// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***

using System;
using System.Collections.Generic;
using System.Collections.Immutable;
using System.Threading.Tasks;
using Pulumi.Serialization;
using Pulumi;

namespace Pulumiverse.Fortios
{
    /// <summary>
    /// Configure VPN autokey tunnel.
    /// 
    /// ## Example Usage
    /// 
    /// ```csharp
    /// using System.Collections.Generic;
    /// using System.Linq;
    /// using Pulumi;
    /// using Fortios = Pulumiverse.Fortios;
    /// 
    /// return await Deployment.RunAsync(() =&gt; 
    /// {
    ///     var trnamex2 = new Fortios.VpnipsecPhase1("trnamex2", new()
    ///     {
    ///         AcctVerify = "disable",
    ///         AddGwRoute = "disable",
    ///         AddRoute = "disable",
    ///         AssignIp = "enable",
    ///         AssignIpFrom = "range",
    ///         Authmethod = "psk",
    ///         AutoNegotiate = "enable",
    ///         CertIdValidation = "enable",
    ///         ChildlessIke = "disable",
    ///         ClientAutoNegotiate = "disable",
    ///         ClientKeepAlive = "disable",
    ///         Dhgrp = "14 5",
    ///         DigitalSignatureAuth = "disable",
    ///         Distance = 15,
    ///         DnsMode = "manual",
    ///         Dpd = "on-demand",
    ///         DpdRetrycount = 3,
    ///         DpdRetryinterval = "20",
    ///         Eap = "disable",
    ///         EapIdentity = "use-id-payload",
    ///         EnforceUniqueId = "disable",
    ///         ForticlientEnforcement = "disable",
    ///         Fragmentation = "enable",
    ///         FragmentationMtu = 1200,
    ///         GroupAuthentication = "disable",
    ///         HaSyncEspSeqno = "enable",
    ///         IdleTimeout = "disable",
    ///         IdleTimeoutinterval = 15,
    ///         IkeVersion = "1",
    ///         IncludeLocalLan = "disable",
    ///         Interface = "port4",
    ///         Ipv4DnsServer1 = "0.0.0.0",
    ///         Ipv4DnsServer2 = "0.0.0.0",
    ///         Ipv4DnsServer3 = "0.0.0.0",
    ///         Ipv4EndIp = "0.0.0.0",
    ///         Ipv4Netmask = "255.255.255.255",
    ///         Ipv4StartIp = "0.0.0.0",
    ///         Ipv4WinsServer1 = "0.0.0.0",
    ///         Ipv4WinsServer2 = "0.0.0.0",
    ///         Ipv6DnsServer1 = "::",
    ///         Ipv6DnsServer2 = "::",
    ///         Ipv6DnsServer3 = "::",
    ///         Ipv6EndIp = "::",
    ///         Ipv6Prefix = 128,
    ///         Ipv6StartIp = "::",
    ///         Keepalive = 10,
    ///         Keylife = 86400,
    ///         LocalGw = "0.0.0.0",
    ///         LocalidType = "auto",
    ///         MeshSelectorType = "disable",
    ///         Mode = "main",
    ///         ModeCfg = "disable",
    ///         Nattraversal = "enable",
    ///         NegotiateTimeout = 30,
    ///         Peertype = "any",
    ///         Ppk = "disable",
    ///         Priority = 0,
    ///         Proposal = "aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1",
