uip admin integrations vpn

Syntax and options for `uip admin integrations vpn`, which manages VPN gateways and site-to-site connections that let cloud and serverless robots reach on-prem networks privately.

uip admin integrations vpn manages VPN gateways and their site-to-site connections. A VPN gateway lets cloud and serverless robots reach on-prem networks privately over a site-to-site IPsec tunnel, hosted in a network whose address space you provide at create time. A gateway can have multiple connections, each peering the gateway with one on-prem network.

This command tree is implemented by the separately-published @uipath/admin-vpngateway-commands package, one of several packages composed into uip admin (see the uip admin overview) — it owns no top-level CLI verb of its own; integrations is a shared parent namespace other admin integration tools may register under later.

Conceptos

• Asynchronous operations. Every mutating verb (create, edit, redeploy, delete, refresh) returns as soon as the task is enqueued, not once it's applied. Poll gateways get <key> / connections get <key> until state reaches a terminal value (Deployed for a gateway, anything other than Connecting/Updating for a connection) before issuing the next mutation. Concurrent mutations on the same gateway return HTTP 409 — wait a few seconds and retry.
• Destructive verbs require --confirm. gateways delete and connections delete refuse to run without it, specifically so non-interactive callers can't trigger deletion by accident. connections edit also requires --confirm on every call, since most edits cause a brief tunnel renegotiation and connectivity drop.
• List-replace semantics on edit. For both gateways edit and connections edit, list-shaped flags (--dns-server, --apipa-address, --trusted-cert, --target-address-space) replace the existing list wholesale when passed — re-pass every entry you want to keep. Each has a matching --clear-* flag to empty the list explicitly, mutually exclusive with the populated form.
• connections edit always requires --shared-key. Even when you're not changing it, you must re-supply the current pre-shared key on every edit call — the backend has no partial-update path for it.
• IPsec policy is all-or-nothing. If you set any of the 8 IPsec/IKE flags (--ipsec-sa-lifetime, --ipsec-sa-data-size, --ipsec-encryption, --ipsec-integrity, --ike-encryption, --ike-integrity, --dh-group, --pfs-group), you must set all 8. A GCMAES --ipsec-encryption variant requires an identical GCMAES --ipsec-integrity. connections edit preserves the existing policy by default; pass all 8 flags to replace it, or --clear-ipsec to remove it (mutually exclusive with the 8 flags).
• BGP pairing convention. --bgp-peer-address (the on-prem device's BGP endpoint) must be the /30 partner of an address in the gateway's --apipa-address pool, both drawn from 169.254.21.0/24 or 169.254.22.0/24. Convention: the gateway takes the higher usable address of the /30 (e.g. .10), the on-prem peer takes the lower (e.g. .9). Enabling BGP on a connection that wasn't BGP-enabled before requires passing both --asn and --bgp-peer-address together — the CLI rejects the edit upfront otherwise.
• --vnet-address-space is immutable after gateways create and must be a CIDR with prefix between /8 and /27; the 169.254.0.0/16 APIPA range is rejected because it collides with the BGP APIPA blocks used internally.

Sinopsis

uip admin integrations vpn gateways list [--tenant <name>]
uip admin integrations vpn gateways get <key> [--tenant <name>]
uip admin integrations vpn gateways tenant-config [--tenant <name>]
uip admin integrations vpn gateways create --name <name> --vnet-address-space <cidr> [--description <text>] [--dns-server <ip>]... [--apipa-address <ip>]... [--trusted-cert <name=base64>]... [--tenant <name>]
uip admin integrations vpn gateways edit <key> [--name <name>] [--description <text>] [--dns-server <ip>]... [--clear-dns-servers] [--apipa-address <ip>]... [--clear-apipa-addresses] [--trusted-cert <name=base64>]... [--clear-trusted-certs] [--tenant <name>]
uip admin integrations vpn gateways redeploy <key> [--tenant <name>]
uip admin integrations vpn gateways delete <key> --confirm [--tenant <name>]

uip admin integrations vpn connections get <key> [--tenant <name>]
uip admin integrations vpn connections create <gateway-key> --name <name> --shared-key <key> --target-ip <ip> [--target-address-space <cidr>]... [--bgp-enabled --asn <num> --bgp-peer-address <ip>] [ipsec flags...] [--tenant <name>]
uip admin integrations vpn connections edit <key> --shared-key <key> --confirm [options...]
uip admin integrations vpn connections refresh <key> [--tenant <name>]
uip admin integrations vpn connections delete <key> --confirm [--tenant <name>]

