Edit, disable, and delete VPN objects
Change a site connection's settings, disable, enable, or restart its tunnel, edit shared VPN objects, and delete connections and the objects they use.
Change a site connection's settings, control its tunnel, edit the shared VPN objects, and delete what you no longer need.
Before you begin
- You need the Owner or Contributor role, or a custom role with Manage access to Networking, on the subscription or on the project. Any role with Read access to Networking can view VPN objects. With the Reader role, the console shows "Your role is read-only — ask an owner to grant write access." on the actions.
- An object whose last operation is still running refuses another change until the operation finishes. Its provisioning status is pending until then.
Open a site connection
In the console, go to NetworkingVPN.
On the Site connections tab, select the connection.
The connection's page has the actions Enable, Disable, Restart, Refresh, and Delete, and the tabs Overview, Configuration, and Activity. The Activity tab lists the connection's recent operations, with the reason of any that failed.
Change a site connection
On the connection's page, select the Configuration tab.
Change the name, the description, Pre-shared key, Initiator, the dead peer detection settings, or MTU.
Select Save. To discard your changes instead, select Reset.
- Leave the pre-shared key empty to keep the current one — it is never read back from the provider. A new key needs at least 8 characters, and changing it renegotiates the tunnel.
- To change the peer address, create a new connection and delete the old one.
- Save is available when the name and the peer gateway address are set, the interval is at least 1, the timeout at least 2, the MTU at least 68, and a new key, if you entered one, has at least 8 characters. It's unavailable while the connection's last operation is still running. The platform also refuses a timeout that isn't greater than the interval, and an MTU above the deployment's tenant network MTU.
- Under Fixed at creation, the tab shows the VPN service, the two policies, and the two endpoint groups, which can't be changed. To use other objects, create a new site connection and delete this one.
When the platform accepts the change, the console shows Changes saved and returns to the Overview tab. The connection shows a pending status until the change is applied. For each field's rules, see Site connections.
Disable, enable, or restart a tunnel
| Action | Available when | What happens |
|---|---|---|
| Enable | The connection is disabled. | The connection is enabled, and the tunnel negotiates again. |
| Disable | The connection is enabled. | The IPsec tunnel is torn down and stays down until the connection is enabled again. Traffic to the peer network stops at both ends. |
| Restart | The connection is enabled. | The tunnel is dropped and renegotiated. Traffic to the peer network stops until the new security association comes up. |
| Refresh | Always, with the Owner or Contributor role, or a custom role with Manage access to Networking. | The page reloads the connection's record. See Statuses. |
On the connection's page, select Enable, Disable, or Restart.
For Disable and Restart, confirm in the dialog.
If an action is unavailable, see A tunnel action is unavailable.
Change a VPN service, policy, or endpoint group
Under NetworkingVPN, open the VPN services, IKE policies, IPsec policies, or Endpoint groups tab.
Select the object. Its details open with the fields you can change.
Change the fields, and select Save.
| Object | What you can change | What's fixed |
|---|---|---|
| VPN service | Name and description, also while site connections use it. | The router cannot be changed after the service is created. |
| IKE or IPsec policy | Every field, but only while no site connection uses the policy. | While the policy is in use: This policy is referenced by 1 site connection, so the platform refuses every change to it. Delete the connections that use it, or create a new policy instead. |
| Endpoint group | Name and description, also while site connections use it. | The type and the endpoints can't be changed. To cover other subnets, create a new group and a new site connection. |
When the platform accepts the change, the console shows a confirmation such as Saved hq-ike. The object shows a pending status until the change is applied.
Delete a site connection
Caution
Deleting a site connection can't be undone. The tunnel is torn down, and traffic to the remote network stops.
On the connection's page, select Delete. In the list, you can also select Delete in the row's menu.
In the confirmation, select Delete.
- A site connection can be deleted in any state, also while its last operation is still running.
- The VPN service, the policies, and the endpoint groups that it used are kept. Their Used by count drops by one.
- Billing for the connection ends when the deletion completes. See Billing.
- If you canceled the creation of a connection, the delete action is labeled Clean up.
Delete a VPN service, policy, or endpoint group
An object can't be deleted while site connections refer to it. Its Used by count shows how many do, and the count includes connections in Error. To delete a whole tunnel, delete the site connection first, and then the objects that nothing else uses.
Open the object's tab, and check that its Used by count is 0.
In the object's row menu, select Delete.
In the confirmation, select Delete. The object is removed from the cloud. This cannot be undone.
If Delete is unavailable or the platform refuses the deletion, see A change or deletion is refused.
Result
Every change and deletion runs as an asynchronous operation, and the object shows a pending provisioning status until the operation finishes. For a deletion, and for Enable, Disable, and Restart, the console reports the result when the operation finishes. For an edit, it confirms that the platform accepted the change. If the provider refuses the change, the object goes to Error, and its details show What the provider reported with the reason. For the statuses, see Statuses.
Troubleshooting
For refused changes and deletions, and for actions that are unavailable, see Troubleshoot site connections.