    ///         Psksecret = "dewcEde2112",
    ///         Reauth = "disable",
    ///         Rekey = "enable",
    ///         RemoteGw = "2.1.1.1",
    ///         RsaSignatureFormat = "pkcs1",
    ///         SavePassword = "disable",
    ///         SendCertChain = "enable",
    ///         SignatureHashAlg = "sha2-512 sha2-384 sha2-256 sha1",
    ///         SuiteB = "disable",
    ///         Type = "static",
    ///         UnitySupport = "enable",
    ///         WizardType = "custom",
    ///         Xauthtype = "disable",
    ///     });
    /// 
    ///     var trname = new Fortios.VpnipsecPhase2("trname", new()
    ///     {
    ///         AddRoute = "phase1",
    ///         AutoNegotiate = "disable",
    ///         DhcpIpsec = "disable",
    ///         Dhgrp = "14 5",
    ///         DstAddrType = "subnet",
    ///         DstEndIp = "0.0.0.0",
    ///         DstEndIp6 = "::",
    ///         DstPort = 0,
    ///         DstStartIp = "0.0.0.0",
    ///         DstStartIp6 = "::",
    ///         DstSubnet = "0.0.0.0 0.0.0.0",
    ///         DstSubnet6 = "::/0",
    ///         Encapsulation = "tunnel-mode",
    ///         Keepalive = "disable",
    ///         KeylifeType = "seconds",
    ///         Keylifekbs = 5120,
    ///         Keylifeseconds = 43200,
    ///         L2tp = "disable",
    ///         Pfs = "enable",
    ///         Phase1name = trnamex2.Name,
    ///         Proposal = "null-md5 null-sha1 null-sha256",
    ///         Protocol = 0,
    ///         Replay = "enable",
    ///         RouteOverlap = "use-new",
    ///         SelectorMatch = "auto",
    ///         SingleSource = "disable",
    ///         SrcAddrType = "subnet",
    ///         SrcEndIp = "0.0.0.0",
    ///         SrcEndIp6 = "::",
    ///         SrcPort = 0,
    ///         SrcStartIp = "0.0.0.0",
    ///         SrcStartIp6 = "::",
    ///         SrcSubnet = "0.0.0.0 0.0.0.0",
    ///         SrcSubnet6 = "::/0",
    ///         UseNatip = "disable",
    ///     });
    /// 
    /// });
    /// ```
    /// 
    /// ## Import
    /// 
    /// VpnIpsec Phase2 can be imported using any of these accepted formats
    /// 
    /// ```sh
    ///  $ pulumi import fortios:index/vpnipsecPhase2:VpnipsecPhase2 labelname {{name}}
    /// ```
    /// 
    ///  If you do not want to import arguments of block$ export "FORTIOS_IMPORT_TABLE"="false"
    /// 
    /// ```sh
    ///  $ pulumi import fortios:index/vpnipsecPhase2:VpnipsecPhase2 labelname {{name}}
    /// ```
    /// 
    ///  $ unset "FORTIOS_IMPORT_TABLE"
    /// </summary>
    [FortiosResourceType("fortios:index/vpnipsecPhase2:VpnipsecPhase2")]
    public partial class VpnipsecPhase2 : global::Pulumi.CustomResource
    {
        /// <summary>
        /// Enable/disable automatic route addition. Valid values: `phase1`, `enable`, `disable`.
        /// </summary>
        [Output("addRoute")]
        public Output<string> AddRoute { get; private set; } = null!;

