Branch Office VPNs (BOVPNs) API

A Branch Office Virtual Private Network (BOVPN) enables secure, encrypted connections between networks at geographically separated locations. You can configure an IPSec BOVPN tunnel between cloud-managed Fireboxes in your WatchGuard Cloud account or from a cloud-managed Firebox to any other Firebox or third-party VPN endpoint. For more information, go to Manage BOVPNs for Cloud-Managed Fireboxes.

BOVPN API operations work only with cloud‑managed Fireboxes that store configuration in WatchGuard Cloud. They do not work with locally‑managed Fireboxes, including those with WatchGuard Cloud reporting, because these devices store no configuration in WatchGuard Cloud. The API returns an empty response for locally‑managed Fireboxes.

This API does not automatically deploy BOVPN configuration changes to the Firebox. To apply these changes, you must manually deploy them from the WatchGuard Cloud UI or through a separate public API call. For more information, go to Deployments.

You can use the Firebox Management API to:

Get a BOVPN Tunnel
Create a BOVPN Tunnel
Edit a BOVPN Tunnel
Modify Routes and Certificates
Delete a BOVPN Tunnel
Manage Shared Phase 1 Settings

Endpoints:

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels/{objectid}

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels/{objectid}

/{v1}/configuration/{accountid}/bovpn/ipsec/p1_shared_settings

Get a BOVPN Tunnel

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels?device={device}

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels/{objectid}

Make a request to this endpoint to retrieve information about BOVPN tunnels. You can retrieve BOVPN tunnels for a specific account, device, or tunnel ID. The information you must provide in the request depends on the BOVPN tunnels you want to retrieve:

Retrieve a list of all BOVPN tunnels for a WatchGuard account

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels

Make a request to this endpoint to retrieve BOVPN tunnel information for a specific account.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can view your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Example Request

This example requests a list of the BOVPN tunnels for an account:

                    curl -X GET https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/ACC-1234567/bovpn/ipsec/tunnels
	-H 'Accept: application/json'
	-H 'Content-Type: application/json'
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXIn0.eyJzdWIiOiN0LTJfa3hXeFdfU650heiAaUAy7XmiqbA'

Retrieve a list of all BOVPN tunnels for a device

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels?device={device}

Make a request to this endpoint to retrieve BOVPN tunnel information for a specific Firebox.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can view your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Query Parameters

device
string
integer
REQUIRED

Each device has a unique ID in WatchGuard Cloud, which appears in the URL of the Device Summary page. The device ID can be a string or an integer for a standalone device. For example, if the Device Summary page URL is https://usa.cloud.watchguard.com/services/fb/device/FB-12345/summary, the device ID is FB-12345 or 12345.

Example: 12345

For FireClusters, specify the full device ID.

Example: FBCL-12345.

Example Request

This request retrieves the list of BOVPN tunnels for a device.

                    
curl -X GET https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/ACC-1234567/bovpn/ipsec/tunnels?device=12345
	-H 'Accept: application/json'
	-H 'Content-Type: application/json'
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXIn0.eyJzdWIiOiN0LTJfa3hXeFdfU650heiAaUAy7XmiqbA'

Retrieve a specific BOVPN tunnel

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels/{objectid}

Make a request to this endpoint to retrieve information about a specific BOVPN tunnel.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can view your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid
string
REQUIRED

Each BOVPN tunnel has a unique ID in WatchGuard Cloud, which appears in the URL of the BOVPN configuration page.

For example, if the BOVPN configuration page URL is https://usa.cloud.watchguard.com/ss-tenant/services/ACC-1234567/fb/device/FB-12345/configuration/bovpn/tunnel/ipsgp_123456DH, the tunnel ID is ipsgp_123456DH.

Example: ipsgp_123456DH

Example Request

This request retrieves a specific BOVPN tunnel from a device.

                    
curl -X GET https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/ACC-1234567/bovpn/ipsec/tunnels/ipsgp_136162_2DPNyV3Tc4ZkpqK
	-H 'Accept: application/json'
	-H 'Content-Type: application/json'
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXIn0.eyJzdWIiOiN0LTJfa3hXeFdfU650heiAaUAy7XmiqbA'

Example Response

The response includes details of the requested BOVPN IPSec tunnels in JSON format:

                {
"id": "ipsgp_12345_ARBHLJ70Y78rGOIGBS",
"object": "ipsec_gatewaypair",
"version": 1,
"account": "WGC-1-123abc456",
"created": 1579907960,
"author": "testuser",
"name": "PBoVPN1",
"endpoint_a": "136162",
"endpoint_b_name": "CentralVPNServer",
"vpn_type": "route-based",
"address_family": 4,
"interfaces": [
	{
	"endpoint_a": {
		"network": "External"
	},
	"endpoint_b": {
		"id": {
			"type": "ip",
			"value": "192.88.99.200"
			}
		}
	}
],
"psk": "12345678",
"ipsec_tunnel_core": {
	"ike_proposals": [
	{
	"encryption": "AES-CBC-256",
	"dh_group": "DH-14",
	"lifetime": 24,
	"authentication": "SHA2-256"
	}
],
	"ipsec_proposals": [
		{
		"encryption": "AES-CBC-256",
		"lifetime": 8,
		"lifebyte": 0,
		"authentication": "SHA2-256"
	}
],
	"pfs_dh_group": "DH-14",
	"natt_interval": 20,
	"dpd": {
		"dpd_type": "traffic",
		"idle_time": 20,
		"retries": 5
	}
},
"routes": {
	"endpoint_a": {
		"local_routes": [
		{
		"metric": 1,
		"route": "192.168.1.0/24"
		}
	]
},
	"endpoint_b": {
		"local_routes": [
		{
		"metric": 6,
		"route": "192.168.100.0/24"
			}
		]
	}
},
	"vif": {
		"endpoint_a": {
			"vif_df_bit": "set",
			"vif_local_ip": "9.9.9.9/32",
			"vif_mtu": 1399,
			"vif_remote_ip": "10.10.10.10/32"
		},
		"endpoint_b": {
			"vif_local_ip": "10.10.10.10/32",
			"vif_remote_ip": "9.9.9.9/32"
		}
	}
}

This table shows and describes the data returned in the response:

id string	Unique ID of the IPSec gateway. Example: ipstp_12345_ARBHLJ70Y78rGOIGBS
object string	Type of object returned. Example: ipsec_gatewaytemplate
version integer	Version number of the BOVPN. Example: 1
account string	WatchGuard Cloud account ID associated with this gateway pair. Example: WGC-1-123abc456
created integer	Unix time stamp of when the gateway pair was created. Example: 1579907960
author string	Author of the object. Empty for objects added or updated with the Firebox Management API.
name string	Name of the gateway pair. Example: PBoVPN1
endpoint_a string	Name of the cloud-managed Firebox. Example: 12345
endpoint_b_name string	Name of the second Firebox. Example: CentralVPNServer
vpn_type string	VPN IPSec tunnel type. Must be either route‑based or policy‑based. Default is `route-based`. Example: route-based
address_family integer	IP address family for all gateway endpoints. Default is `4`. This can be one of these values: 4 (IPv4) 6 (IPv6) Example: 4
interfaces array	Array of interface endpoint mappings between endpoint A and endpoint B.
endpoint_a object	Defines the cloud-managed Firebox interface settings.
network string	Network definition for the tunnel. This can be one of these values: External Trusted Optional Example: External
endpoint_b object	Identifies the remote device or endpoint that the cloud-managed Firebox (`endpoint_a`) connects to.
id object	Unique ID for the IPSec gateway.
type string	Gateway endpoint ID type. Default is `ip`. This can be one of these values: ip — An IP address. fqdn — A fully qualified domain name. ufqdn — A user fully qualified domain name. x500_name — An X.500 distinguished name. Example: ip
value string	Specifies the identifier string (IP address, FQDN, user FQDN, or X.500 Distinguished Name). Depends on `type`. Example: 192.88.99.200
psk string	Pre-shared key (PSK) used for authentication between endpoints. Example: 24681012
ipsec_tunnel_core object	Phase 1 (IKE) and Phase 2 (IPSec) settings, Dead Peer Detection (DPD), and NAT-T keep-alive configurations for the tunnel.
ike_proposals array	Array of IKE Phase 1 proposals that define encryption and authentication settings for tunnel negotiation.
encryption string	Encryption algorithm. This can be one of these values: AES-CBC-128 AES-CBC-192 AES-CBC-256 (Default) AES-GCM-128 AES-GCM-192 AES-GCM-256 Example: AES-CBC-256
dh_group string	Diffie-Hellman group. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 DH-21 Example: DH-14
lifetime integer	Lifetime of the security association. Specify the number of hours or minutes. The minimum value is 1, and the default value is 24. Example: 24
lifetime_unit string	Specifies the time unit for the `lifetime` value. This can be one of these values: hours (Default) minutes Example: hours
authentication string	The hash algorithm to use to verify message integrity and authenticity. This can be one of these values: SHA2-256 (Default) SHA2-384 SHA2-512 Example: SHA2-256
pfs_dh_group string	Diffie-Hellman (DH) group used for Perfect Forward Secrecy (PFS) in Phase 2 of the VPN tunnel. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 DH-21 Example: DH-14
natt_interval integer	Keep-alive interval (in seconds). Specify a number of seconds from 1 through 65535. The default value is 20. Example: 20
dpd object	Dead Peer Detection settings used to detect if the remote peer is no longer responsive.
dpd_type string	Dead Peer Detection type. This can be one of these values: traffic — Default. Based on traffic activity. If no traffic is detected for a specified idle time, DPD messages are sent. timer — Sent at regular intervals, regardless of traffic. Example: traffic
idle_time integer	Amount of time (in seconds) before the peer is considered idle. Specify a number of seconds from 10-300. Default value is 30. Example: 20
retries integer	Number of retries to make before the peer is considered unreachable. Specify a number from 1-30. Default value is 5. Example: 5
routes object	Routes to establish through the tunnel.
endpoint_a object	Route object for the cloud-managed Firebox.
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 1
route string	Route to establish through the tunnel. Example: 192.168.1.0/24
endpoint_b object	Route object for the remote device or endpoint that the cloud-managed Firebox (`endpoint_a`) connects to.
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 1
route string	Route to establish through the tunnel. Example: 192.168.100.0/24
vif object	Virtual interface configuration for each VPN endpoint.
endpoint_a object	Route object for the cloud-managed Firebox.
vif_df_bit string	Specifies the DF (Don't Fragment) bit value. This can be one of these values: copy — Copies the DF bit from the original packet. set — Sets the DF bit to 1 (prevent fragmentation). clear — Clears the DF bit (allow fragmentation). Example: set
vif_local_ip string	Local IP address for the virtual interface used in the route-based VPN. Example: 9.9.9.9/32
vif_mtu integer	Maximum packet size (in bytes) that can be transmitted through the virtual interface without fragmentation. Can be an integer between 68 and 9000. Example: 1500
vif_remote_ip string	IP address of the virtual interface in a route-based VPN tunnel. Example: 10.10.10.10/32
endpoint_b object	Route object for the remote device or endpoint that the cloud-managed Firebox (`endpoint_a`) connects to.
vif_local_ip string	Local IP address for the virtual interface used in the route-based VPN. Example: 10.10.10.10/32
vif_remote_ip string	IP address of the virtual interface in a route-based VPN tunnel. Example: 9.9.9.9/32

Create a BOVPN Tunnel

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels

Make a request to this endpoint to configure a route-based or policy-based BOVPN IPSec tunnel between two devices. All tunnels require at least one cloud-managed Firebox endpoint.

Requests for policy-based and route-based BOVPNs have some differences. For policy-based BOVPNs, you must:

Set the value of the vpn_type parameter to policy-based.
Configure the routes section, and optionally use the local_remote_pairs section to control traffic direction.
Not submit request parameters in the vif section, which does not apply for policy-based BOVPNs.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid
string
REQUIRED

Your WatchGuard Cloud account ID. You can view your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

The information you must provide in the request body depends on the type of BOVPN configuration you want to add:

Configure a route-based BOVPN tunnel that uses a pre-shared key

Request Body

When you send a request to this endpoint, include this information in the request body:

name string REQUIRED	Name of the BOVPN tunnel. This can include only letters, numbers, spaces, parentheses "()", asterisks "*", periods ".", hyphens "-", and underscores "_". Maximum: 58 characters Example: PBoVPN1
endpoint_a string REQUIRED	Unique device ID for the cloud-managed Firebox. You can find the device ID in the URL of the Device Summary page. For example, if the Device Summary page URL is https://usa.cloud.watchguard.com/services/fb/device/FB-12345/summary, the device ID is 12345. For a FireCluster, use the FBCL prefix (FBCL-12345). Example: 12345
endpoint_b_name string	Name of the second Firebox. Example: CentralVPNServer
vpn_type string	VPN IPSec tunnel type. Must be either route‑based or policy‑based. Default is `route-based`. Example: route-based
address_family integer	IP address family for all gateway endpoints. Default is `4`. This can be one of these values: 4 (IPv4) 6 (IPv6) Example: 4
interfaces array REQUIRED	Array of interface endpoint mappings between endpoint A and endpoint B.
endpoint_a object	Route object for the device.
network string	Network definition for the tunnel. This can be one of these values: External Trusted Optional Example: External
endpoint_b object	Route object for the device that `endpoint_a` connects to.
id object	Unique ID for the IPSec gateway.
type string	Gateway endpoint ID type. Default is `ip`. This can be one of these values: ip — An IP address. fqdn — A fully qualified domain name. ufqdn — A user fully qualified domain name. x500_name — An X.500 distinguished name. Example: ip
value string	Specifies the identifier string (IP address, FQDN, user FQDN, or X.500 Distinguished Name). Depends on `type`. Example: 192.88.99.200
psk string	Pre-shared key (PSK) used for authentication between endpoints. Example: 12345678
ipsec_tunnel_core object	Phase 1 (IKE) and Phase 2 (IPSec) settings, Dead Peer Detection (DPD), and NAT-T keep-alive configurations for the tunnel.
ike_proposals array	Array of IKE Phase 1 proposals that define encryption and authentication settings for tunnel negotiation.
encryption string	Encryption algorithm. This can be one of these values: AES-CBC-128 AES-CBC-192 AES-CBC-256 (Default) AES-GCM-128 AES-GCM-192 AES-GCM-256 Example: AES-CBC-256
dh_group string	Diffie-Hellman group. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 Example: DH-14
lifetime integer	Lifetime of the security association. Specify the number of hours or minutes. The minimum value is 1, and the default value is 24. Example: 24
lifetime_unit string	Specifies the time unit for the `lifetime` value. This can be one of these values: hours (Default) minutes Example: hours
authentication string	The hash algorithm to use to verify message integrity and authenticity. This can be one of these values: SHA2-256 (Default) SHA2-384 SHA2-512 Example: SHA2-256
ipsec_proposals array	Array of IPSec Phase 2 proposals.
encryption string	Encryption algorithm. This can be one of these values: AES-CBC-128 AES-CBC-192 AES-CBC-256 (Default) AES-GCM-128 AES-GCM-192 AES-GCM-256 Example: AES-CBC-256
lifetime integer	Lifetime of the security association. Specify the number of hours or minutes. The minimum value is 1, and the default value is 8. Example: 8
lifetime_unit string	Specifies the time unit for the `lifetime` value. This can be one of these values: hours (Default) minutes Example: hours
lifebyte integer	Maximum amount of data (in bytes) that you can be transmit through an IPSec Security Association (SA) before it expires and must rekey. Example: 0
authentication string	The hash algorithm used to verify message integrity and authenticity. This can be one of these values: SHA2-256 (Default) SHA2-384 SHA2-512 Example: SHA2-256
pfs_dh_group string	Diffie-Hellman (DH) group used for Perfect Forward Secrecy (PFS) in Phase 2 of the VPN tunnel. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 DH-21 Example: DH-14
natt_interval integer	Keep-alive interval (in seconds). Specify a number of seconds from 1 through 65535. The default value is 20. Example: 20
dpd object	Dead Peer Detection settings used to detect if the remote peer is no longer responsive.
dpd_type string	Dead Peer Detection type. This can be one of these values: traffic — Default. Based on traffic activity. If no traffic is detected for a specified idle time, DPD messages are sent. timer — Sent at regular intervals, regardless of traffic. Example: traffic
idle_time integer	Amount of time (in seconds) before the peer is considered idle. Specify a number of seconds from 10-300. Default value is 30 Example: 20
retries integer	Number of retries to make before the peer is considered unreachable. Specify a number from 1-30. Default value is 5. Example: 5
routes object REQUIRED	Routes to establish through the tunnel.
endpoint_a object	Route object for the device.
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 1
route string	Route to establish through the tunnel. Example: 192.168.1.0/24
endpoint_b object	Route object for the device that `endpoint_a` connects to.
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 6
route string	Route to establish through the tunnel. Example: 192.168.100.0/24
vif object	Virtual interface configuration for each VPN endpoint.
endpoint_a object	Route object for the device.
vif_df_bit string	Specifies the DF bit value. This can be one of these values: copy — Copies the DF (Don't Fragment) bit from the original packet. set — Sets the DF bit to 1 (prevent fragmentation). clear — Clears the DF bit (allow fragmentation). Example: set
vif_local_ip string	Local IP address for the virtual interface used in the route-based VPN. Example: 9.9.9.9/32
vif_mtu integer	Maximum packet size (in bytes) that can be transmitted through the virtual interface without fragmentation. Can be an integer between 68 and 9000. Example: 1500
vif_remote_ip string	IP address of the virtual interface in a route-based VPN tunnel. Example: 10.10.10.10/32
endpoint_b object	Route object for the device that `endpoint_a` connects to.
vif_local_ip string	Local IP address for the virtual interface used in the route-based VPN. Example: 10.10.10.10/32
vif_remote_ip string	IP address of the virtual interface in a route-based VPN tunnel. Example: 9.9.9.9/32

