long the SA will be valid.
name String
natTraversal Boolean
Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
prfAlgorithm String
proposalCheck String
Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

  • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.
___id_ number
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ string
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
dhGroups string[]
Diffie-Hellman group (cipher strength).
dpdInterval string
Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
dpdMaximumFailures number
Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
encAlgorithms string[]
List of encryption algorithms that will be used by the peer.
hashAlgorithm string
Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
ipIpsecProfileId string
lifebytes number
Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
lifetime string
Phase 1 lifetime: specifies how long the SA will be valid.
name string
natTraversal boolean
Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
prfAlgorithm string
proposalCheck string
Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

  • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.
___id_ float
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ str
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
dh_groups Sequence[str]
Diffie-Hellman group (cipher strength).
dpd_interval str
Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
dpd_maximum_failures float
Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
enc_algorithms Sequence[str]
List of encryption algorithms that will be used by the peer.
hash_algorithm str
Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
ip_ipsec_profile_id str
lifebytes float
Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
lifetime str
Phase 1 lifetime: specifies how long the SA will be valid.
name str
nat_traversal bool
Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
prf_algorithm str
proposal_check str
Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

  • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.
___id_ Number
Resource ID type (.id / name). This is an internal service field, setting a value is not required.
___path_ String
Resource path for CRUD operations. This is an internal service field, setting a value is not required.
dhGroups List<String>
Diffie-Hellman group (cipher strength).
dpdInterval String
Dead peer detection interval. If set to disable-dpd, dead peer detection will not be used.
dpdMaximumFailures Number
Maximum count of failures until peer is considered to be dead. Applicable if DPD is enabled.
encAlgorithms List<String>
List of encryption algorithms that will be used by the peer.
hashAlgorithm String
Hashing algorithm. SHA (Secure Hash Algorithm) is stronger, but slower. MD5 uses 128-bit key, sha1-160bit key.
ipIpsecProfileId String
lifebytes Number
Phase 1 lifebytes is used only as administrative value which is added to proposal. Used in cases if remote peer requires specific lifebytes value to establish phase 1.
lifetime String
Phase 1 lifetime: specifies how long the SA will be valid.
name String
natTraversal Boolean
Use Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that made ESP incompatible with NAT.
prfAlgorithm String
proposalCheck String
Phase 2 lifetime check logic: * claim - take shortest of proposed and configured lifetimes and notify initiator about it

  • exact - require lifetimes to be the same * obey - accept whatever is sent by an initiator * strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.

Import

#The ID can be found via API or the terminal

#The command for the terminal is -> :put [/ip/ipsec/profile get [print show-ids]]

$ pulumi import routeros:index/ipIpsecProfile:IpIpsecProfile test *3
Copy

#Or you can import a resource using one of its attributes

$ pulumi import routeros:index/ipIpsecProfile:IpIpsecProfile test "name=test-profile"
Copy

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository
routeros terraform-routeros/terraform-provider-routeros
License
Notes
This Pulumi package is based on the routeros Terraform Provider.
routeros 1.83.0 published on Wednesday, Apr 16, 2025 by terraform-routeros
terraform-routeros/terraform-provider-routeros