--tenant <name> is available on every verb in both groups (defaults to the tenant in your login context).

uip admin integrations vpn gateways

uip admin integrations vpn gateways list

List all VPN gateways for the current tenant — key, name, state, type, SKU, VNet, location, public IP, connection count.

Opciones

Largo	Valor	Descripción
--tenant <name>	String	Target tenant. Defaults to your login context.

Ejemplo

uip admin integrations vpn gateways list

Forma de datos (--json de salida)

{
  "Code": "VpnGatewayList",
  "Data": {
    "count": 1,
    "value": [
      {
        "key": "00000000-0000-0000-0000-000000000001",
        "name": "prod-gw",
        "state": "Deployed",
        "gatewayType": "Vpn",
        "sku": "Basic",
        "vnetAddressSpace": "10.0.0.0/24",
        "location": "westus",
        "publicIp": "20.0.0.1",
        "connections": []
      }
    ]
  }
}

uip admin integrations vpn gateways get

Fetch a gateway and its connections by key.

Argumentos

Nombre	Obligatorio	Propósito
<key>	Sí	VPN gateway key (GUID).

Ejemplo

uip admin integrations vpn gateways get 00000000-0000-0000-0000-000000000001

Forma de datos (--json de salida)

{
  "Code": "VpnGatewayGet",
  "Data": {
    "key": "00000000-0000-0000-0000-000000000001",
    "name": "prod-gw",
    "state": "Deployed",
    "gatewayType": "Vpn",
    "sku": "Basic",
    "vnetAddressSpace": "10.0.0.0/24",
    "location": "westus",
    "publicIp": "20.0.0.1",
    "connections": [
      { "key": "11111111-1111-1111-1111-111111111111", "name": "site-a", "state": "Connected", "targetIpAddress": "203.0.113.10" }
    ],
    "trustedCertificates": [
      { "name": "corp-root-ca", "publicCertificateData": "MIIDazCCAlOgAwIBAgIUHs9..." }
    ]
  }
}

uip admin integrations vpn gateways tenant-config

Check whether the current tenant is allowed to provision a VPN gateway.

Ejemplo

uip admin integrations vpn gateways tenant-config

Forma de datos (--json de salida)

{ "Code": "VpnGatewayTenantConfig", "Data": { "canCreateVpnGateway": true } }

Data also carries validationError when canCreateVpnGateway is false.

uip admin integrations vpn gateways create

Provision a new VPN gateway. Asynchronous — track state with gateways get/list; on Failed, use gateways redeploy.

Opciones

Largo	Valor	Obligatorio	Descripción
--name <name>	String	Sí	Gateway name.
--vnet-address-space <cidr>	CIDR, /8–/27	Sí	VNet address space. Immutable after create. Rejects the 169.254.0.0/16 APIPA range.
--description <text>	String	No	Free-form description.
--dns-server <ip>	IPv4, repeatable, max 3	No	DNS server IP.
--apipa-address <ip>	IPv4 in 169.254.21.0/24 or 169.254.22.0/24, repeatable, max 2	No	APIPA BGP peering address.
--trusted-cert <cert-name=base64>	<name>=<base64-X509>, repeatable, max 10	No	Trusted root certificate.
--tenant <name>	String	No	Tenant de destino.