Example Request

This request configures a route-based BOVPN tunnel that uses a pre-shared key.

                    curl -X POST https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/{accountid}/bovpn/ipsec/tunnels 
-H 'Accept: application/json'
-H 'Content-Type: application/json'
-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE5mM2FXTHhoSmEza0ltcEFMbnluT05DcFdIT2tZPSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiJjNDQyMTJlMi05MmI1LTRiOTYtYTRmNS1lYWRlODA4OTM1YjIiLCJjdXN0b206YXBpX2tleXMiOiJwMHM1UmQzUkF2NlR2d0VuWEx5YUphR2x0ZWtieEFVUzcwVGVzOXlGIiwiaXNzIjoiaHR0cHM6XC9cL2NvZ25pdG8taWRwLnVzLXdlc3QtMi5hbWF6b25hd3MuY29tXC91cy13ZXN0LTJfa3hXeFdrTFZ5IiwiY29nbml0bzp1c2VybmFtZSI6IjAyNjk0OWM1OWI2NzIxOGNfcndfaWQiLCJhdWQiOiIzb3AybDBqazkxN3FudXFoZnVoanRvcXRzZyIsImV2ZW50X2lkIjoiODczM2ZmMjktOGNhMC00ODMyLTg0NzgtMDNiNWIxMDI3NmQ3IiwidG9rZW5fdXNlIjoiaWQiLCJhdXRoX3RpbWUiOjE1NjkzNTM0NDEsIm5hbWUiOiIwMjY5NDljNTliNjcyMThjX3J3X2lkIiwiY3VzdG9tOmFjY291bnRfaWQiOiJBQ0MtMTIzNTA2OCIsImV4cCI6MTU2OTM1NzA0MSwiY3VzdG9tOnJvbGUiOiIxIiwiaWF0IjoxNTY5MzUzNDQxfQ.MUAeG6QyM7Zog8mM--WK2uJVevLRwz8z2KPpGhQbUnHK04Hy_JdO4F4wH6IV0WVENGsBrcjp5boxcBZgdJE46123MGnB0HvghN5IoAZUOkfFPm7SAN68posHqYLoo14YNedc5GtvOzCxTmi9YepvE5LhsoC6Tgyc0e3ABn18gEZsyxmJFcMBHXOMei7AssYSWAdDyoI7j6jZslxmhXj7_h6T9PyqjLxLjFEq5S6oK9u4IVDVBlRxbURaRVAGb7ywfHiZEPDgceV-Wnv0AIhDzj5dL28AmiGIkWtWinF0UD-NSMKN4vtszK2sUWUSl8ZfVNGU650heiAaUAy7XmiqbA'
-d '{
"example1": {
"summary": "Create an IPSEC tunnel using PSK",
"value": {
	"name": "PBoVPN1",
	"endpoint_a": "136162",
	"endpoint_b_name": "CentralVPNServer",
	"vpn_type": "route-based",
	"address_family": 4,
	"interfaces": [
	{
	"endpoint_a": {
		"network": "External"
	},
	"endpoint_b": {
		"id": {
			"type": "ip",
			"value": "192.88.99.200"
			}
		}
	}
	],
"psk": "12345678",
"ipsec_tunnel_core": {
	"ike_proposals": [
	{
	"encryption": "AES-CBC-256",
	"dh_group": "DH-14",
	"lifetime": 24,
	"authentication": "SHA2-256"
	}
	],
"ipsec_proposals": [
	{
	"encryption": "AES-CBC-256",
	"lifetime": 8,
	"lifebyte": 0,
	"authentication": "SHA2-256"
	}
	],
"pfs_dh_group": "DH-14",
"natt_interval": 20,
"dpd": {
	"dpd_type": "traffic",
	"idle_time": 20,
	"retries": 5
	}
},
"routes": {
	"endpoint_a": {
		"local_routes": [
		{
			"metric": 1,
			"route": "192.168.1.0/24"
			}
		]
	},
	"endpoint_b": {
		"local_routes": [
		{
			"metric": 6,
			"route": "192.168.100.0/24"
			}
		]
	}
},
"vif": {
	"endpoint_a": {
		"vif_df_bit": "set",
		"vif_local_ip": "9.9.9.9/32",
		"vif_mtu": 1399,
		"vif_remote_ip": "10.10.10.10/32"
		},
	"endpoint_b": {
		"vif_local_ip": "10.10.10.10/32",
		"vif_remote_ip": "9.9.9.9/32"
		}
		}
	},
}'

Configure a route-based BOVPN tunnel that uses a certificate

Request Body

When you send a request to this endpoint, include this information in the request body:

name string REQUIRED	Name of the BOVPN tunnel. This can include only letters, numbers, spaces, parentheses "()", asterisks "*", periods ".", hyphens "-", and underscores "_". Maximum: 58 characters. Example: PBoVPN1
endpoint_a string REQUIRED	Unique device ID for the cloud-managed Firebox. You can find the device ID in the URL of the Device Summary page. For example, if the Device Summary page URL is https://usa.cloud.watchguard.com/services/fb/device/FB-12345/summary, the device ID is 12345. For a FireCluster, use the FBCL prefix (FBCL-12345). Example: 12345
endpoint_b_name string	Name of the second Firebox. Example: CentralVPNServer
vpn_type string	VPN IPSec tunnel type. Must be either route‑based or policy‑based. Default is `route-based`. Example: route-based
address_family integer	IP address family for all gateway endpoints. Default is `4`. This can be one of these values: 4 (IPv4) 6 (IPv6) Example: 4
interfaces array REQUIRED	Array of interface endpoint mappings between endpoint A and endpoint B.
endpoint_a object	Route object for the device.
network string	Network definition for the tunnel. This can be one of these values: External Trusted Optional Example: External
endpoint_b object	Route object for the device that `endpoint_a` connects to.
id object	Unique ID for the IPSec gateway.
type string	Gateway endpoint ID type. This can be one of these values: ip — An address. fqdn — A fully qualified domain name. ufqdn — A user fully qualified domain name. x500_name — An X.500 distinguished name. Example: ip
value string	Specifies the identifier string (IP address, FQDN, user FQDN, or X.500 Distinguished Name). Depends on `type`. Example: 192.88.99.200
certs object	Object of certificate references.
endpoint_a string	Certificate ID for endpoint A. Example: DeviceCertificateNam
ipsec_tunnel_core object	Phase 1 (IKE) and Phase 2 (IPSec) settings, Dead Peer Detection (DPD), and NAT-T keep-alive configurations for the tunnel.
ike_proposals array	Array of IKE Phase 1 proposals that define encryption and authentication settings for tunnel negotiation.
encryption string	Encryption algorithm. This can be one of these values: AES-CBC-128 AES-CBC-192 AES-CBC-256 (Default) AES-GCM-128 AES-GCM-192 AES-GCM-256 Example: AES-CBC-256
dh_group string	Diffie-Hellman group. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 Example: DH-14
lifetime integer	Lifetime of the security association. Specify the number of hours or minutes. The minimum value is 1, and the default value is 24. Example: 24
lifetime_unit string	Specifies the time unit for the `lifetime` value. This can be one of these values: hours (Default) minutes Example: hours
authentication string	The hash algorithm to use to verify message integrity and authenticity. This can be one of these values: SHA2-256 (Default) SHA2-384 SHA2-512 Example: SHA2-256
ipsec_proposals array	Array of IPSec Phase 2 proposals.
encryption string	Encryption algorithm. This can be one of these values: AES-CBC-128 AES-CBC-192 AES-CBC-256 (Default) AES-GCM-128 AES-GCM-192 AES-GCM-256 Example: AES-CBC-256
lifetime integer	Lifetime of the security association. Specify the number of hours or minutes. The minimum value is 1, and the default value is 8. Example: 8
lifetime_unit string	Specifies the time unit for the `lifetime` value. This can be one of these values: hours (Default) minutes Example: hours
lifebyte integer	Maximum amount of data (in bytes) that you can be transmit through an IPSec Security Association (SA) before it expires and must rekey. Example: 0
authentication string	The hash algorithm used to verify message integrity and authenticity. This can be one of these values: SHA2-256 (Default) SHA2-384 SHA2-512 Example: SHA2-256
pfs_dh_group string	Diffie-Hellman (DH) group used for Perfect Forward Secrecy (PFS) in Phase 2 of the VPN tunnel. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 DH-21 Example: DH-14
natt_interval integer	Keep-alive interval (in seconds). Specify a number of seconds from 1 through 65535. The default value is 20. Example: 20
dpd object	Dead Peer Detection settings used to detect if the remote peer is no longer responsive.
dpd_type string	Dead Peer Detection type. This can be one of these values: traffic — Default. Based on traffic activity. If no traffic is detected for a specified idle time, DPD messages are sent. timer — Sent at regular intervals, regardless of traffic. Example: traffic
idle_time integer	Amount of time (in seconds) before the peer is considered idle. Specify a number of seconds from 10-300. Default value is 30 Example: 20
retries integer	Number of retries to make before the peer is considered unreachable. Specify a number from 1-30. Default value is 5. Example: 5
routes object REQUIRED	Routes to establish through the tunnel.
endpoint_a object	Route object for the device.
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 1
route string	Route to establish through the tunnel. Example: 192.168.1.0/24
endpoint_b object	Route object for the device that `endpoint_a` connects to.
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 6
route string	Route to establish through the tunnel. Example: 192.168.100.0/24
vif object	Virtual interface configuration for each VPN endpoint.
endpoint_a object	Route object for the device.
vif_df_bit string	Specifies the DF bit value. This can be one of these values: copy — Copies the DF (Don't Fragment) bit from the original packet. set — Sets the DF bit to 1 (prevent fragmentation). clear — Clears the DF bit (allow fragmentation). Example: set
vif_local_ip string	Local IP address for the virtual interface used in the route-based VPN. Example: 9.9.9.9/32
vif_mtu integer	Maximum packet size (in bytes) that can be transmitted through the virtual interface without fragmentation. Can be an integer between 68 and 9000. Example: 1500
vif_remote_ip string	IP address of the virtual interface in a route-based VPN tunnel. Example: 10.10.10.10/32
endpoint_b object	Route object for the device that `endpoint_a` connects to.
vif_local_ip string	Local IP address for the virtual interface used in the route-based VPN. Example: 10.10.10.10/32
vif_remote_ip string	IP address of the virtual interface in a route-based VPN tunnel. Example: 9.9.9.9/32

Example Request

This request configures a route-based BOVPN tunnel that uses a certificate.

                    curl -X POST https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/{accountid}/bovpn/ipsec/tunnels 
-H 'Accept: application/json'
-H 'Content-Type: application/json'
-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE5mM2FXTHhoSmEza0ltcEFMbnluT05DcFdIT2tZPSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiJjNDQyMTJlMi05MmI1LTRiOTYtYTRmNS1lYWRlODA4OTM1YjIiLCJjdXN0b206YXBpX2tleXMiOiJwMHM1UmQzUkF2NlR2d0VuWEx5YUphR2x0ZWtieEFVUzcwVGVzOXlGIiwiaXNzIjoiaHR0cHM6XC9cL2NvZ25pdG8taWRwLnVzLXdlc3QtMi5hbWF6b25hd3MuY29tXC91cy13ZXN0LTJfa3hXeFdrTFZ5IiwiY29nbml0bzp1c2VybmFtZSI6IjAyNjk0OWM1OWI2NzIxOGNfcndfaWQiLCJhdWQiOiIzb3AybDBqazkxN3FudXFoZnVoanRvcXRzZyIsImV2ZW50X2lkIjoiODczM2ZmMjktOGNhMC00ODMyLTg0NzgtMDNiNWIxMDI3NmQ3IiwidG9rZW5fdXNlIjoiaWQiLCJhdXRoX3RpbWUiOjE1NjkzNTM0NDEsIm5hbWUiOiIwMjY5NDljNTliNjcyMThjX3J3X2lkIiwiY3VzdG9tOmFjY291bnRfaWQiOiJBQ0MtMTIzNTA2OCIsImV4cCI6MTU2OTM1NzA0MSwiY3VzdG9tOnJvbGUiOiIxIiwiaWF0IjoxNTY5MzUzNDQxfQ.MUAeG6QyM7Zog8mM--WK2uJVevLRwz8z2KPpGhQbUnHK04Hy_JdO4F4wH6IV0WVENGsBrcjp5boxcBZgdJE46123MGnB0HvghN5IoAZUOkfFPm7SAN68posHqYLoo14YNedc5GtvOzCxTmi9YepvE5LhsoC6Tgyc0e3ABn18gEZsyxmJFcMBHXOMei7AssYSWAdDyoI7j6jZslxmhXj7_h6T9PyqjLxLjFEq5S6oK9u4IVDVBlRxbURaRVAGb7ywfHiZEPDgceV-Wnv0AIhDzj5dL28AmiGIkWtWinF0UD-NSMKN4vtszK2sUWUSl8ZfVNGU650heiAaUAy7XmiqbA'
-d '{
"example2": {
"summary": "Create an IPSEC tunnel using a certificate.",
"value": {
	"name": "PBoVPN1",
	"endpoint_a": "136162",
	"endpoint_b_name": "CentralVPNServer",
	"vpn_type": "route-based",
	"address_family": 4,
	"interfaces": [
		{
		"endpoint_a": {
			"network": "External"
			},
		"endpoint_b": {
			"id": {
			"type": "ip",
			"value": "192.88.99.200"
				}
			}
		}
	],
	"certs": [
		{
		"endpoint_a": "DeviceCertificateName"
		}
	],
	"ipsec_tunnel_core": {
		"ike_proposals": [
		{
		"encryption": "AES-CBC-256",
		"dh_group": "DH-14",
		"lifetime": 24,
		"authentication": "SHA2-256"
		}
		],
	"ipsec_proposals": [
		{
		"encryption": "AES-CBC-256",
		"lifetime": 8,
		"lifebyte": 0,
		"authentication": "SHA2-256"
		}
		],
	"pfs_dh_group": "DH-14",
	"natt_interval": 20,
	"dpd": {
		"dpd_type": "traffic",
		"idle_time": 20,
		"retries": 5
		}
		},
	"routes": {
		"endpoint_a": {
			"local_routes": [
			{
			"metric": 1,
			"route": "192.168.1.0/24"
			}
		]
		},
		"endpoint_b": {
			"local_routes": [
			{
			"metric": 6,
			"route": "192.168.100.0/24"
			}
			]
		}
		},
	"vif": {
		"endpoint_a": {
			"vif_df_bit": "set",
			"vif_local_ip": "9.9.9.9/32",
			"vif_mtu": 1399,
			"vif_remote_ip": "10.10.10.10/32"
			},
		"endpoint_b": {
			"vif_local_ip": "10.10.10.10/32",
			"vif_remote_ip": "9.9.9.9/32"
			}
		}
	}
	}
}'