        /// <summary>
        /// Enable/disable IPsec SA auto-negotiation. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("autoNegotiate")]
        public Output<string> AutoNegotiate { get; private set; } = null!;

        /// <summary>
        /// Comment.
        /// </summary>
        [Output("comments")]
        public Output<string?> Comments { get; private set; } = null!;

        /// <summary>
        /// Enable/disable DHCP-IPsec. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("dhcpIpsec")]
        public Output<string> DhcpIpsec { get; private set; } = null!;

        /// <summary>
        /// Phase2 DH group. Valid values: `1`, `2`, `5`, `14`, `15`, `16`, `17`, `18`, `19`, `20`, `21`, `27`, `28`, `29`, `30`, `31`, `32`.
        /// </summary>
        [Output("dhgrp")]
        public Output<string> Dhgrp { get; private set; } = null!;

        /// <summary>
        /// Enable/disable applying DSCP value to the IPsec tunnel outer IP header. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("diffserv")]
        public Output<string> Diffserv { get; private set; } = null!;

        /// <summary>
        /// DSCP value to be applied to the IPsec tunnel outer IP header.
        /// </summary>
        [Output("diffservcode")]
        public Output<string> Diffservcode { get; private set; } = null!;

        /// <summary>
        /// Remote proxy ID type. Valid values: `subnet`, `range`, `ip`, `name`.
        /// </summary>
        [Output("dstAddrType")]
        public Output<string> DstAddrType { get; private set; } = null!;

        /// <summary>
        /// Remote proxy ID IPv4 end.
        /// </summary>
        [Output("dstEndIp")]
        public Output<string> DstEndIp { get; private set; } = null!;

        /// <summary>
        /// Remote proxy ID IPv6 end.
        /// </summary>
        [Output("dstEndIp6")]
        public Output<string> DstEndIp6 { get; private set; } = null!;

        /// <summary>
        /// Remote proxy ID name.
        /// </summary>
        [Output("dstName")]
        public Output<string> DstName { get; private set; } = null!;

        /// <summary>
        /// Remote proxy ID name.
        /// </summary>
        [Output("dstName6")]
        public Output<string> DstName6 { get; private set; } = null!;

        /// <summary>
        /// Quick mode destination port (1 - 65535 or 0 for all).
        /// </summary>
        [Output("dstPort")]
        public Output<int> DstPort { get; private set; } = null!;

        /// <summary>
        /// Remote proxy ID IPv4 start.
        /// </summary>
        [Output("dstStartIp")]
        public Output<string> DstStartIp { get; private set; } = null!;

        /// <summary>
        /// Remote proxy ID IPv6 start.
        /// </summary>
        [Output("dstStartIp6")]
        public Output<string> DstStartIp6 { get; private set; } = null!;

        /// <summary>
        /// Remote proxy ID IPv4 subnet.
        /// </summary>
        [Output("dstSubnet")]
        public Output<string> DstSubnet { get; private set; } = null!;

        /// <summary>
        /// Remote proxy ID IPv6 subnet.
        /// </summary>
        [Output("dstSubnet6")]
        public Output<string> DstSubnet6 { get; private set; } = null!;

        /// <summary>
        /// ESP encapsulation mode. Valid values: `tunnel-mode`, `transport-mode`.
        /// </summary>
        [Output("encapsulation")]
        public Output<string> Encapsulation { get; private set; } = null!;

        /// <summary>
        /// Enable/disable copying of the DSCP field in the ESP header to the inner IP header. Valid values: `phase1`, `enable`, `disable`.
        /// </summary>
        [Output("inboundDscpCopy")]
        public Output<string> InboundDscpCopy { get; private set; } = null!;

        /// <summary>
        /// Enable/disable traffic selector narrowing for IKEv2 initiator. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("initiatorTsNarrow")]
        public Output<string> InitiatorTsNarrow { get; private set; } = null!;

        /// <summary>
        /// Enable/disable setting and resetting of IPv4 'Don't Fragment' bit. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("ipv4Df")]
        public Output<string> Ipv4Df { get; private set; } = null!;

        /// <summary>
        /// Enable/disable keep alive. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("keepalive")]
        public Output<string> Keepalive { get; private set; } = null!;

        /// <summary>
        /// Keylife type. Valid values: `seconds`, `kbs`, `both`.
        /// </summary>
        [Output("keylifeType")]
        public Output<string> KeylifeType { get; private set; } = null!;

        /// <summary>
        /// Phase2 key life in number of bytes of traffic (5120 - 4294967295).
        /// </summary>
        [Output("keylifekbs")]
        public Output<int> Keylifekbs { get; private set; } = null!;

        /// <summary>
        /// Phase2 key life in time in seconds (120 - 172800).
        /// </summary>
        [Output("keylifeseconds")]
        public Output<int> Keylifeseconds { get; private set; } = null!;