Ejemplos

uip admin integrations vpn gateways create --name prod-gw --vnet-address-space 10.0.0.0/24

# Full lifecycle: provision, wait for Deployed, then attach a BGP connection
ROOT=$(cat root.b64); INTER=$(cat inter.b64)
GW_KEY=$(uip admin integrations vpn gateways create \
  --name prod-gw \
  --vnet-address-space 10.0.0.0/24 \
  --dns-server 172.23.0.105 --dns-server 172.23.2.89 \
  --apipa-address 169.254.21.10 \
  --trusted-cert "Root=$ROOT" --trusted-cert "Inter=$INTER" \
  --output-filter Data.key --output plain)
until uip admin integrations vpn gateways get $GW_KEY \
  --output-filter Data.state --output plain | grep -q Deployed; do
  sleep 30
done
uip admin integrations vpn connections create $GW_KEY \
  --name site-a --shared-key "MyS3cr3tP4ssphr4se" \
  --target-ip 203.0.113.10 \
  --bgp-enabled --asn 65001 --bgp-peer-address 169.254.21.9

Forma de datos (--json de salida)

{
  "Code": "VpnGatewayCreated",
  "Data": {
    "key": "00000000-0000-0000-0000-000000000001",
    "name": "prod-gw",
    "state": "Provisioning",
    "gatewayType": "Vpn",
    "sku": "Basic",
    "vnetAddressSpace": "10.0.0.0/24"
  }
}

uip admin integrations vpn gateways edit

Update a gateway's mutable fields. Scalars you don't pass are preserved; lists you pass replace the existing list wholesale (see Concepts). Fails if no edit field is provided.

Argumentos

Nombre	Obligatorio	Propósito
<key>	Sí	VPN gateway key (GUID).

Opciones

Largo	Valor	Descripción
--name <name>	String	Rename the gateway.
--description <text>	String	Update description.
--dns-server <ip>	IPv4, repeatable, max 3	Replace the DNS server list. Mutually exclusive with --clear-dns-servers.
--clear-dns-servers	Marca	Remove all DNS servers.
--apipa-address <ip>	IPv4, repeatable, max 2	Replace the APIPA address list. Mutually exclusive with --clear-apipa-addresses.
--clear-apipa-addresses	Marca	Remove all APIPA BGP addresses.
--trusted-cert <cert-name=base64>	repeatable, max 10	Replace the trusted certificate list. Mutually exclusive with --clear-trusted-certs.
--clear-trusted-certs	Marca	Remove all trusted certificates.
--tenant <name>	String	Tenant de destino.

Ejemplos

uip admin integrations vpn gateways edit 00000000-0000-0000-0000-000000000001 --name new-name

uip admin integrations vpn gateways edit 00000000-0000-0000-0000-000000000001 --clear-dns-servers

Forma de datos (--json de salida)

{
  "Code": "VpnGatewayEdited",
  "Data": { "key": "00000000-0000-0000-0000-000000000001", "name": "new-name" }
}

Data only echoes back the fields that changed.

uip admin integrations vpn gateways redeploy

Retry the last background task on a gateway whose previous deployment attempt didn't complete cleanly. Rejected if the gateway is frozen, has a task in flight, or is in an unsupported state.

Argumentos

Nombre	Obligatorio	Propósito
<key>	Sí	VPN gateway key (GUID).

Ejemplo

uip admin integrations vpn gateways redeploy 00000000-0000-0000-0000-000000000001

Forma de datos (--json de salida)

{ "Code": "VpnGatewayRedeployRequested", "Data": { "Key": "00000000-0000-0000-0000-000000000001" } }

uip admin integrations vpn gateways delete

Delete the gateway and all related infrastructure. Destructive and irreversible.

Argumentos

Nombre	Obligatorio	Propósito
<key>	Sí	VPN gateway key (GUID).

Opciones

Largo	Valor	Obligatorio	Descripción
--confirm	Marca	Sí	Required — the command refuses without it.
--tenant <name>	String	No	Tenant de destino.