Example Response

This response includes the route-based BOVPN tunnel that uses a pre-shared key in JSON format:

                {
"id": "ipsgp_12345_ARBHLJ70Y78rGOIGBS",
"object": "ipsec_gatewaypair",
"version": 1,
"account": "WGC-1-123abc456",
"created": 1579907960,
"author": "testuser",
"name": "PBoVPN1",
"endpoint_a": "136162",
"endpoint_b_name": "CentralVPNServer",
"vpn_type": "route-based",
"address_family": 4,
"interfaces": [
	{
	"endpoint_a": {
		"network": "External"
		},
	"endpoint_b": {
		"id": {
		"type": "ip",
		"value": "192.88.99.200"
		}
	}
	}
],
"psk": "12345678",
"ipsec_tunnel_core": {
	"ike_proposals": [
	{
	"encryption": "AES-CBC-256",
	"dh_group": "DH-14",
	"lifetime": 24,
	"authentication": "SHA2-256"
	}
],
"ipsec_proposals": [
	{
	"encryption": "AES-CBC-256",
	"lifetime": 8,
	"lifebyte": 0,
	"authentication": "SHA2-256"
	}
	],
"pfs_dh_group": "DH-14",
"natt_interval": 20,
"dpd": {
	"dpd_type": "traffic",
	"idle_time": 20,
	"retries": 5
	}
},
"routes": {
	"endpoint_a": {
		"local_routes": [
			{
			"metric": 1,
			"route": "192.168.1.0/24"
		}
	]
},
	"endpoint_b": {
		"local_routes": [
			{
			"metric": 6,
			"route": "192.168.100.0/24"
			}
		]
	}
},
"vif": {
	"endpoint_a": {
		"vif_df_bit": "set",
		"vif_local_ip": "9.9.9.9/32",
		"vif_mtu": 1399,
		"vif_remote_ip": "10.10.10.10/32"
	},
	"endpoint_b": {
		"vif_local_ip": "10.10.10.10/32",
		"vif_remote_ip": "9.9.9.9/32"
	}
	}
}

This table lists and describes the data returned in the response:

id string	Unique ID of the IPSec gateway. Example: ipstp_12345_ARBHLJ70Y78rGOIGBS
object string	Type of object returned. Example: ipsec_gatewaytemplate
version integer	Version number of the BOVPN. Example: 1
account string	WatchGuard Cloud account ID associated with this gateway pair. Example: WGC-1-123abc456
created integer	Unix time stamp when the gateway pair was created. Example: 1579907960
author string	Author of the gateway pair. Example: YourName
name string	Name for the gateway pair. Example: PBoVPN1
endpoint_a string	Name of the cloud-managed Firebox. Example: 136162
endpoint_b_name string	Name of the second Firebox. Example: CentralVPNServer
vpn_type string	VPN IPSec tunnel type. Must be either route‑based or policy‑based. Default is `route-based`. Example: route-based
address_family integer	IP address family for all gateway endpoints. Default is `4`. This can be one of these values: 4 (IPv4) 6 (IPv6) Example: 4
interfaces array	Array of interface endpoint mappings between endpoint A and endpoint B.
endpoint_a object	Route object for the device.
network string	Network definition for the tunnel. This can be one of these values: External Trusted Optional Example: External
endpoint_b object	Route object for the remote device or endpoint that `endpoint_a` connects to.
id object	Unique ID for the IPSec gateway.
type string	Gateway endpoint ID type. This can be one of these values: ip — An address. fqdn — A fully qualified domain name. ufqdn — A user fully qualified domain name. x500_name — An X.500 distinguished name. Example: ip
value string	Specifies the identifier string (IP address, FQDN, user FQDN, or X.500 Distinguished Name). Depends on `type`. Example: 192.88.99.200
psk string	Pre-shared key (PSK) used for authentication between endpoints. Example: 12345678
ipsec_tunnel_core object	Phase 1 (IKE) and Phase 2 (IPSec) settings, Dead Peer Detection (DPD), and NAT-T keep-alive configurations for the tunnel.
ike_proposals array	Array of IKE Phase 1 proposals that define encryption and authentication settings for tunnel negotiation.
encryption string	Encryption algorithm. This can be one of these values: AES-CBC-128 AES-CBC-192 AES-CBC-256 (Default) AES-GCM-128 AES-GCM-192 AES-GCM-256 Example: AES-CBC-256
dh_group string	Diffie-Hellman group. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 DH-21 Example: DH-14
lifetime integer	Lifetime of the security association. Specify the number of hours or minutes. The minimum value is 1, and the default value is 24. Example: 24
lifetime_unit string	Specifies the time unit for the `lifetime` value. This can be one of these values: hours (Default) minutes Example: hours
authentication string	The hash algorithm to use to verify message integrity and authenticity. This can be one of these values: SHA2-256 (Default) SHA2-384 SHA2-512 Example: SHA2-256
ipsec_proposals array	Array of IPSec Phase 2 proposals.
encryption string	Encryption algorithm. This can be one of these values: AES-CBC-128 AES-CBC-192 AES-CBC-256 (Default) AES-GCM-128 AES-GCM-192 Example: AES-GCM-256
lifetime integer	Lifetime of the security association. Specify the number of hours or minutes. The minimum value is 1, and the default value is 8. Example: 8
lifetime_unit string	Specifies the time unit for the `lifetime` value. This can be one of these values: hours (Default) minutes Example: hours
lifebyte integer	Maximum amount of data (in bytes) that you can be transmit through an IPSec Security Association (SA) before it expires and must rekey. Example: 0
authentication string	The hash algorithm used to verify message integrity and authenticity. This can be one of these values: SHA2-256 (Default) SHA2-384 SHA2-512 Example: SHA2-256
pfs_dh_group string	Diffie-Hellman (DH) group used for Perfect Forward Secrecy (PFS) in Phase 2 of the VPN tunnel. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 DH-21 Example: DH-14
natt_interval integer	Keep-alive interval (in seconds). Specify a number of seconds from 1 through 65535. The default value is 20. Example: 20
dpd object	Dead Peer Detection settings used to detect if the remote peer is no longer responsive.
dpd_type string	Dead Peer Detection type. This can be one of these values: traffic — Default. Based on traffic activity. If no traffic is detected for a specified idle time, DPD messages are sent. timer — Sent at regular intervals, regardless of traffic. Example: traffic
idle_time integer	Amount of time (in seconds) before the peer is considered idle. Specify a number of seconds from 10-300. Default value is 30 Example: 20
retries integer	Number of retries to make before the peer is considered unreachable. Specify a number from 1-30. Default value is 5. Example: 5
routes object	Routes to establish through the tunnel.
endpoint_a object	Route object for the device.
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 1
route string	Route to establish through the tunnel. Example: 192.168.1.0/24
endpoint_b object	Route object the remote device or endpoint that `endpoint_a` connects to.
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 1
route string	Route to establish through the tunnel. Example: 192.168.100.0/24
vif object	Virtual interface configuration for each VPN endpoint.
endpoint_a object	Route object for the device.
vif_df_bit string	Specifies the DF bit value. This can be one of these values: copy — Copies the DF (Don't Fragment) bit from the original packet. set — Sets the DF bit to 1 (prevent fragmentation). clear — Clears the DF bit (allow fragmentation). Example: set
vif_local_ip string	Local IP address for the virtual interface used in the route-based VPN. Example: 9.9.9.9/32
vif_mtu integer	Maximum packet size (in bytes) that can be transmitted through the virtual interface without fragmentation. Can be an integer between 68 and 9000. Example: 1500
vif_remote_ip string	IP address of the virtual interface in a route-based VPN tunnel. Example: 10.10.10.10/32
endpoint_b object	Route object for the remote device or endpoint that the cloud-managed Firebox (`endpoint_a`) connects to.
vif_local_ip string	Local IP address for the virtual interface used in the route-based VPN. Example: 10.10.10.10/32
vif_remote_ip string	IP address of the virtual interface in a route-based VPN tunnel. Example: 9.9.9.9/32

Edit a BOVPN Tunnel

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels/

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels/{objectid}

Make a request to this endpoint to update a BOVPN IPSec tunnel configuration by name or by unique object ID.

Update a BOVPN IPSec tunnel by name

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels/

Make a request to this endpoint to update an existing BOVPN configuration by name.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid
string
REQUIRED

Your WatchGuard Cloud account ID. You can view your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Request Body

When you send a request to this endpoint, you can include these parameters in the request body:

version integer REQUIRED	Version number of the BOVPN. Example: 1
name string REQUIRED	Name of the BOVPN tunnel. This can include only letters, numbers, spaces, parentheses "()", asterisks "*", periods ".", hyphens "-", and underscores "_". Maximum: 58 characters. Example: PBoVPN1
endpoint_a string REQUIRED	Unique device ID for the cloud-managed Firebox. You can find the device ID in the URL of the Device Summary page. For example, if the Device Summary page URL is https://usa.cloud.watchguard.com/services/fb/device/FB-12345/summary, the device ID is 12345. For a FireCluster, use the FBCL prefix (FBCL-12345). Example: 12345
endpoint_b string	Identifies the remote device or endpoint that endpoint_a connects to. Example: 67890
endpoint_b_name string	Name of the second Firebox. Example: CentralVPNServer
disabled boolean	Indicates whether the IPSec tunnel is disabled. Default is false. Example: false
vpn_type string	VPN IPSec tunnel type. Must be either route‑based or policy‑based. Default is `route-based`. Example: route-based
address_family integer	IP address family for all gateway endpoints. Default is `4`. This can be one of these values: 4 (IPv4) 6 (IPv6) Example: 4
auth_method string	Local authentication method for the tunnel. Default is `psk`. This can be one of these values: psk certificate Example: psk
interfaces array REQUIRED	Array of interface endpoint mappings between endpoint A and endpoint B.
endpoint_a object	Defines the cloud-managed Firebox interface settings.
network string	Network definition for the tunnel (External \| Trusted \| Optional).
ip_address string	IP address of endpoint A interface; can be a literal address or `Dynamic`.
id object	Unique ID for the IPSec gateway.
type string	Gateway endpoint ID type. Default is `ip`. This can be one of these values: ip — An address. fqdn — A fully qualified domain name. ufqdn — A user fully qualified domain name. x500_name — An X.500 distinguished name. Example: ip
value string	Specifies the identifier string (IP address, FQDN, user FQDN, or X.500 Distinguished Name). Depends on `type`. Example: 192.88.99.200
perpetual_resolve boolean	Enable to re-resolve domains when you rebuild tunnels. Example: true
endpoint_b object	Defines the remote VPN gateway interface settings.
network string	Network definition for the tunnel (External \| Trusted \| Optional).
ip_address string	IP address of endpoint B interface; can be a literal address or `Dynamic`.
id object	Unique ID for the IPSec gateway.
type string	Gateway endpoint ID type. Default is `ip`. This can be one of these values: ip — An address. fqdn — A fully qualified domain name. ufqdn — A user fully qualified domain name. x500_name — An X.500 distinguished name. Example: ip
value string	Specifies the identifier string (IP address, FQDN, user FQDN, or X.500 Distinguished Name). Depends on `type`. Example: 192.88.99.200
perpetual_resolve boolean	Enable to re-resolve domains when you rebuild tunnels. Example: true
df_bit string	Specifies the DF bit value. This can be one of these values: copy — Copies the DF (Don't Fragment) bit from the original packet. set — Sets the DF bit to 1 (prevent fragmentation). clear — Clears the DF bit (allow fragmentation). Example: set
pmtu_minimum integer	Minimum Path MTU threshold for each endpoint (68 to1550 bytes). Example:1550
pmtu_age integer	Path MTU aging time for each endpoint in minutes (60 to 2147483647 minutes). Example: 2147483647
routes object REQUIRED	Routes to establish through the tunnel.
endpoint_a object	Route object for the cloud-managed Firebox .
local_networks array	Local network segments that are accessible through the VPN tunnel.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 1
nat_base string	Specifies the source network for NAT. Must be in IPv4 CIDR format. Example: 192.0.2.0/24
network string	Network definition for the tunnel. This can be one of these values: External Trusted Optional Example: External
dnat_ip string	Specifies an optional destination NAT. Example: 192.0.2.1
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 1
nat_base string	Specifies the source network for NAT. Must be in IPv4 CIDR format. Example: 192.0.2.0/24
route string	Specifies the local network that the VPN endpoint advertises or use as part of the tunnel Example: 192.0.2.0/24
dnat_ip string	Specifies an optional destination NAT. Example: 192.0.2.1
endpoint_b object	Route object for the remote device or endpoint that the cloud-managed Firebox (endpoint_a) connects to.
local_networks array	Local network segments that are accessible through the VPN tunnel.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 1
nat_base string	Specifies the source network for NAT. Must be in IPv4 CIDR format. Example: 192.0.2.0/24
network string	Network definition for the tunnel. This can be one of these values: External Trusted Optional Example: External
dnat_ip string	Specifies an optional destination NAT. Example: 192.0.2.1
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 1
nat_base string	Specifies the source network for NAT. Must be in IPv4 CIDR format. Example: 192.0.2.0/24
route string	Specifies the local network that the VPN endpoint advertises or use as part of the tunnel Example: 192.0.2.0/24
dnat_ip string	Specifies an optional destination NAT. Example: 192.0.2.1
vif object	Virtual interface configuration for each VPN endpoint.
endpoint_a object	Route object for the cloud-managed Firebox.
vif_dev_name string	Name of the virtual interface.
vif_df_bit string	Specifies the DF bit value. This can be one of these values: copy — Copies the DF (Don't Fragment) bit from the original packet. set — Sets the DF bit to 1 (prevent fragmentation). clear — Clears the DF bit (allow fragmentation). Example: set
vif_local_ip string	Local IP address for the virtual interface used in the route-based VPN. Example: 9.9.9.9/32
vif_mtu integer	Maximum packet size (in bytes) that can be transmitted through the virtual interface without fragmentation. Can be an integer between 68 and 9000. Example: 1500
vif_remote_ip string	IP address of the virtual interface in a route-based VPN tunnel. Example: 10.10.10.10/32
endpoint_b object	Route object for the remote device or endpoint that the cloud-managed Firebox (`endpoint_a`) connects to.
vif_dev_name string	Name of the virtual interface.
vif_local_ip string	Local IP address for the virtual interface used in the route-based VPN. Example: 10.10.10.10/32
vif_remote_ip string	IP address of the virtual interface in a route-based VPN tunnel. Example: 9.9.9.9/32
vif_mtu integer	Maximum packet size (in bytes) that can be transmitted through the virtual interface without fragmentation. Can be an integer between 68 and 9000. Example: 1500
vif_df_bit string	Specifies the DF bit value. This can be one of these values: copy — Copies the DF (Don't Fragment) bit from the original packet. set — Sets the DF bit to 1 (prevent fragmentation). clear — Clears the DF bit (allow fragmentation). Example: set
certs object	Object of certificate references.
endpoint_a string	Certificate name for endpoint A. Example: DeviceCertificateName
endpoint_b string	Certificate name for endpoint B. Example: RemotePeerCertName
psk string	Pre-shared key used when authentication method is PSK. Example: 12345678
psk_encrypted boolean	Indicates if the provided pre-shared key is already encrypted. Example: true
shared_p1_settings boolean	Indicate whether to use the shared Phase‑1 (IKE) settings of the device (typically for dynamic peers). Example: true
ipsec_tunnel_core object	Phase 1 (IKE) and Phase 2 (IPSec) settings, Dead Peer Detection (DPD), and NAT-T keep-alive configurations for the tunnel.
natt_interval integer	Keep-alive interval (in seconds). Specify a number of seconds from 1 through 65535. The default value is 20. Example: 20
dpd object	Dead Peer Detection settings used to detect if the remote peer is no longer responsive.
enabled boolean	Indicates whether DPD is enabled. Default is true. Example: true
dpd_type string	Dead Peer Detection type. This can be one of these values: traffic — Default. Based on traffic activity. If no traffic is detected for a specified idle time, DPD messages are sent. timer — Sent at regular intervals, regardless of traffic. Example: traffic
idle_time integer	Amount of time (in seconds) before the peer is considered idle. Specify a number of seconds from 10-300. Default value is 30 Example: 20
retries integer	Number of retries to make before the peer is considered unreachable. Specify a number from 1-30. Default value is 5. Example: 5
interval integer	For timer‑based Dead Peer Detection, message interval between checks. Example: 30
max_failures integer	For timer‑based Dead Peer Detection, number of consecutive failures before declaring the peer down. Example: 5
ike_proposals array	Array of IKE Phase 1 proposals that define encryption and authentication settings for tunnel negotiation.
encryption string	Encryption algorithm. This can be one of these values: AES-CBC-128 AES-CBC-192 AES-CBC-256 (Default) AES-GCM-128 AES-GCM-192 AES-GCM-256 Example: AES-CBC-256
dh_group string	Diffie-Hellman group. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 Example: DH-14
lifetime integer	Lifetime of the security association. Specify the number of hours or minutes. The minimum value is 1, and the default value is 24. Example: 24
lifetime_unit string	Specifies the time unit for the `lifetime` value. This can be one of these values: hours (Default) minutes Example: hours
pfs_dh_group string	DH group used for Perfect Forward Secrecy in Phase 2. Example: DH-14
ipsec_proposals array	Array of IPSec Phase 2 proposals.
protocol string	Phase‑2 protocol; currently ESP is supported. Example: ESP
encryption string	Encryption algorithm. This can be one of these values: AES-CBC-128 AES-CBC-192 AES-CBC-256 (Default) AES-GCM-128 AES-GCM-192 AES-GCM-256 Example: AES-CBC-256
lifetime integer	Lifetime of the security association. Specify the number of hours or minutes. The minimum value is 1, and the default value is 8. Example: 8
lifetime_unit string	Specifies the time unit for the `lifetime` value. This can be one of these values: hours (Default) minutes Example: hours
lifebyte integer	Maximum amount of data (in bytes) that you can be transmit through an IPSec Security Association (SA) before it expires and must rekey. Example: 0
authentication string	The hash algorithm used to verify message integrity and authenticity. This can be one of these values: SHA2-256 (Default) SHA2-384 SHA2-512 Example: SHA2-256
local_remote_pairs array	Policy‑based tunnels only. Custom local and remote pairs that define address match and direction with optional NAT.
enabled boolean	Indicates whether the local-remote pair is active. Example: true
local_network string	Optional name for the local network associated with this policy pair. Example:
local_address string	Local network address (CIDR) included in the policy‑based pair. Example: 192.0.2.0/24
remote_address string	Remote network address (CIDR) included in the policy‑based pair. Example: 192.0.2.0/24
direction string	Traffic direction for the policy pair. This can be: Inbound (`in`) Outbound (`out`) Bidirectional (`bi`) Example: in
dnat_ip string	Specifies an optional destination NAT. Example: 192.0.2.1
nat_base string	Specifies the source network for NAT. Must be in IPv4 CIDR format. Example: 192.0.2.0/24

