检查 IPSec VPN 会话的已实现状态

发送 IPSec VPN 会话的配置更新请求后，可以检查请求的状态是否已在传输节点上的 NSX 本地控制平面中成功处理。

创建 IPSec VPN 会话时，会创建多个实体：IKE 配置文件、DPD 配置文件、隧道配置文件、本地端点、IPSec VPN 服务和 IPSec VPN 会话。所有这些实体都共享同一个 IPSecVPNSession SPAN，因此可以使用相同的 GET API 调用获取 IPSec VPN 会话的所有实体的实现状态。可以仅使用 API 检查实现状态。

前提条件

熟悉 IPSec VPN。请参见了解 IPSec VPN。
确认已配置 IPSec VPN。请参见添加 NSX IPSec VPN 服务。
您必须具有 NSX Manager API 的访问权限。

过程

发送 POST、PUT 或 DELETE 请求 API 调用。

例如：

PUT https://<nsx-mgr>/api/v1/vpn/ipsec/sessions/8dd1c386-9b2c-4448-85b8-51ff649fae4f
{
   "resource_type": "PolicyBasedIPSecVPNSession",
   "id": "8dd1c386-9b2c-4448-85b8-51ff649fae4f",
   "display_name": "Test RZ_UPDATED",
   "ipsec_vpn_service_id": "7adfa455-a6fc-4934-a919-f5728957364c",
   "peer_endpoint_id":  "17263ca6-dce4-4c29-bd8a-e7d12bd1a82d",
   "local_endpoint_id": "91ebfa0a-820f-41ab-bd87-f0fb1f24e7c8",
   "enabled": true,
   "policy_rules": [
       {
           "id": "1026",
           "sources": [
               {
                   "subnet": "1.1.1.0/24"
               }
           ],
           "logged": true,
           "destinations": [
               {
                   "subnet": "2.1.4..0/24"
               }
           ],
           "action": "PROTECT",
           "enabled": true,
           "_revision": 1
       }
   ]
}

在返回的响应标头中找到 x-nsx-requestid 的值并复制。
例如：
```
x-nsx-requestid   e550100d-f722-40cc-9de6-cf84d3da3ccb
```

使用以下 GET 调用请求 IPSec VPN 会话的实现状态。

GET https://<nsx-mgr>/api/v1/vpn/ipsec/sessions/<ipsec-vpn-session-id>/state?request_id=<request-id>

以下 API 调用使用上述步骤所用示例中的 id 和 x-nsx-requestid 值。

GET https://<nsx-mgr>/api/v1/vpn/ipsec/sessions/8dd1c386-9b2c-4448-85b8-51ff649fae4f/state?request_id=e550100d-f722-40cc-9de6-cf84d3da3ccb

以下是实现状态为 in_progress 时收到的响应示例。

{
  "details": [
    {
      "sub_system_type": "TransportNode",
      "sub_system_id": "fe651e63-04bd-43a4-a8ec-45381a3b71b9",
      "state": "in_progress",
      "failure_message": "CCP Id:ab5958df-d98a-468e-a72b-d89dcdae5346, Message:State realization is in progress at the node."
    },
    {
      "sub_system_type": "TransportNode",
      "sub_system_id": "ebe174ac-e4f1-4135-ba72-3dd2eb7099e3",
      "state": "in_sync"
    }
  ],
  "state": "in_progress",
  "failure_message": "The state realization is in progress at transport nodes."
}

以下是实现状态为 in_sync 时收到的响应示例。

{
    "details": [
        {
            "sub_system_type": "TransportNode",
            "sub_system_id":  "7046e8f4-a680-11e8-9bc3-020020593f59",
            "state": "in_sync"
        }
    ],
    "state": "in_sync"
}

以下是实现状态为 unknown 时可能收到的响应示例。

{
    "state": "unknown",
    "failure_message": "Unable to get response from any CCP node. Please retry operation after some time."
}

{
    "details": [
       {
          "sub_system_type": "TransportNode",
          "sub_system_id": "3e643776-5def-11e8-94ae-020022e7749b",
          "state": "unknown", 
          "failure_message": "CCP Id:ab5958df-d98a-468e-a72b-d89dcdae5346, Message: Unable to get response from the node. Please retry operation after some time."
       },
       {
          "sub_system_type": "TransportNode",
          "sub_system_id": "4784ca0a-5def-11e8-93be-020022f94b73",
          "state": "in_sync"
       }
    ],
    "state": "unknown",
    "failure_message": "The state realization is unknown at transport nodes"
}

执行实体 DELETE 操作后，可能会收到 NOT_FOUND 状态，如下例所示。

{
   "http_status": "NOT_FOUND",
   "error_code": 600, 
   "module_name": "common-services",
   "error_message": "The operation failed because object identifier LogicalRouter/61746f54-7ab8-4702-93fe-6ddeb804 is missing: Object identifiers are case sensitive.."
}

如果禁用与会话关联的 IPSec VPN 服务，则会收到 BAD_REQUEST 响应，如下例所示。

{
    "httpStatus": "BAD_REQUEST",
    "error_code": 110199,
    "module_name": "VPN",
    "error_message": "VPN service f9cfe508-05e3-4e1d-b253-fed096bb2b63 associated with the session 8dd1c386-9b2c-4448-85b8-51ff649fae4f is disabled. Can not get the realization status."
}