Ejemplo

uip admin integrations vpn gateways delete 00000000-0000-0000-0000-000000000001 --confirm

Forma de datos (--json de salida)

{ "Code": "VpnGatewayDeleted", "Data": { "Key": "00000000-0000-0000-0000-000000000001" } }

uip admin integrations vpn connections

Site-to-site connections attached to a VPN gateway. Each connection peers one on-prem network with the gateway.

uip admin integrations vpn connections get

Argumentos

Nombre	Obligatorio	Propósito
<key>	Sí	VPN gateway connection key (GUID).

Ejemplo

uip admin integrations vpn connections get 00000000-0000-0000-0000-000000000001

Forma de datos (--json de salida)

{
  "Code": "VpnGatewayConnectionGet",
  "Data": {
    "key": "00000000-0000-0000-0000-000000000001",
    "name": "site-a",
    "state": "Connected",
    "targetIpAddress": "203.0.113.10",
    "targetAddressSpaces": ["192.168.1.0/24"],
    "bgpEnabled": false
  }
}

uip admin integrations vpn connections create

Attach a new site-to-site connection to a gateway.

Argumentos

Nombre	Obligatorio	Propósito
<gateway-key>	Sí	Parent VPN gateway key (GUID).

Opciones

Largo	Valor	Obligatorio	Descripción
--name <name>	String	Sí	Connection name.
--shared-key <key>	string, ≤128 printable ASCII chars, no spaces/dashes/tildes	Sí	Pre-shared key.
--target-ip <ip>	IPv4	Sí	On-prem VPN device public IP.
--target-address-space <cidr>	CIDR, repeatable	conditionally	Required (at least one) when --bgp-enabled is not set. 0.0.0.0/0 is rejected.
--bgp-enabled	Marca	No	Use BGP for dynamic routing.
--asn <num>	positive integer	conditionally	Required with --bgp-enabled. 65515 and 64512 are reserved.
--bgp-peer-address <ip>	IPv4	conditionally	Required with --bgp-enabled. Must be the on-prem /30 partner of a gateway --apipa-address.
--ipsec-sa-lifetime <seconds>	integer, min 300	No	IPsec SA lifetime. All-or-nothing with the 7 flags below.
--ipsec-sa-data-size <kb>	integer, 0 or 1024–2147483647	No	IPsec SA data size.
--ipsec-encryption <alg>	None|AES128|AES192|AES256|GCMAES128|GCMAES192|GCMAES256	No	IPsec encryption algorithm.
--ipsec-integrity <alg>	MD5|SHA1|SHA256|SHA384|GCMAES128|GCMAES256	No	Must match a GCMAES --ipsec-encryption exactly.
--ike-encryption <alg>	AES128|AES192|AES256|GCMAES128|GCMAES256	No	IKE encryption algorithm.
--ike-integrity <alg>	MD5|SHA1|SHA256|SHA384|GCMAES128|GCMAES256	No	IKE integrity algorithm.
--dh-group <group>	None|DHGroup1|DHGroup2|DHGroup14|DHGroup24|DHGroup2048|ECP256|ECP384	No	Diffie-Hellman group.
--pfs-group <group>	None|PFS1|PFS2|PFS14|PFS24|PFS2048|ECP256|ECP384|PFS	No	Perfect Forward Secrecy group.
--tenant <name>	String	No	Tenant de destino.

Ejemplos

# Static routes, no BGP
uip admin integrations vpn connections create 00000000-0000-0000-0000-0000000000aa \
  --name site-a --shared-key 'MyS3cr3tP4ssphr4se' \
  --target-ip 203.0.113.10 --target-address-space 192.168.1.0/24

# With BGP
uip admin integrations vpn connections create 00000000-0000-0000-0000-0000000000aa \
  --name site-a --shared-key 'MyS3cr3tP4ssphr4se' \
  --target-ip 203.0.113.10 --bgp-enabled --asn 65001 --bgp-peer-address 169.254.21.1

Forma de datos (--json de salida)

{
  "Code": "VpnGatewayConnectionCreated",
  "Data": {
    "key": "00000000-0000-0000-0000-000000000001",
    "name": "site-a",
    "state": "Connecting",
    "targetIpAddress": "203.0.113.10",
    "bgpEnabled": true,
    "asn": 65001
  }
}

uip admin integrations vpn connections edit

Update a connection's mutable fields. --shared-key and --confirm are required on every call regardless of what else changes (see Concepts).