Example Request

This request updates a BOVPN IPSec tunnel by name.

                    curl -X PUT https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/ACC-1234567/bovpn/ipsec/tunnels
	-H 'Accept: application/json'
	-H 'Content-Type: application/json'
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXIn0.eyJzdWIiOiN0LTJfa3hXeFdfU650heiAaUAy7XmiqbA'
-d '{
"version": 1,
"name": "MyName",
"endpoint_a": "MyEndA",
"endpoint_b": "MyEndB",
"endpoint_b_name": "MyEndBname",
"disabled": false,
"vpn_type": "route-based",
"address_family": 4,
"auth_method": "psk",
"interfaces": [
	{
	"endpoint_a": {
		"network": "MyNetA",
		"ip_address": "192.0.2.1",
		"id": {
			"type": "ip",
			"value": "MyValueA"
		},
		"perpetual_resolve": true
	},
	"endpoint_b": {
		"network": "MyNetB",
		"ip_address": "192.0.2.1",
		"id": {
			"type": "ip",
			"value": "MyValueB"
		},
		"perpetual_resolve": true
	},
	"df_bit": "copy",
	"pmtu_minimum": 1550,
	"pmtu_age": 2147483647
	}
],
"routes": {
	"endpoint_a": {
		"local_networks": [
		{
			"network": "MyLocANet",
			"metric": 1,
			"nat_base": "192.0.2.0/24",
			"dnat_ip": "192.0.2.1"
		}
	],
	"local_routes": [
		{
		"route": "192.0.2.0/24",
		"metric": 1,
		"nat_base": "192.0.2.0/24",
		"dnat_ip": "192.0.2.1"
		}
	]
},
"endpoint_b": {
	"local_networks": [
		{
		"network": "MyLocBNet",
		"metric": 1,
		"nat_base": "192.0.2.0/24",
		"dnat_ip": "192.0.2.1"
		}
	],
	"local_routes": [
		{
		"route": "192.0.2.0/24",
		"metric": 1,
		"nat_base": "192.0.2.0/24",
		"dnat_ip": "192.0.2.1"
		}
	]
	}
},
"vif": {
	"endpoint_a": {
		"vif_dev_name": "MyVifA",
		"vif_local_ip": "192.0.2.0/24",
		"vif_remote_ip": "192.0.2.0/24",
		"vif_mtu": 9000,
		"vif_df_bit": "copy"
		},
	"endpoint_b": {
		"vif_dev_name": "MyVifB",
		"vif_local_ip": "192.0.2.0/24",
		"vif_remote_ip": "192.0.2.0/24",
		"vif_mtu": 9000,
		"vif_df_bit": "copy"
		}
		},
	"certs": {
		"endpoint_a": "DeviceCertificateName",
		"endpoint_b": "RemotePeerCertName"
	},
	"psk": "stringst",
	"psk_encrypted": true,
	"shared_p1_settings": false,
	"ipsec_tunnel_core": {
		"natt_interval": 20,
		"dpd": {
		"enabled": true,
		"dpd_type": "traffic",
		"idle_time": 30,
		"retries": 5,
		"interval": 30,
		"max_failures": 5
		},
	"ike_proposals": [
		{
		"encryption": "AES-CBC-256",
		"authentication": "SHA2-256",
		"dh_group": "DH-14",
		"lifetime": 24,
		"lifetime_unit": "hours"
		}
	],
	"pfs_dh_group": "DH-14",
	"ipsec_proposals": [
		{
		"protocol": "ESP",
		"encryption": "AES-CBC-256",
		"authentication": "SHA2-256",
		"lifetime": 8,
		"lifetime_unit": "hours",
		"lifebyte": 0,
		"lifebyte_unit": "GB"
		}
	]
	},	
	"local_remote_pairs": [
		{
		"enabled": true,
		"local_network": "MyLocNetP",
		"local_address": "192.0.2.0/24",
		"remote_address": "192.0.2.0/24",
		"direction": "in",
		"dnat_ip": "192.0.2.1",
		"nat_base": "192.0.2.0/24"
		}
	]
}'

Update a BOVPN IPSec tunnel by unique object ID

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels/{objectid}

Make a request to this endpoint to update an existing BOVPN configuration by unique object ID.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid
string
REQUIRED

Your WatchGuard Cloud account ID. You can view your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid
string
REQUIRED

Object ID of the BOVPN tunnel to edit.

Each BOVPN tunnel has a unique ID in WatchGuard Cloud, which appears in the URL of the BOVPN configuration page. For example, if the BOVPN configuration page URL is https://usa.cloud.watchguard.com/ss-tenant/services/ACC-1234567/fb/device/FB-12345/configuration/bovpn/tunnel/ipsgp_123456DH, the tunnel object ID is ipsgp_123456DH.

Example: ipsgp_123456DH

Request Body

When you send a request to this endpoint, you can include these parameters in the request body:

id string	Unique ID of the IPSec gateway. Example: ipstp_12345_ARBHLJ70Y78rGOIGBS
object string	Type of object returned. Example: ipsec_gatewaytemplate
version integer REQUIRED	Version number of the BOVPN. Example: 1
account string REQUIRED	Your WatchGuard Cloud account ID. You can view your `accountId` on the My Account page in WatchGuard Cloud. Example: WGC-1-123abc456 or ACC-1234567
name string REQUIRED	Human-readable name of the BOVPN tunnel. Example: PBoVPN1
endpoint_a string REQUIRED	Cloud-managed Firebox device ID for endpoint A.
endpoint_b_name string	Name of the second Firebox. Example: CentralVPNServer
vpn_type string	VPN IPSec tunnel type. Must be either route‑based or policy‑based. Default is `route-based`. Example: route-based
address_family integer	IP address family for all gateway endpoints. Default is `4`. This can be one of these values: 4 (IPv4) 6 (IPv6) Example: 4
interfaces array REQUIRED	Array of interface endpoint mappings between endpoint A and endpoint B.
endpoint_a string	Network name/role for endpoint A. For example, External.
endpoint_b string	Remote endpoint details.
id object	Unique ID of the IPSec gateway.
type string	Gateway endpoint ID type. Default is `ip`. This can be one of these values: ip — An address. fqdn — A fully qualified domain name. ufqdn — A user fully qualified domain name. x500_name — An X.500 distinguished name. Example: ip
value string	Specifies the identifier string (IP address, FQDN, user FQDN, or X.500 Distinguished Name). Depends on `type`. Example: 192.88.99.200
psk string	Pre-shared key used when authentication method is PSK. Example: 12345678
ipsec_tunnel_core object	Phase 1 (IKE) and Phase 2 (IPSec) settings, Dead Peer Detection (DPD), and NAT-T keep-alive configurations for the tunnel.
ike_proposals array	Array of IKE Phase 1 proposals that define encryption and authentication settings for tunnel negotiation.
encryption string	Encryption algorithm. This can be one of these values: AES-CBC-128 AES-CBC-192 AES-CBC-256 (Default) AES-GCM-128 AES-GCM-192 AES-GCM-256 Example: AES-CBC-256
dh_group string	Diffie-Hellman group. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 Example: DH-14
lifetime integer	Lifetime of the security association. Specify the number of hours or minutes. The default value is 24. Example: 24
lifetime_unit string	Specifies the time unit for the `lifetime` value. This can be one of these values: hours (Default) minutes Example: hours
authentication string	The hash algorithm used to verify message integrity and authenticity. This can be one of these values: SHA2-256 (Default) SHA2-384 SHA2-512 Example: SHA2-256
ipsec_proposals array	Array of IPSec Phase 2 proposals.
encryption string	Encryption algorithm. This can be one of these values: AES-CBC-128 AES-CBC-192 AES-CBC-256 (Default) AES-GCM-128 AES-GCM-192 AES-GCM-256 Example: AES-CBC-256
lifetime integer	Lifetime of the security association. Specify the number of hours or minutes. The minimum value is 1, and the default value is 8. Example: 8
lifetime_unit string	Specifies the time unit for the `lifetime` value. This can be one of these values: hours (Default) minutes Example: hours
lifebyte integer	Maximum amount of data (in bytes) that you can be transmit through an IPSec Security Association (SA) before it expires and must rekey. Example: 0
authentication string	The hash algorithm used to verify message integrity and authenticity. This can be one of these values: SHA2-256 (Default) SHA2-384 SHA2-512 Example: SHA2-256
pfs_dh_group string	Diffie-Hellman (DH) group used for Perfect Forward Secrecy (PFS) in Phase 2 of the VPN tunnel. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 DH-21 Example: DH-14
natt_interval integer	Keep-alive interval (in seconds). Specify a number of seconds from 1 through 65535. The default value is 20. Example: 20
dpd object	Dead Peer Detection settings used to detect if the remote peer is no longer responsive.
dpd_type string	Dead Peer Detection type. This can be one of these values: traffic — Default. Based on traffic activity. If no traffic is detected for a specified idle time, DPD messages are sent. timer — Sent at regular intervals, regardless of traffic. Example: traffic
idle_time integer	Amount of time (in seconds) before the peer is considered idle. Specifies a number of seconds from 10-300. Default value is 30 Example: 20
retries integer	Number of retries to make before the peer is considered unreachable. Specifies a number from 1-30. Default value is 5. Example: 5
routes object REQUIRED	Routes to establish through the tunnel.
endpoint_a object	Route object for the device.
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 1
route string	Route to establish through the tunnel. Example: 192.168.1.0/24
endpoint_b object	Route object for the device that `endpoint_a` connects to.
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 6
route string	Route to establish through the tunnel. Example: 192.168.100.0/24
vif object	Virtual interface configuration for each VPN endpoint.
endpoint_a object	Route object for the device.
vif_df_bit string	Specifies the DF bit value. This can be one of these values: copy — Copies the DF (Don't Fragment) bit from the original packet. set — Sets the DF bit to 1 (prevent fragmentation). clear — Clears the DF bit (allow fragmentation). Example: set
vif_local_ip string	Local IP address for the virtual interface used in the route-based VPN. Example: 9.9.9.9/32
vif_mtu integer	Maximum packet size (in bytes) that can be transmitted through the virtual interface without fragmentation. Can be an integer between 68 and 9000. Example: 1500
vif_remote_ip string	IP address of the virtual interface in a route-based VPN tunnel. Example: 10.10.10.10/32
endpoint_b object	Route object for the device that `endpoint_a` connects to.
vif_local_ip string	Local IP address for the virtual interface used in the route-based VPN. Example: 10.10.10.10/32
vif_remote_ip string	IP address of the virtual interface in a route-based VPN tunnel. Example: 9.9.9.9/32

Example Request

This request updates a BOVPN IPSec tunnel by object ID.