        /// <summary>
        /// Enable/disable L2TP over IPsec. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("l2tp")]
        public Output<string> L2tp { get; private set; } = null!;

        /// <summary>
        /// IPsec tunnel name.
        /// </summary>
        [Output("name")]
        public Output<string> Name { get; private set; } = null!;

        /// <summary>
        /// Enable/disable PFS feature. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("pfs")]
        public Output<string> Pfs { get; private set; } = null!;

        /// <summary>
        /// Phase 1 determines the options required for phase 2.
        /// </summary>
        [Output("phase1name")]
        public Output<string> Phase1name { get; private set; } = null!;

        /// <summary>
        /// Phase2 proposal. Valid values: `null-md5`, `null-sha1`, `null-sha256`, `null-sha384`, `null-sha512`, `des-null`, `des-md5`, `des-sha1`, `des-sha256`, `des-sha384`, `des-sha512`, `3des-null`, `3des-md5`, `3des-sha1`, `3des-sha256`, `3des-sha384`, `3des-sha512`, `aes128-null`, `aes128-md5`, `aes128-sha1`, `aes128-sha256`, `aes128-sha384`, `aes128-sha512`, `aes128gcm`, `aes192-null`, `aes192-md5`, `aes192-sha1`, `aes192-sha256`, `aes192-sha384`, `aes192-sha512`, `aes256-null`, `aes256-md5`, `aes256-sha1`, `aes256-sha256`, `aes256-sha384`, `aes256-sha512`, `aes256gcm`, `chacha20poly1305`, `aria128-null`, `aria128-md5`, `aria128-sha1`, `aria128-sha256`, `aria128-sha384`, `aria128-sha512`, `aria192-null`, `aria192-md5`, `aria192-sha1`, `aria192-sha256`, `aria192-sha384`, `aria192-sha512`, `aria256-null`, `aria256-md5`, `aria256-sha1`, `aria256-sha256`, `aria256-sha384`, `aria256-sha512`, `seed-null`, `seed-md5`, `seed-sha1`, `seed-sha256`, `seed-sha384`, `seed-sha512`.
        /// </summary>
        [Output("proposal")]
        public Output<string> Proposal { get; private set; } = null!;

        /// <summary>
        /// Quick mode protocol selector (1 - 255 or 0 for all).
        /// </summary>
        [Output("protocol")]
        public Output<int> Protocol { get; private set; } = null!;

        /// <summary>
        /// Enable/disable replay detection. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("replay")]
        public Output<string> Replay { get; private set; } = null!;

        /// <summary>
        /// Action for overlapping routes. Valid values: `use-old`, `use-new`, `allow`.
        /// </summary>
        [Output("routeOverlap")]
        public Output<string> RouteOverlap { get; private set; } = null!;

        /// <summary>
        /// Match type to use when comparing selectors. Valid values: `exact`, `subset`, `auto`.
        /// </summary>
        [Output("selectorMatch")]
        public Output<string> SelectorMatch { get; private set; } = null!;

        /// <summary>
        /// Enable/disable single source IP restriction. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("singleSource")]
        public Output<string> SingleSource { get; private set; } = null!;

        /// <summary>
        /// Local proxy ID type. Valid values: `subnet`, `range`, `ip`, `name`.
        /// </summary>
        [Output("srcAddrType")]
        public Output<string> SrcAddrType { get; private set; } = null!;

        /// <summary>
        /// Local proxy ID end.
        /// </summary>
        [Output("srcEndIp")]
        public Output<string> SrcEndIp { get; private set; } = null!;

        /// <summary>
        /// Local proxy ID IPv6 end.
        /// </summary>
        [Output("srcEndIp6")]
        public Output<string> SrcEndIp6 { get; private set; } = null!;

        /// <summary>
        /// Local proxy ID name.
        /// </summary>
        [Output("srcName")]
        public Output<string> SrcName { get; private set; } = null!;