Argumentos

Nombre	Obligatorio	Propósito
<key>	Sí	VPN gateway connection key (GUID).

Opciones

Largo	Valor	Obligatorio	Descripción
--shared-key <key>	String	Sí	Re-supply the current pre-shared key on every edit.
--confirm	Marca	Sí	Acknowledge the brief connectivity drop most edits cause.
--name <name>	String	No	Rename the connection.
--target-ip <ip>	IPv4	No	On-prem VPN device public IP.
--target-address-space <cidr>	repeatable	No	Replace the on-prem CIDR list. 0.0.0.0/0 rejected. Mutually exclusive with --clear-target-address-spaces.
--clear-target-address-spaces	Marca	No	Remove all target address spaces. A non-BGP connection with none is misconfigured.
--bgp-enabled / --no-bgp-enabled	Marca	No	Enable/disable BGP. Enabling on a previously-non-BGP connection requires --asn and --bgp-peer-address together.
--asn <num>	Entero	No	BGP ASN.
--bgp-peer-address <ip>	IPv4	No	BGP peer address.
--ipsec-sa-lifetime, --ipsec-sa-data-size, --ipsec-encryption, --ipsec-integrity, --ike-encryption, --ike-integrity, --dh-group, --pfs-group	see connections create	No	Pass all 8 to replace the IPsec policy; omit all 8 to preserve it.
--clear-ipsec	Marca	No	Remove the IPsec policy. Mutually exclusive with the 8 IPsec/IKE flags.
--tenant <name>	String	No	Tenant de destino.

Ejemplos

uip admin integrations vpn connections edit 00000000-0000-0000-0000-000000000001 \
  --shared-key 'MyS3cr3tP4ssphr4se' --name new-name --confirm

uip admin integrations vpn connections edit 00000000-0000-0000-0000-000000000001 \
  --shared-key 'MyS3cr3tP4ssphr4se' --no-bgp-enabled --confirm

Forma de datos (--json de salida)

{
  "Code": "VpnGatewayConnectionEdited",
  "Data": { "key": "00000000-0000-0000-0000-000000000001", "name": "new-name" }
}

uip admin integrations vpn connections refresh

Queue a background refresh of the connection's state from Azure — connections also refresh automatically on a periodic job; use this only when you don't want to wait for the next cycle. Rejected if another operation is in flight.

Argumentos

Nombre	Obligatorio	Propósito
<key>	Sí	VPN gateway connection key (GUID).

Ejemplo

uip admin integrations vpn connections refresh 00000000-0000-0000-0000-000000000001

Forma de datos (--json de salida)

{ "Code": "VpnGatewayConnectionRefreshRequested", "Data": { "Key": "00000000-0000-0000-0000-000000000001" } }

uip admin integrations vpn connections delete

Delete the connection. Destructive and irreversible — the on-prem peer must reconnect to a recreated connection afterward.

Argumentos

Nombre	Obligatorio	Propósito
<key>	Sí	VPN gateway connection key (GUID).

Opciones

Largo	Valor	Obligatorio	Descripción
--confirm	Marca	Sí	Required — the command refuses without it.
--tenant <name>	String	No	Tenant de destino.

Ejemplo

uip admin integrations vpn connections delete 00000000-0000-0000-0000-000000000001 --confirm

Forma de datos (--json de salida)

{ "Code": "VpnGatewayConnectionDeleted", "Data": { "Key": "00000000-0000-0000-0000-000000000001" } }

Ver también

• uip admin overview
• Opciones globales
• Códigos de salida