                    curl -X PATCH 
https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/{accountid}/bovpn/ipsec/tunnels/ipsgp_123456DH
-H 'Accept: application/json'
-H 'Content-Type: application/json'
-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE5mM2FXTHhoSmEza0ltcEFMbnluT05DcFdIT2tZPSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiJjNDQyMTJlMi05MmI1LTRiOTYtYTRmNS1lYWRlODA4OTM1YjIiLCJjdXN0b206YXBpX2tleXMiOiJwMHM1UmQzUkF2NlR2d0VuWEx5YUphR2x0ZWtieEFVUzcwVGVzOXlGIiwiaXNzIjoiaHR0cHM6XC9cL2NvZ25pdG8taWRwLnVzLXdlc3QtMi5hbWF6b25hd3MuY29tXC91cy13ZXN0LTJfa3hXeFdrTFZ5IiwiY29nbml0bzp1c2VybmFtZSI6IjAyNjk0OWM1OWI2NzIxOGNfcndfaWQiLCJhdWQiOiIzb3AybDBqazkxN3FudXFoZnVoanRvcXRzZyIsImV2ZW50X2lkIjoiODczM2ZmMjktOGNhMC00ODMyLTg0NzgtMDNiNWIxMDI3NmQ3IiwidG9rZW5fdXNlIjoiaWQiLCJhdXRoX3RpbWUiOjE1NjkzNTM0NDEsIm5hbWUiOiIwMjY5NDljNTliNjcyMThjX3J3X2lkIiwiY3VzdG9tOmFjY291bnRfaWQiOiJBQ0MtMTIzNTA2OCIsImV4cCI6MTU2OTM1NzA0MSwiY3VzdG9tOnJvbGUiOiIxIiwiaWF0IjoxNTY5MzUzNDQxfQ.MUAeG6QyM7Zog8mM--WK2uJVevLRwz8z2KPpGhQbUnHK04Hy_JdO4F4wH6IV0WVENGsBrcjp5boxcBZgdJE46123MGnB0HvghN5IoAZUOkfFPm7SAN68posHqYLoo14YNedc5GtvOzCxTmi9YepvE5LhsoC6Tgyc0e3ABn18gEZsyxmJFcMBHXOMei7AssYSWAdDyoI7j6jZslxmhXj7_h6T9PyqjLxLjFEq5S6oK9u4IVDVBlRxbURaRVAGb7ywfHiZEPDgceV-Wnv0AIhDzj5dL28AmiGIkWtWinF0UD-NSMKN4vtszK2sUWUSl8ZfVNGU650heiAaUAy7XmiqbA'
-d '{
"id": "ipsgp_123456DH",
"object": "ipsec_gatewaypair",
"version": 1,
"account": "WGC-1-123abc456",
"name": "PBoVPN1",
"endpoint_a": "136162",
"endpoint_b_name": "CentralVPNServer",
"vpn_type": "route-based",
"address_family": 4,
"interfaces": [
	{
	"endpoint_a": {
		"network": "External"
		},
	"endpoint_b": {
		"id": {
			"type": "ip",
			"value": "192.88.99.200"
			}
		}
	}
],
"psk": "12345678",
"ipsec_tunnel_core": {
	"ike_proposals": [
		{
		"encryption": "AES-CBC-256",
		"dh_group": "DH-14",
		"lifetime": 24,
		"authentication": "SHA2-256"
		}
],
	"ipsec_proposals": [
		{
		"encryption": "AES-CBC-256",
		"lifetime": 8,
		"lifebyte": 0,
		"authentication": "SHA2-256"
		}
	],
"pfs_dh_group": "DH-14",
"natt_interval": 20,
"dpd": {
	"dpd_type": "traffic",
	"idle_time": 20,
	"retries": 5
	}
},
"routes": {
	"endpoint_a": {
		"local_routes": [
			{
			"metric": 1,
			"route": "192.168.1.0/24"
			}
		]
	},
	"endpoint_b": {
		"local_routes": [
			{
			"metric": 6,
			"route": "192.168.100.0/24"
			}
		]
	}
},
"vif": {
	"endpoint_a": {
		"vif_df_bit": "set",
		"vif_local_ip": "9.9.9.9/32",
		"vif_mtu": 1399,
		"vif_remote_ip": "10.10.10.10/32"
		},
	"endpoint_b": {
		"vif_local_ip": "10.10.10.10/32",
		"vif_remote_ip": "9.9.9.9/32"
		}
	}
}'

Example Response

This response includes the update to a BOVPN tunnel by Object ID in JSON format:

                {
"id": "ipsgp_12345_ARBHLJ70Y78rGOIGBS",
"object": "ipsec_gatewaypair",
"version": 2,
"account": "WGC-1-123abc456",
"created": 1579909960,
"author": "testuser",
"name": "PBoVPN1",
"endpoint_a": "136162",
"endpoint_b_name": "CentralVPNServer",
"vpn_type": "route-based",
"address_family": 4,
"interfaces": [
	{
	"endpoint_a": {
		"network": "External"
		},
	"endpoint_b": {
		"id": {
			"type": "ip",
			"value": "192.88.99.200"
			}
		}
	}
],
"psk": "12345678",
"ipsec_tunnel_core": {
	"ike_proposals": [
		{
		"encryption": "AES-CBC-256",
		"dh_group": "DH-14",
		"lifetime": 24,
		"authentication": "SHA2-256"
		}
	],
	"ipsec_proposals": [
		{
		"encryption": "AES-CBC-256",
		"lifetime": 8,
		"lifebyte": 0,
		"authentication": "SHA2-256"
		}
	],
	"pfs_dh_group": "DH-14",
	"natt_interval": 20,
	"dpd": {
		"dpd_type": "traffic",
		"idle_time": 20,
		"retries": 5
		}
	},
"routes": {
	"endpoint_a": {
		"local_routes": [
			{
			"metric": 1,
			"route": "192.168.1.0/24"
			}
		]
	},
	"endpoint_b": {
		"local_routes": [
			{
			"metric": 6,
			"route": "192.168.100.0/24"
			}
		]
	}
},
"vif": {
	"endpoint_a": {
		"vif_df_bit": "set",
		"vif_local_ip": "9.9.9.9/32",
		"vif_mtu": 1399,
		"vif_remote_ip": "10.10.10.10/32"
		},
	"endpoint_b": {
		"vif_local_ip": "10.10.10.10/32",
		"vif_remote_ip": "9.9.9.9/32"
		}
	}
}

This table lists and describes the data returned in the response:

id string	Identifier object for endpoint B. Example: ipsgp_12345_ARBHLJ70Y78rGOIGBS
object string	Type of object returned. Example: ipsec_gatewaytemplate
version integer	Version number of the BOVPN. Example: 2
account string	WatchGuard Cloud account ID associated with the object. Example: WGC-1-123abc456
created integer	Unix time stamp when the object was created. Example: 1579909960
author string	Author of the gateway pair. Always empty for objects added or updated with the Firebox Management API. Example: YourName
name string	Human-readable name of the BOVPN tunnel. Example: PBoVPN1
endpoint_a string	Endpoint A interface block. Example: 136162
endpoint_b_name string	Name of the second Firebox. Example: CentralVPNServer
vpn_type string	VPN IPSec tunnel type. Must be either route‑based or policy‑based. Default is `route-based`. Example: route-based
address_family integer	IP address family for all gateway endpoints. Default is `4`. This can be one of these values: 4 (IPv4) 6 (IPv6) Example: 4
interfaces array	Array of interface endpoint mappings between endpoint A and endpoint B.
endpoint_a object	Endpoint A interface block.
network string	Network definition for the tunnel. This can be one of these values: External Trusted Optional Example: External
endpoint_b object	Endpoint B interface block.
id object	Identifier object for endpoint B.
type string	Gateway endpoint ID type. Default is `ip`. This can be one of these values: ip — An address. fqdn — A fully qualified domain name. ufqdn — A user fully qualified domain name. x500_name — An X.500 distinguished name. Example: ip
value string	Specifies the identifier string (IP address, FQDN, user FQDN, or X.500 Distinguished Name). Depends on `type`. Example: 192.88.99.200
psk string	Pre-shared key used when authentication method is PSK. Example: 12345678
ipsec_tunnel_core object	Core settings for IKE (Phase 1) and IPSec (Phase 2), including DPD and NAT-T.
ike_proposals array	Array of IKE Phase 1 proposals that define encryption and authentication settings for tunnel negotiation.
encryption string	Encryption algorithm. This can be one of these values: AES-CBC-128 AES-CBC-192 AES-CBC-256 (Default) AES-GCM-128 AES-GCM-192 AES-GCM-256 Example: AES-CBC-256
dh_group string	Diffie-Hellman group. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 Example: DH-14
lifetime integer	Lifetime of the security association. Specifies the number of hours or minutes. The minimum value is 1, and the default value is 24. Example: 24
authentication string	The hash algorithm to use to verify message integrity and authenticity. This can be one of these values: SHA2-256 (Default) SHA2-384 SHA2-512 Example: SHA2-256
ipsec_proposals array	Array of IPSec Phase 2 proposals.
encryption string	Encryption algorithm. Example: AES-CBC-256
lifetime integer	Lifetime of the security association. Specifies the number of hours or minutes. The minimum value is 1, and the default value is 8. Example: 8
lifebyte integer	Data volume before Phase 2 SA rekey (0 disables byte lifetime). Example: 0
authentication string	The hash algorithm to use to verify message integrity and authenticity. This can be one of these values: SHA2-256 (Default) SHA2-384 SHA2-512 Example: SHA2-256
pfs_dh_group string	DH group used for Perfect Forward Secrecy in Phase 2. Example: DH-14
natt_interval integer	Keep-alive interval (in seconds). Specifies a number of seconds from 1 through 65535. The default value is 20. Example: 20
dpd object	Dead Peer Detection settings used to detect an unresponsive peer. Example:
dpd_type string	DPD trigger type (traffic or timer). Example: traffic
idle_time integer	Idle time in seconds before peer is considered idle. Example: 20
retries integer	Number of retries to make before the peer is considered unreachable. Specify a number from 1-30. Default value is 5. Example: 5
routes object	Routing configuration for endpoint A and endpoint B. Example:
endpoint_a object	Endpoint A interface block. Example:
local_routes array	Array of local routes available through the VPN from the endpoint. Example:
metric integer	Route priority metric (lower value = higher priority). Example: 1
route string	CIDR-formatted route. Example: 192.168.1.0/24
endpoint_b object	Endpoint B interface block. Example:
local_routes array	Array of local routes available through the VPN from the endpoint. Example:
metric integer	Route priority metric (lower value = higher priority). Example: 6
route string	CIDR-formatted route. Example: 192.168.100.0/24
vif object	Virtual Interface settings for each endpoint in a route-based VPN. Example:
endpoint_a object	Endpoint A interface block. Example:
vif_df_bit string	Specifies the DF bit value. This can be one of these values: copy — Copies the DF (Don't Fragment) bit from the original packet. set — Sets the DF bit to 1 (prevent fragmentation). clear — Clears the DF bit (allow fragmentation). Example: set
vif_local_ip string	Local VIF IP address (CIDR). Example: 9.9.9.9/32
vif_mtu integer	Maximum packet size (in bytes) that can be transmitted through the virtual interface without fragmentation. Can be an integer between 68 and 9000. Example: 1500
vif_remote_ip string	Remote VIF IP address (CIDR). Example: 10.10.10.10/32
endpoint_b object	Endpoint B interface block. Example:
vif_local_ip string	Local VIF IP address (CIDR). Example: 10.10.10.10/32
vif_remote_ip string	Remote VIF IP address (CIDR). Example: 9.9.9.9/32

Modify Routes and Certificates

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels/

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels/{objectid}

Make a request to this endpoint to update the routes list or certificate of a specific BOVPN IPSec tunnel by name or unique object ID.

Update the routes list or certificate of a specific BOVPN tunnel

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels/

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid
string
REQUIRED

Your WatchGuard Cloud account ID. You can view your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Request Body

When you send a request to this endpoint, you can include these parameters in the request body:

id string	Unique ID of the IPSec gateway. Example: ipstp_12345_ARBHLJ70Y78rGOIGBS
name string	Name for the gateway pair. Example: PBoVPN1
routes object	Routes to establish through the tunnel.
endpoint_a object	Route object for the cloud-managed Firebox.
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 1
route string	Specifies the local network that the VPN endpoint advertises or use as part of the tunnel Example: 192.0.1.0/24
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 2
route string	Specifies the local network that the VPN endpoint advertises or use as part of the tunnel Example: 192.0.2.0/24
endpoint_b object	Route object for the remote device or endpoint that the cloud-managed Firebox (endpoint_a) connects to.
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 6
route string	Specifies the local network that the VPN endpoint advertises or use as part of the tunnel Example: 192.168.100.0/24
certs object	Object of certificate references.
endpoint_a string REQUIRED	Certificate name for endpoint A. Example: cert_12345_ABCDEFGHIJKLMNOP
routes object	Routes to establish through the tunnel.
endpoint_a object	Route object for the cloud-managed Firebox.
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 1
route string	Specifies the local network that the VPN endpoint advertises or use as part of the tunnel Example: 10.0.1.0/24
endpoint_b object	Route object for the Firebox.
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 5
route string	Specifies the local network that the VPN endpoint advertises or use as part of the tunnel Example: 10.0.2.0/24
certs object	Object of certificate references.
endpoint_a string	Certificate name for endpoint A. Example: cert_12345_ABCDEFGHIJKLMNOP
endpoint_b string	Certificate name for endpoint B. Example: cert_67890_QRSTUVWXZABCDEF

Example Request

This request modifies the routes and certificates for a BOVPN tunnel.

                    curl -X PATCH https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/{accountid}/bovpn/ipsec/tunnels/
-H 'Accept: application/json'
-H 'Content-Type: application/json'
-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE5mM2FXTHhoSmEza0ZslxmhXj7_h6T9PyN4vtszK2sUWUSl8ZfVNGU650heiAaUAy7XmiqbA'
-d '{
"update_routes": {
	"summary": "Update routes for both endpoints",
	"value": {
	"id": "ipsgp_12345_ARBHLJ70Y78rGOIGBS",
	"name": "PBoVPN1",
	"routes": {
		"endpoint_a": {
			"local_routes": [
					{
					"metric": 1,
					"route": "192.168.1.0/24"
					},
					{
					"metric": 2,
					"route": "192.168.2.0/24"
					}
				]
			},
		"endpoint_b": {
			"local_routes": [
					{
					"metric": 6,
					"route": "192.168.100.0/24"
					}
				]
			}
		}
		}
	},
"update_certificate": {
	"summary": "Update certificate for endpoint_a",
	"value": {
		"id": "ipsgp_12345_ARBHLJ70Y78rGOIGBS",
		"name": "PBoVPN1",
		"certs": {
			"endpoint_a": "cert_12345_ABCDEFGHIJKLMNOP"
			}
		}
		},
"update_routes_and_certificate": {
	"summary": "Update name, routes, and certificate",
	"value": {
		"id": "ipsgp_12345_ARBHLJ70Y78rGOIGBS",
		"name": "UpdatedTunnelName",
		"routes": {
			"endpoint_a": {
			"local_routes": [
					{
					"metric": 1,
					"route": "10.0.1.0/24"
					}
				]
			},
			"endpoint_b": {
			"local_routes": [
					{
					"metric": 5,
					"route": "10.0.2.0/24"
					}
				]
			}
		},
	"certs": {
		"endpoint_a": "cert_12345_ABCDEFGHIJKLMNOP",
		"endpoint_b": "cert_67890_QRSTUVWXZABCDEF"
		}
	}
}
}

Update the routes list or certificate of a specific BOVPN tunnel by Object ID

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels/{objectid}

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid
string
REQUIRED

Your WatchGuard Cloud account ID. You can view your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid
string
REQUIRED

Object ID of the BOVPN tunnel to edit.

Example: ipsgp_123456DH

Request Body

When you send a request to this endpoint, you can include theses parameters in the request body:

routes object	Routes to establish through the tunnel.
endpoint_a object	Route object for the cloud-managed Firebox.
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 1
route string	Specifies the local network that the VPN endpoint advertises or use as part of the tunnel Example: 192.0.1.0/24
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 2
route string	Specifies the local network that the VPN endpoint advertises or use as part of the tunnel Example: 192.0.2.0/24
endpoint_b object	Route object for the remote device or endpoint that the cloud-managed Firebox (endpoint_a) connects to.
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 6
route string	Specifies the local network that the VPN endpoint advertises or use as part of the tunnel Example: 192.168.100.0/24
certs object	Object of certificate references.
endpoint_a string REQUIRED	Certificate name for endpoint A. Example: cert_12345_ABCDEFGHIJKLMNOP
routes object	Routes to establish through the tunnel.
endpoint_a object	Route object for the cloud-managed Firebox.
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 1
route string	Specifies the local network that the VPN endpoint advertises or use as part of the tunnel Example: 10.0.1.0/24
endpoint_b object	Route object for the Firebox.
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 5
route string	Specifies the local network that the VPN endpoint advertises or use as part of the tunnel Example: 10.0.2.0/24
certs object	Object of certificate references.
endpoint_a string	Certificate name for endpoint A. Example: cert_12345_ABCDEFGHIJKLMNOP
endpoint_b string	Certificate name for endpoint B. Example: cert_67890_QRSTUVWXZABCDEF

Example Request

This request modifies the routes and certificates for a BOVPN tunnel.

                    curl -X PATCH 
https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/{accountid}/bovpn/ipsec/tunnels/ipsgp_123456DH
-H 'Accept: application/json'
-H 'Content-Type: application/json'
-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE5mM2FXTHhoSmEza0ltcEFMbnluT05DcFdIT2tZPSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiJjNDQyMTJlMi05MmI1LTRiOTYtYTRmNS1lYWRlODA4OTM1YjIiLCJjdXN0b206YXBpX2tleXMiOiJwMHM1UmQzUkF2NlR2d0VuWEx5YUphR2x0ZWtieEFVUzcwVGVzOXlGIiwiaXNzIjoiaHR0cHM6XC9cL2NvZ25pdG8taWRwLnVzLXdlc3QtMi5hbWF6b25hd3MuY29tXC91cy13ZXN0LTJfa3hXeFdrTFZ5IiwiY29nbml0bzp1c2VybmFtZSI6IjAyNjk0OWM1OWI2NzIxOGNfcndfaWQiLCJhdWQiOiIzb3AybDBqazkxN3FudXFoZnVoanRvcXRzZyIsImV2ZW50X2lkIjoiODczM2ZmMjktOGNhMC00ODMyLTg0NzgtMDNiNWIxMDI3NmQ3IiwidG9rZW5fdXNlIjoiaWQiLCJhdXRoX3RpbWUiOjE1NjkzNTM0NDEsIm5hbWUiOiIwMjY5NDljNTliNjcyMThjX3J3X2lkIiwiY3VzdG9tOmFjY291bnRfaWQiOiJBQ0MtMTIzNTA2OCIsImV4cCI6MTU2OTM1NzA0MSwiY3VzdG9tOnJvbGUiOiIxIiwiaWF0IjoxNTY5MzUzNDQxfQ.MUAeG6QyM7Zog8mM--WK2uJVevLRwz8z2KPpGhQbUnHK04Hy_JdO4F4wH6IV0WVENGsBrcjp5boxcBZgdJE46123MGnB0HvghN5IoAZUOkfFPm7SAN68posHqYLoo14YNedc5GtvOzCxTmi9YepvE5LhsoC6Tgyc0e3ABn18gEZsyxmJFcMBHXOMei7AssYSWAdDyoI7j6jZslxmhXj7_h6T9PyqjLxLjFEq5S6oK9u4IVDVBlRxbURaRVAGb7ywfHiZEPDgceV-Wnv0AIhDzj5dL28AmiGIkWtWinF0UD-NSMKN4vtszK2sUWUSl8ZfVNGU650heiAaUAy7XmiqbA'
-d '{
"update_routes": {
	"summary": "Update routes for both endpoints",
	"value": {
		"routes": {
			"endpoint_a": {
				"local_routes": [
						{
					"metric": 1,
					"route": "192.168.1.0/24"
						},
						{
					"metric": 2,
					"route": "192.168.2.0/24"
						}
						]
					},
			"endpoint_b": {
				"local_routes": [
						{
					"metric": 6,
					"route": "192.168.100.0/24"
						}
					]
				}
			}
		}
	},
"update_certificate": {
	"summary": "Update certificate for endpoint_a",
	"value": {
	"certs": {
		"endpoint_a": "cert_12345_ABCDEFGHIJKLMNOP"
		}
	}
},
"update_routes_and_certificate": {
	"summary": "Update both routes and certificate",
	"value": {
	"routes": {
		"endpoint_a": {
			local_routes": [
				{
				"metric": 1,
				"route": "10.0.1.0/24"
				}
			]
		},
		"endpoint_b": {
			"local_routes": [
				{
				"metric": 5,
				"route": "10.0.2.0/24"
				}
			]
		}
},
"certs": {
	"endpoint_a": "cert_12345_ABCDEFGHIJKLMNOP",
	"endpoint_b": "cert_67890_QRSTUVWXZABCDEF"
		}
		}
	}
}

Example Response

This response includes routes and certificate references for a specific BOVPN IPSec tunnel in JSON format:

                {
"id": "string",
"object": "string",
"version": 1,
"account": "WGC-1-123abc456",
"created": 1579907960,
"author": "string",
"name": "string",
"endpoint_a": "string",
"endpoint_b": "string",
"endpoint_b_name": "string",
"disabled": false,
"vpn_type": "route-based",
"address_family": 4,
"auth_method": "psk",
"interfaces": [
	{
	"endpoint_a": {
		"network": "string",
		"ip_address": "192.0.2.1",
		"id": {
			"type": "ip",
			"value": "string"
			},
		"perpetual_resolve": true
		},
	"endpoint_b": {
		"network": "string",
		"ip_address": "192.0.2.1",
		"id": {
			"type": "ip",
			"value": "string"
			},
	"perpetual_resolve": true
	},
	"df_bit": "copy",
	"pmtu_minimum": 1550,
	"pmtu_age": 2147483647
	}
],
"routes": {
	"endpoint_a": {
		"local_networks": [
		{
			"network": "string",
			"metric": 1,
			"nat_base": "192.0.2.0/24",
			"dnat_ip": "192.0.2.1"
			}
		],
		"local_routes": [
			{
			"route": "192.0.2.0/24",
			"metric": 1,
			"nat_base": "192.0.2.0/24",
			"dnat_ip": "192.0.2.1"
			}
		]
	},
	"endpoint_b": {
		"local_networks": [
			{
			"network": "string",
			"metric": 1,
			"nat_base": "192.0.2.0/24",
			"dnat_ip": "192.0.2.1"
			}
		],
		"local_routes": [
			{
			"route": "192.0.2.0/24",
			"metric": 1,
			"nat_base": "192.0.2.0/24",
			"dnat_ip": "192.0.2.1"
			}
		]
	}
},
"vif": {
	"endpoint_a": {
		"vif_dev_name": "string",
		"vif_local_ip": "192.0.2.0/24",
		"vif_remote_ip": "192.0.2.0/24",
		"vif_mtu": 9000,
		"vif_df_bit": "copy"
		},
	"endpoint_b": {
		"vif_dev_name": "string",
		"vif_local_ip": "192.0.2.0/24",
		"vif_remote_ip": "192.0.2.0/24",
		"vif_mtu": 9000,
		"vif_df_bit": "copy"
		}
	},
"certs": {
	"endpoint_a": "DeviceCertificateName",
	"endpoint_b": "RemotePeerCertName"
},
"psk": "stringst",
"psk_encrypted": true,
"shared_p1_settings": false,
"ipsec_tunnel_core": {
		"natt_interval": 20,
		"dpd": {
			"enabled": true,
			"dpd_type": "traffic",
			"idle_time": 30,
			"retries": 5,
			"interval": 30,
			"max_failures": 5
		},
	"ike_proposals": [
			{
			"encryption": "AES-CBC-256",
			"authentication": "SHA2-256",
			"dh_group": "DH-14",
			"lifetime": 24,
			"lifetime_unit": "hours"
			}
		],
	"pfs_dh_group": "DH-14",
	"ipsec_proposals": [
			{
			"protocol": "ESP",
			"encryption": "AES-CBC-256",
			"authentication": "SHA2-256",
			"lifetime": 8,
			"lifetime_unit": "hours",
			"lifebyte": 0,
			"lifebyte_unit": "GB"
			}
		]
	},
	"local_remote_pairs": [
			{
			"enabled": true,
			"local_network": "string",
			"local_address": "192.0.2.0/24",
			"remote_address": "192.0.2.0/24",
			"direction": "in",
			"dnat_ip": "192.0.2.1",
			"nat_base": "192.0.2.0/24"
			}
		]
	}
}

This table lists and describes the data returned in the response:

id string	Unique ID of the IPSec gateway. Example: ipstp_12345_ARBHLJ70Y78rGOIGBS
object string	Type of object.
version integer	Version number of the BOVPN. Example: 1
account string	WatchGuard Cloud account ID.
created integer	Unix time stamp when the object was created.
author string	Author of the gateway pair. Always empty for objects added or updated with the Firebox Management API.
name string	Name of the IPSec gateway pair.
endpoint_a string	ID of endpoint A.
endpoint_b_name string	Name of the second Firebox. Example: CentralVPNServer
vpn_type string	VPN IPSec tunnel type. Must be either route‑based or policy‑based. Default is `route-based`. Example: route-based
address_family integer	IP address family for all gateway endpoints. Default is `4`. This can be one of these values: 4 (IPv4) 6 (IPv6) Example: 4
interfaces array	Array of interface endpoint mappings between endpoint A and endpoint B.
endpoint_a object	Defines the cloud-managed Firebox interface settings.
network string	Network definition for the tunnel. This can be one of these values: External Trusted Optional Example: External
endpoint_b object	Identifies the remote device or endpoint that the cloud-managed Firebox (`endpoint_a`) connects to.
id object	Unique ID for the IPSec gateway.
type string	Gateway endpoint ID type. Default is `ip`. This can be one of these values: ip — An address. fqdn — A fully qualified domain name. ufqdn — A user fully qualified domain name. x500_name — An X.500 distinguished name. Example: ip
value string	Specifies the identifier string (IP address, FQDN, user FQDN, or X.500 Distinguished Name). Depends on `type`. Example: 192.88.99.200
psk string	Pre-shared key (PSK) used for authentication between endpoints. Example: 24681012
ipsec_tunnel_core object	Phase 1 (IKE) and Phase 2 (IPSec) settings, Dead Peer Detection (DPD), and NAT-T keep-alive configurations for the tunnel.
ike_proposals array	Array of IKE Phase 1 proposals that define encryption and authentication settings for tunnel negotiation.
encryption string	Encryption algorithm. This can be one of these values: AES-CBC-128 AES-CBC-192 AES-CBC-256 (Default) AES-GCM-128 AES-GCM-192 AES-GCM-256 Example: AES-CBC-256
dh_group string	Diffie-Hellman group. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 Example: DH-14
lifetime integer	Lifetime of the security association. Specify the number of hours or minutes. The minimum value is 1, and the default value is 24. Example: 24
lifetime_unit string	Specifies the time unit for the `lifetime` value. This can be one of these values: hours (Default) minutes Example: hours
authentication string	The hash algorithm to use to verify message integrity and authenticity. This can be one of these values: SHA2-256 (Default) SHA2-384 SHA2-512 Example: SHA2-256
ipsec_proposals array	Array of IPSec Phase 2 proposals.
dh_group string	Diffie-Hellman group. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 DH-21 Example: DH-14
lifetime integer	Lifetime of the security association. Specify the number of hours or minutes. The minimum value is 1, and the default value is 24. Example: 24
lifetime_unit string	Specifies the time unit for the `lifetime` value. This can be one of these values: hours (Default) minutes Example: hours
authentication string	The hash algorithm to use to verify message integrity and authenticity. This can be one of these values: SHA2-256 (Default) SHA2-384 SHA2-512 Example: SHA2-256
pfs_dh_group string	Diffie-Hellman (DH) group used for Perfect Forward Secrecy (PFS) in Phase 2 of the VPN tunnel. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 DH-21 Example: DH-14
natt_interval integer	Keep-alive interval (in seconds). Specify a number of seconds from 1 through 65535. The default value is 20. Example: 20
dpd object	Dead Peer Detection settings used to detect if the remote peer is no longer responsive.
dpd_type string	Dead Peer Detection type. This can be one of these values: traffic — Default. Based on traffic activity. If no traffic is detected for a specified idle time, DPD messages are sent. timer — Sent at regular intervals, regardless of traffic. Example: traffic
idle_time integer	Amount of time (in seconds) before the peer is considered idle. Specify a number of seconds from 10-300. Default value is 30 Example: 20
retries integer	Number of retries to make before the peer is considered unreachable. Specify a number from 1-30. Default value is 5. Example: 5
routes object	Routes to establish through the tunnel.
endpoint_a object	Route object for the device.
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 1
route string	Route to establish through the tunnel. Example: 192.168.1.0/24
endpoint_b object	Route object for the device that `endpoint_a` connects to.
local_routes array	Array of routes available through the VPN from the local endpoint.
metric integer	Specifies route priority. Lower values have higher priority. Default is 1. Example: 6
route string	Route to establish through the tunnel. Example: 192.168.100.0/24
certs object	Object of certificate references.
endpoint_a string	Certificate name for endpoint A. Example: DeviceCertificateName
endpoint_b string	Certificate name for endpoint B. Example: RemotePeerCertName
vif object	Virtual interface configuration for each VPN endpoint.
endpoint_a object	Route object for the cloud-managed Firebox.
vif_df_bit string	Specifies the DF bit value. This can be one of these values: copy — Copies the DF (Don't Fragment) bit from the original packet. set — Sets the DF bit to 1 (prevent fragmentation). clear — Clears the DF bit (allow fragmentation). Example: set
vif_local_ip string	Local IP address for the virtual interface used in the route-based VPN. Example: 9.9.9.9/32
vif_mtu integer	Maximum packet size (in bytes) that can be transmitted through the virtual interface without fragmentation. Can be an integer between 68 and 9000. Example: 1500
vif_remote_ip string	IP address of the virtual interface in a route-based VPN tunnel. Example: 10.10.10.10/32
endpoint_b object	Route object for the remote device or endpoint that the cloud-managed Firebox (`endpoint_a`) connects to.
vif_local_ip string	Local IP address for the virtual interface used in the route-based VPN. Example: 10.10.10.10/32
vif_remote_ip string	IP address of the virtual interface in a route-based VPN tunnel. Example: 9.9.9.9/32

Delete a BOVPN Tunnel

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels/{objectid}

Make a request to this endpoint to delete a BOVPN IPSec tunnel by name or by object ID.

Delete a BOVPN tunnel by name

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels

Make a request to this endpoint to delete a BOVPN tunnel by name.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid
string
REQUIRED

Your WatchGuard Cloud account ID. You can view your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

name
string
REQUIRED

Name for the gateway pair.

Example: PBoVPN1

Example Request

This request deletes a BOVPN tunnel by name.

                    curl -X DELETE https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/ACC-1234567/bovpn/ipsec/tunnels/tunnels?name=PBoVPN1
	-H 'Accept: application/json'
	-H 'Content-Type: application/json'	
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'	
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE5mM2FXTHhoSmEza0ltcEFMbnluT05DcFdIT2tZPSIsImFsZyI6IlJTMjU2In0._h6T9PyqjLxLjFEq5S6oK9u4IVDVBlRxbURaRVAGb7ywfHiZEPDgceV-Wnv0AIhDzj5dL28AmiqbA'

Example Response

The response returns the deleted BOVPN in JSON format:

                        {
"id": "ipsgp_12345_ARBHLJ70Y78rGOIGBS",
"object": "ipsec_gatewaypair",
"version": 1,
"account": "WGC-1-123abc456",
"created": 1579907960,
"author": "testuser",
"name": "PBoVPN1",
"endpoint_a": "136162",
"endpoint_b_name": "CentralVPNServer",
"vpn_type": "route-based",
"address_family": 4,
"interfaces": [
	{
	"endpoint_a": {
		"network": "External"
		},
	"endpoint_b": {
		"id": {
			"type": "ip",
			"value": "192.88.99.200"
			}
		}
	}
],
"psk": "12345678",
"ipsec_tunnel_core": {
	"ike_proposals": [
			{
		"encryption": "AES-CBC-256",
		"dh_group": "DH-14",
		"lifetime": 24,
		"authentication": "SHA2-256"
		}
	],
	"ipsec_proposals": [
		{
		"encryption": "AES-CBC-256",
		"lifetime": 8,
		"lifebyte": 0,
		"authentication": "SHA2-256"
		}
	],
	"pfs_dh_group": "DH-14",
	"natt_interval": 20,
	"dpd": {
		"dpd_type": "traffic",
		"idle_time": 20,
		"retries": 5
		}
},
"routes": {
	"endpoint_a": {
		"local_routes": [
			{
			"metric": 1,
			"route": "192.168.1.0/24"
			}
		]
	},
	"endpoint_b": {
		"local_routes": [
			{
			"metric": 6,
			"route": "192.168.100.0/24"
			}
		]
	}
},
"vif": {
	"endpoint_a": {
		"vif_df_bit": "set",
		"vif_local_ip": "9.9.9.9/32",
		"vif_mtu": 1399,
		"vif_remote_ip": "10.10.10.10/32"
		},
	"endpoint_b": {
		"vif_local_ip": "10.10.10.10/32",
		"vif_remote_ip": "9.9.9.9/32"
		}
	}
}

This table lists and describes the data returned in the response:

id string	Unique ID of the IPSec gateway. Example: ipstp_12345_ARBHLJ70Y78rGOIGBS
object string	Type of object, typically ipsec_gatewaypair.
version integer	Version number of the BOVPN.
account string	WatchGuard Cloud account ID.
created integer	Unix time stamp when the object was created. Example: 1579909960
author string	Author of the gateway pair. Always empty for objects added or updated with the Firebox Management API.
name string	Name of the IPSec gateway pair.
endpoint_a string	ID of endpoint A.
endpoint_b_name string	Name of the second Firebox. Example: CentralVPNServer
vpn_type string	VPN IPSec tunnel type. Must be either route‑based or policy‑based. Default is `route-based`. Example: route-based
address_family integer	IP address family for all gateway endpoints. Default is `4`. This can be one of these values: 4 (IPv4) 6 (IPv6) Example: 4
interfaces array	Array of interface endpoint mappings between endpoint A and endpoint B.
endpoint_a object	Configuration for endpoint A. Example:
network string	Network ID for endpoint A. Example: External
endpoint_b object	Configuration for endpoint B. Example:
id object	Peer gateway identifier object. Example:
type string	Gateway endpoint ID type. Default is `ip`. This can be one of these values: ip — An address. fqdn — A fully qualified domain name. ufqdn — A user fully qualified domain name. x500_name — An X.500 distinguished name. Example: ip
value string	Peer gateway identifier value (IP or FQDN). Example: 192.88.99.200
psk string	Pre-shared key used for authentication. Example: 12345678
routes object	Routing configuration for both endpoints. Example:
local_routes array	Local routes for endpoint. Example:
route string	CIDR-formatted route for endpoint. Example: 192.168.1.0/24
metric integer	Route metric for endpoint. Example: 1
ipsec_tunnel_core object	Core IPSec tunnel configuration.
ike_proposals array	IKE Phase 1 proposals. Example:
encryption string	Encryption algorithm. This can be one of these values: AES-CBC-128 AES-CBC-192 AES-CBC-256 (Default) AES-GCM-128 AES-GCM-192 AES-GCM-256 Example: AES-CBC-256
authentication string	The hash algorithm to use to verify message integrity and authenticity. This can be one of these values: SHA2-256 (Default) SHA2-384 SHA2-512 Example: SHA2-256
dh_group string	Diffie-Hellman group. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 Example: DH-14
lifetime integer	Lifetime of the security association. Specify the number of hours or minutes. The minimum value is 1, and the default value is 24. Example: 24
lifetime_unit string	Specifies the time unit for the `lifetime` value. This can be one of these values: hours (Default) minutes Example: hours
lifebyte integer	Phase 2 byte lifetime (0 disables). Example: 0
pfs_dh_group string	Diffie-Hellman group for Perfect Forward Secrecy. Example: DH-14
natt_interval integer	Keep-alive interval (in seconds). Specify a number of seconds from 1 through 65535. The default value is 20. Example: 20
dpd object	Dead Peer Detection settings. Example:
dpd_type string	Dead Peer Detection type (traffic or timer). Example: traffic
idle_time integer	Idle time before DPD triggers. Example: 20
retries integer	Number of retries to make before the peer is considered unreachable. Specify a number from 1-30. Default value is 5. Example: 5
vif object	Virtual interface configuration for endpoints. Example:
vif_df_bit string	Specifies the DF bit value. This can be one of these values: copy — Copies the DF (Don't Fragment) bit from the original packet. set — Sets the DF bit to 1 (prevent fragmentation). clear — Clears the DF bit (allow fragmentation). Example: set
vif_local_ip string	Local VIF IP for endpoint. Example: 9.9.9.9/32
vif_mtu integer	Maximum packet size (in bytes) that can be transmitted through the virtual interface without fragmentation. Can be an integer between 68 and 9000. Example: 1500
vif_remote_ip string	Remote VIF IP for endpoint. Example: 10.10.10.10/32

Delete a BOVPN tunnel by Object ID

/{v1}/configuration/{accountid}/bovpn/ipsec/tunnels/{objectid}

Make a request to this endpoint to delete a BOVPN tunnel by object ID.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid
string
REQUIRED

Your WatchGuard Cloud account ID. You can view your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid
string
REQUIRED

Each BOVPN tunnel has a unique ID in WatchGuard Cloud, which appears in the URL of the BOVPN configuration page.

Example: When the BOVPN configuration page URL is https://usa.cloud.watchguard.com/ss-tenant/services/ACC-1234567/fb/device/FB-12345/configuration/bovpn/tunnel/ipsgp_123456DH, the tunnel ID is ipsgp_123456DH.

Example Request

This request deletes a BOVPN tunnel by object ID.

                    curl -X DELETE https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/ACC-1234567/bovpn/ipsec/tunnels/ipsgp_123456DH
	-H 'Accept: application/json'
	-H 'Content-Type: application/json'	
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'	
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE5mM2FXTHhoSmEza0ltcEFMbnluT05DcFdIT2tZPSIsImFsZyI6IlJTMjU2In0._h6T9PyqjLxLjFEq5S6oK9u4IVDVBlRxbURaRVAGb7ywfHiZEPDgceV-Wnv0AIhDzj5dL28AmiqbA'

Example Response

The response returns the deleted BOVPN in JSON format:

                        {
"id": "ipsgp_12345_ARBHLJ70Y78rGOIGBS",
"object": "ipsec_gatewaypair",
"version": 1,
"account": "WGC-1-123abc456",
"created": 1579907960,
"author": "testuser",
"name": "PBoVPN1",
"endpoint_a": "136162",
"endpoint_b_name": "CentralVPNServer",
"vpn_type": "route-based",
"address_family": 4,
"interfaces": [
	{
	"endpoint_a": {
		"network": "External"
		},
	"endpoint_b": {
		"id": {
			"type": "ip",
			"value": "192.88.99.200"
			}
		}
	}
],
"psk": "12345678",
"ipsec_tunnel_core": {
	"ike_proposals": [
			{
		"encryption": "AES-CBC-256",
		"dh_group": "DH-14",
		"lifetime": 24,
		"authentication": "SHA2-256"
		}
	],
	"ipsec_proposals": [
		{
		"encryption": "AES-CBC-256",
		"lifetime": 8,
		"lifebyte": 0,
		"authentication": "SHA2-256"
		}
	],
	"pfs_dh_group": "DH-14",
	"natt_interval": 20,
	"dpd": {
		"dpd_type": "traffic",
		"idle_time": 20,
		"retries": 5
		}
},
"routes": {
	"endpoint_a": {
		"local_routes": [
			{
			"metric": 1,
			"route": "192.168.1.0/24"
			}
		]
	},
	"endpoint_b": {
		"local_routes": [
			{
			"metric": 6,
			"route": "192.168.100.0/24"
			}
		]
	}
},
"vif": {
	"endpoint_a": {
		"vif_df_bit": "set",
		"vif_local_ip": "9.9.9.9/32",
		"vif_mtu": 1399,
		"vif_remote_ip": "10.10.10.10/32"
		},
	"endpoint_b": {
		"vif_local_ip": "10.10.10.10/32",
		"vif_remote_ip": "9.9.9.9/32"
		}
	}
}

This table lists and describes the data returned in the response:

id string	Unique ID of the IPSec gateway. Example: ipstp_12345_ARBHLJ70Y78rGOIGBS
object string	Type of object, typically ipsec_gatewaypair.
version integer	Version number of the BOVPN.
account string	WatchGuard Cloud account ID.
created integer	Unix time stamp when the object was created. Example: 1579909960
author string	Author of the gateway pair. Always empty for objects added or updated with the Firebox Management API.
name string	Name of the IPSec gateway pair.
endpoint_a string	ID of endpoint A.
endpoint_b_name string	Name of the second Firebox. Example: CentralVPNServer
vpn_type string	VPN IPSec tunnel type. Must be either route‑based or policy‑based. Default is `route-based`. Example: route-based
address_family integer	IP address family for all gateway endpoints. Default is `4`. This can be one of these values: 4 (IPv4) 6 (IPv6) Example: 4
interfaces array	Array of interface endpoint mappings between endpoint A and endpoint B.
endpoint_a object	Configuration for endpoint A. Example:
network string	Network ID for endpoint A. Example: External
endpoint_b object	Configuration for endpoint B. Example:
id object	Peer gateway identifier object. Example:
type string	Gateway endpoint ID type. Default is `ip`. This can be one of these values: ip — An address. fqdn — A fully qualified domain name. ufqdn — A user fully qualified domain name. x500_name — An X.500 distinguished name. Example: ip
value string	Peer gateway identifier value (IP or FQDN). Example: 192.88.99.200
psk string	Pre-shared key used for authentication. Example: 12345678
routes object	Routing configuration for both endpoints. Example:
local_routes array	Local routes for endpoint. Example:
route string	CIDR-formatted route for endpoint. Example: 192.168.1.0/24
metric integer	Route metric for endpoint. Example: 1
ipsec_tunnel_core object	Core IPSec tunnel configuration.
ike_proposals array	IKE Phase 1 proposals. Example:
encryption string	Encryption algorithm. This can be one of these values: AES-CBC-128 AES-CBC-192 AES-CBC-256 (Default) AES-GCM-128 AES-GCM-192 AES-GCM-256 Example: AES-CBC-256
authentication string	The hash algorithm to use to verify message integrity and authenticity. This can be one of these values: SHA2-256 (Default) SHA2-384 SHA2-512 Example: SHA2-256
dh_group string	Diffie-Hellman group. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 Example: DH-14
lifetime integer	Lifetime of the security association. Specify the number of hours or minutes. The minimum value is 1, and the default value is 24. Example: 24
lifetime_unit string	Specifies the time unit for the `lifetime` value. This can be one of these values: hours (Default) minutes Example: hours
lifebyte integer	Phase 2 byte lifetime (0 disables). Example: 0
pfs_dh_group string	Diffie-Hellman group for Perfect Forward Secrecy. Example: DH-14
natt_interval integer	Keep-alive interval (in seconds). Specify a number of seconds from 1 through 65535. The default value is 20. Example: 20
dpd object	Dead Peer Detection settings. Example:
dpd_type string	Dead Peer Detection type (traffic or timer). Example: traffic
idle_time integer	Idle time before DPD triggers. Example: 20
retries integer	Number of retries to make before the peer is considered unreachable. Specify a number from 1-30. Default value is 5. Example: 5
vif object	Virtual interface configuration for endpoints. Example:
vif_df_bit string	Specifies the DF bit value. This can be one of these values: copy — Copies the DF (Don't Fragment) bit from the original packet. set — Sets the DF bit to 1 (prevent fragmentation). clear — Clears the DF bit (allow fragmentation). Example: set
vif_local_ip string	Local VIF IP for endpoint. Example: 9.9.9.9/32
vif_mtu integer	Maximum packet size (in bytes) that can be transmitted through the virtual interface without fragmentation. Can be an integer between 68 and 9000. Example: 1500
vif_remote_ip string	Remote VIF IP for endpoint. Example: 10.10.10.10/32

Manage Shared Phase 1 Settings

/{v1}/configuration/{accountid}/bovpn/ipsec/p1_shared_settings

The BOVPN tunnel uses a shared Phase 1 configuration when the remote gateway endpoint is dynamic. You manage this configuration separately from individual tunnels, and the configuration applies to all BOVPN tunnels on the Firebox that connect to remote endpoints with dynamic IP addresses.

Get Shared Phase 1 Settings

/{v1}/configuration/{accountid}/bovpn/ipsec/p1_shared_settings

Make a request to this endpoint to get the BOVPN IPSec Phase‑1 (P1) shared settings object(s) for an account or device.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid
string
REQUIRED

Your WatchGuard Cloud account ID. You can view your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Request Parameters

When you send a request to this endpoint, you can include these request parameters:

device
string
integer

Each device has a unique ID in WatchGuard Cloud, which appears in the URL of the Device Summary page.

The device ID can be a string or an integer for a standalone device. For example, if the Device Summary page URL is https://usa.cloud.watchguard.com/services/fb/device/FB-12345/summary, the device ID is FB-12345 or 12345.

For FireClusters, specify the full device ID. For example, FBCL-12345.

Example: FB-12345

Example Request

This request returns the BOVPN IPSec P1 shared settings for a device:

                    curl -X GET https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/ACC-1234567/bovpn/ipsec/p1_shared_settings?device=12345
	-H 'Accept: application/json'
	-H 'Content-Type: application/json'
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE5mM2FXTHhl8ZfVNGU650heiAaUAy7XmiqbA'

Example Response

The response returns the object that represents the shared P1 settings for the device or all devices, in JSON format:

                        {
"id": "ipstp_12345_ARBHLJ70Y78rGOIGBS",
"object": "ipsec_gatewaytemplate",
"version": 1,
"account": "ACC-1234567",
"created": 1579907960,
"device": "12345",
"author": "testuser",
"ike_proposals": [
	{
	"encryption": "AES-GCM-256",
	"authentication": "SHA2-512",
	"dh_group": "DH-21",
	"lifetime": 8
	}
	],
	"natt_interval": 20
}

This table lists and describes the data returned in the response:

id string	Unique ID of the IPSec gateway. Example: ipstp_12345_ARBHLJ70Y78rGOIGBS
object string	Type of object. Example: ipsec_gatewaytemplate
version integer	Version number of the BOVPN. Example: 1
account string	WatchGuard Cloud account ID. Example: WGC-1-123abc456
created integer	Unix time stamp when the object was created. Example: 1579907960
device string	Firebox device ID. Example: 12345
author string	Author of the gateway pair. Always empty for objects added or updated with the Firebox Management API.
ike_proposals array	Array of IKE proposals.
encryption string	Encryption algorithm. This can be one of these values: AES-CBC-128 AES-CBC-192 AES-CBC-256 (Default) AES-GCM-128 AES-GCM-192 AES-GCM-256 Example: AES-GCM-256
authentication string	The hash algorithm to use to verify message integrity and authenticity. This can be one of these values: SHA2-256 (Default) SHA2-384 SHA2-512 Example: SHA2-512
dh_group string	Diffie-Hellman (DH) group used with the IKE key exchange process. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 DH-21 Example: DH-14
lifetime integer	Lifetime of the security association. Specify the number of hours or minutes. The minimum value is 1, and the default value is 24. Example: 24
lifetime_unit string	Specifies the time unit for the `lifetime` value. This can be one of these values: hours (Default) minutes Example: hours
natt_interval integer	Keep-alive interval (in seconds). Specify a number of seconds from 1 through 65535. The default value is 20. Example: 20

Create Shared Phase 1 Settings

/{v1}/configuration/{accountid}/bovpn/ipsec/p1_shared_settings

Make a request to this endpoint to create a shared P1 settings object. One object can exist for each Firebox. The Firebox ID is specified in the device attribute of the configuration object.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid
string
REQUIRED

Your WatchGuard Cloud account ID. You can view your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Request Body

When you send a request to this endpoint, you can include these parameters in the request body:

device string integer	Each device has a unique ID in WatchGuard Cloud, which appears in the URL of the Device Summary page. The device ID can be a string or an integer for a standalone device. For example, if the Device Summary page URL is https://usa.cloud.watchguard.com/services/fb/device/FB-12345/summary, the device ID is FB-12345 or 12345. For FireClusters, specify the full device ID. For example, FBCL-12345. Example: FB-12345
ike_proposals array REQUIRED	Array of IKE Phase 1 proposals that define encryption and authentication settings for tunnel negotiation.
encryption string	Encryption algorithm. This can be one of these values: AES-CBC-128 AES-CBC-192 AES-CBC-256 (Default) AES-GCM-128 AES-GCM-192 AES-GCM-256 Example: AES-GCM-256
authentication string	The hash algorithm to use to verify message integrity and authenticity. This can be one of these values: SHA2-256 (Default) SHA2-384 SHA2-512 Example: SHA2-512
dh_group string	Diffie-Hellman (DH) group used with the IKE key exchange process. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 DH-21 Example: DH-14
lifetime integer	Lifetime of the security association. Specify the number of hours or minutes. The minimum value is 1, and the default value is 24. Example: 24
lifetime_unit string	Specifies the time unit for the lifetime value. This can be one of these values: hours (Default) minutes Example: hours
natt_interval integer	Keep-alive interval (in seconds). Specify a number of seconds from 1 through 65535. The default value is 20. Example: 20

Example Request

This request creates an IKEv2 shared settings object:

                    curl -X POST https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/ACC-1234567/bovpn/ipsec/p1_shared_settings
	-H 'Accept: application/json'
	-H 'Content-Type: application/json'
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE5mM2FXTHhoSmEza0ltcEFMbnluT05DcFdIT2tZPSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiJjNDQyMTJlMi05MmI1LTRiOTYtYTRmNS1lYWRlODA4OTM1YjIiLCJjdXN0b206YXBpX2tleXMiOiJwMHM1UmQzUkF2NlR2d0VuWEx5YUphR2x0ZWtieEFVUzcwVGVzOXlGIiwiaXNzIjoiaHR0cHM6XC9cL2NvZ25pdG8taWRwLnVzLXdlc3QtMi5hbWF6b25hd3MuY29tXC91cy13ZXN0LTJfa3hXeFdrTFZ5IiwiY29nbml0bzp1c2VybmFtZSI6IjAyNjk0OWM1OWI2NzIxOGNfcndfaWQiLCJhdWQiOiIzb3AybDBqazkxN3FudXFoZnVoanRvcXRzZyIsImV2ZW50X2lkIjoiODczM2ZmMjktOGNhMC00ODMyLTg0NzgtMDNiNWIxMDI3NmQ3IiwidG9rZW5fdXNlIjoiaWQiLCJhdXRoX3RpbWUiOjE1NjkzNTM0NDEsIm5hbWUiOiIwMjY5NDljNTliNjcyMThjX3J3X2lkIiwiY3VzdG9tOmFjY291bnRfaWQiOiJBQ0MtMTIzNTA2OCIsImV4cCI6MTU2OTM1NzA0MSwiY3VzdG9tOnJvbGUiOiIxIiwiaWF0IjoxNTY5MzUzNDQxfQ.MUAeG6QyM7Zog8mM--WK2uJVevLRwz8z2KPpGhQbUnHK04Hy_JdO4F4wH6IV0WVENGsBrcjp5boxcBZgdJE46123MGnB0HvghN5IoAZUOkfFPm7SAN68posHqYLoo14YNedc5GtvOzCxTmi9YepvE5LhsoC6Tgyc0e3ABn18gEZsyxmJFcMBHXOMei7AssYSWAdDyoI7j6jZslxmhXj7_h6T9PyqjLxLjFEq5S6oK9u4IVDVBlRxbURaRVAGb7ywfHiZEPDgceV-Wnv0AIhDzj5dL28AmiGIkWtWinF0UD-NSMKN4vtszK2sUWUSl8ZfVNGU650heiAaUAy7XmiqbA'
-d '{
	"device": "12345",
	"ike_proposals": [
	{
	"encryption":"AES-CBC-256",
	"dh_group":"DH-14",
	"lifetime":24,
	"lifetime_unit":"hours",
	"authentication":"SHA2-256"
	}
	],
	"natt_interval":20
}'

Example Response

The response represents the BOVPN IPSec P1 shared settings object for a Firebox in JSON format:

                        
{
"id": "ipstp_12345_ARBHLJ70Y78rGOIGBS",
"object": "ipsec_gatewaytemplate",
"version": 1,
"account": "WGC-1-123abc456",
"created": 1579907960,
"device": "12345",
"author": "testuser",
"ike_proposals": [
	{
	"encryption": "AES-CBC-256",
	"authentication": "SHA2-256",
	"dh_group": "DH-14",
	"lifetime": 24,
	"lifetime_unit": "hours"
	}
	],
}
"natt_interval": 20
}'

This table lists and describes the data returned in the response:

id string	Unique ID of the IPSec gateway. Example: ipstp_12345_ARBHLJ70Y78rGOIGBS
object string	Type of object. Example: ipsec_gatewaytemplate
version integer	Version number of the BOVPN. Example: 1
account string	WatchGuard Cloud account ID. Example: WGC-1-123abc456
created integer	Unix time stamp when the object was created. Example: 1579907960
device string	Firebox device ID. Example: 12345
author string	Author of the gateway pair. Always empty for objects added or updated with the Firebox Management API.
ike_proposals array	Array of IKE Phase 1 proposals that define encryption and authentication settings for tunnel negotiation.
encryption string	Encryption algorithm. This can be one of these values: AES-CBC-128 AES-CBC-192 AES-CBC-256 (Default) AES-GCM-128 AES-GCM-192 AES-GCM-256 Example: AES-GCM-256
authentication string	The hash algorithm to use to verify message integrity and authenticity. This can be one of these values: SHA2-256 (Default) SHA2-384 SHA2-512 Example: SHA2-512
dh_group string	Diffie-Hellman (DH) group used with the IKE key exchange process. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 DH-21 Example: DH-14
lifetime integer	Lifetime of the security association. Specify the number of hours or minutes. The minimum value is 1, and the default value is 24. Example: 24
lifetime_unit string	Specifies the time unit for the `lifetime` value. This can be one of these values: hours (Default) minutes Example: hours
natt_interval integer	Keep-alive interval (in seconds). Specify a number of seconds from 1 through 65535. The default value is 20. Example: 20

Update Shared Phase 1 Settings

/{v1}/configuration/{accountid}/bovpn/ipsec/p1_shared_settings

Make a request to this endpoint to update the specified BOVPN IPSec P1 shared settings object for the device. The Firebox ID is specified in the device attribute of the configuration object.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid
string
REQUIRED

Your WatchGuard Cloud account ID. You can view your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Request Body

When you send a request to this endpoint, you can include these parameters in the request body:

id string	Unique ID of the IPSec gateway. Example: ipstp_12345_ARBHLJ70Y78rGOIGBS
object string	Type of object. Example: ipsec_gatewaytemplate
version integer REQUIRED	Version number of the BOVPN. Example: 1
account string	WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string	Firebox device ID. Example: 12345
ike_proposals array REQUIRED	Array of IKE Phase 1 proposals that define encryption and authentication settings for tunnel negotiation.
encryption string	Encryption algorithm. This can be one of these values: AES-CBC-128 AES-CBC-192 AES-CBC-256 (Default) AES-GCM-128 AES-GCM-192 AES-GCM-256 Example: AES-GCM-256
authentication string	The hash algorithm to use to verify message integrity and authenticity. This can be one of these values: SHA2-256 (Default) SHA2-384 SHA2-512 Example: SHA2-512
dh_group string	Diffie-Hellman (DH) group used with the IKE key exchange process. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 DH-21 Example: DH-14
lifetime integer	Lifetime of the security association. Specify the number of hours or minutes. The minimum value is 1, and the default value is 24. Example: 24
lifetime_unit string	Specifies the time unit for the `lifetime` value. This can be one of these values: hours (Default) minutes Example: hours
natt_interval integer	Keep-alive interval (in seconds). Specify a number of seconds from 1 through 65535. The default value is 20. Example: 20

Example Request

This request updates the specified BOVPN IPSec P1 shared settings object for a device.

                    curl -X PUT https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/ACC-1234567/bovpn/ipsec/p1_shared_settings
	-H 'Accept: application/json'
	-H 'Content-Type: application/json'
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE5mM2FXTHhoSmEza0ltcEFMbnluT05DcFdIT2tZPSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiJjNDQyMTJlMi05MmI1LTRiOTYtYTRmNS1lYWRlODA4OTM1YjIiLCJjdXN0b206YXBpX2tleXMiOiJwMHM1UmQzUkF2NlR2d0VuWEx5YUphR2x0ZWtieEFVUzcwVGVzOXlGIiwiaXNzIjoiaHR0cHM6XC9cL2NvZ25pdG8taWRwLnVzLXdlc3QtMi5hbWF6b25hd3MuY29tXC91cy13ZXN0LTJfa3hXeFdrTFZ5IiwiY29nbml0bzp1c2VybmFtZSI6IjAyNjk0OWM1OWI2NzIxOGNfcndfaWQiLCJhdWQiOiIzb3AybDBqazkxN3FudXFoZnVoanRvcXRzZyIsImV2ZW50X2lkIjoiODczM2ZmMjktOGNhMC00ODMyLTg0NzgtMDNiNWIxMDI3NmQ3IiwidG9rZW5fdXNlIjoiaWQiLCJhdXRoX3RpbWUiOjE1NjkzNTM0NDEsIm5hbWUiOiIwMjY5NDljNTliNjcyMThjX3J3X2lkIiwiY3VzdG9tOmFjY291bnRfaWQiOiJBQ0MtMTIzNTA2OCIsImV4cCI6MTU2OTM1NzA0MSwiY3VzdG9tOnJvbGUiOiIxIiwiaWF0IjoxNTY5MzUzNDQxfQ.MUAeG6QyM7Zog8mM--WK2uJVevLRwz8z2KPpGhQbUnHK04Hy_JdO4F4wH6IV0WVENGsBrcjp5boxcBZgdJE46123MGnB0HvghN5IoAZUOkfFPm7SAN68posHqYLoo14YNedc5GtvOzCxTmi9YepvE5LhsoC6Tgyc0e3ABn18gEZsyxmJFcMBHXOMei7AssYSWAdDyoI7j6jZslxmhXj7_h6T9PyqjLxLjFEq5S6oK9u4IVDVBlRxbURaRVAGb7ywfHiZEPDgceV-Wnv0AIhDzj5dL28AmiGIkWtWinF0UD-NSMKN4vtszK2sUWUSl8ZfVNGU650heiAaUAy7XmiqbA'
-d '{
"id": "ipstp_12345_ARBHLJ70Y78rGOIGBS",
"object": "ipsec_gatewaytemplate",
"version": 1,
"account": "WGC-1-123abc456",
"device": "12345",
"ike_proposals": [
	{
	"encryption": "AES-GCM-256",
	"authentication": "SHA2-512",
	"dh_group": "DH-20",
	"lifetime": 16
	}
	],
"natt_interval": 20
}'

Example Response

The response represents the BOVPN IPSec P1 shared settings object for a Firebox in JSON format:

                        {
"id": "ipstp_12345_ARBHLJ70Y78rGOIGBS",
"object": "ipsec_gatewaytemplate",
"version": 1,
"account": "WGC-1-123abc456",
"created": 1579907960,
"device": "12345",
"author": "testuser",
"ike_proposals": [
	{
	"encryption": "AES-CBC-256",
	"authentication": "SHA2-256",
	"dh_group": "DH-14",
	"lifetime": 24,
	"lifetime_unit": "hours"
	}
	],
}
"natt_interval": 20
}'

This table lists and describes the data returned in the response:

id string	Unique ID of the IPSec gateway. Example: ipstp_12345_ARBHLJ70Y78rGOIGBS
object string	Type of object. Example: ipsec_gatewaytemplate
version integer	Version number of the BOVPN. Example: 1
account string	WatchGuard Cloud account ID. Example: WGC-1-123abc456
created integer	Unix time stamp when the object was created. Example: 1579907960
device string	Firebox device ID. Example: 12345
author string	Author of the gateway pair. Always empty for objects added or updated with the Firebox Management API.
ike_proposals array	Array of IKE Phase 1 proposals that define encryption and authentication settings for tunnel negotiation.
encryption string	Encryption algorithm. This can be one of these values: AES-CBC-128 AES-CBC-192 AES-CBC-256 (Default) AES-GCM-128 AES-GCM-192 AES-GCM-256 Example: AES-GCM-256
authentication string	The hash algorithm to use to verify message integrity and authenticity. This can be one of these values: SHA2-256 (Default) SHA2-384 SHA2-512 Example: SHA2-512
dh_group string	Diffie-Hellman (DH) group used with the IKE key exchange process. This can be one of these values: DH-14 (Default) DH-15 DH-19 DH-20 DH-21 Example: DH-14
lifetime integer	Lifetime of the security association. Specify the number of hours or minutes. The minimum value is 1, and the default value is 24. Example: 24
lifetime_unit string	Specifies the time unit for the `lifetime` value. This can be one of these values: hours (Default) minutes Example: hours
natt_interval integer	Keep-alive interval (in seconds). Specify a number of seconds from 1 through 65535. The default value is 20. Example: 20