        /// <summary>
        /// Local proxy ID name.
        /// </summary>
        [Output("srcName6")]
        public Output<string> SrcName6 { get; private set; } = null!;

        /// <summary>
        /// Quick mode source port (1 - 65535 or 0 for all).
        /// </summary>
        [Output("srcPort")]
        public Output<int> SrcPort { get; private set; } = null!;

        /// <summary>
        /// Local proxy ID start.
        /// </summary>
        [Output("srcStartIp")]
        public Output<string> SrcStartIp { get; private set; } = null!;

        /// <summary>
        /// Local proxy ID IPv6 start.
        /// </summary>
        [Output("srcStartIp6")]
        public Output<string> SrcStartIp6 { get; private set; } = null!;

        /// <summary>
        /// Local proxy ID subnet.
        /// </summary>
        [Output("srcSubnet")]
        public Output<string> SrcSubnet { get; private set; } = null!;

        /// <summary>
        /// Local proxy ID IPv6 subnet.
        /// </summary>
        [Output("srcSubnet6")]
        public Output<string> SrcSubnet6 { get; private set; } = null!;

        /// <summary>
        /// Enable to use the FortiGate public IP as the source selector when outbound NAT is used. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("useNatip")]
        public Output<string> UseNatip { get; private set; } = null!;

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Output("vdomparam")]
        public Output<string?> Vdomparam { get; private set; } = null!;


        /// <summary>
        /// Create a VpnipsecPhase2 resource with the given unique name, arguments, and options.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resource</param>
        /// <param name="args">The arguments used to populate this resource's properties</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public VpnipsecPhase2(string name, VpnipsecPhase2Args args, CustomResourceOptions? options = null)
            : base("fortios:index/vpnipsecPhase2:VpnipsecPhase2", name, args ?? new VpnipsecPhase2Args(), MakeResourceOptions(options, ""))
        {
        }

        private VpnipsecPhase2(string name, Input<string> id, VpnipsecPhase2State? state = null, CustomResourceOptions? options = null)
            : base("fortios:index/vpnipsecPhase2:VpnipsecPhase2", name, state, MakeResourceOptions(options, id))
        {
        }

        private static CustomResourceOptions MakeResourceOptions(CustomResourceOptions? options, Input<string>? id)
        {
            var defaultOptions = new CustomResourceOptions
            {
                Version = Utilities.Version,
                PluginDownloadURL = "github://api.github.com/pulumiverse/pulumi-fortios",
            };
            var merged = CustomResourceOptions.Merge(defaultOptions, options);
            // Override the ID if one was specified for consistency with other language SDKs.
            merged.Id = id ?? merged.Id;
            return merged;
        }
        /// <summary>
        /// Get an existing VpnipsecPhase2 resource's state with the given name, ID, and optional extra
        /// properties used to qualify the lookup.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resulting resource.</param>
        /// <param name="id">The unique provider ID of the resource to lookup.</param>
        /// <param name="state">Any extra arguments used during the lookup.</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public static VpnipsecPhase2 Get(string name, Input<string> id, VpnipsecPhase2State? state = null, CustomResourceOptions? options = null)
        {
            return new VpnipsecPhase2(name, id, state, options);
        }
    }

    public sealed class VpnipsecPhase2Args : global::Pulumi.ResourceArgs
    {
        /// <summary>
        /// Enable/disable automatic route addition. Valid values: `phase1`, `enable`, `disable`.
        /// </summary>
        [Input("addRoute")]
        public Input<string>? AddRoute { get; set; }

        /// <summary>
        /// Enable/disable IPsec SA auto-negotiation. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("autoNegotiate")]
        public Input<string>? AutoNegotiate { get; set; }

        /// <summary>
        /// Comment.
        /// </summary>
        [Input("comments")]
        public Input<string>? Comments { get; set; }

        /// <summary>
        /// Enable/disable DHCP-IPsec. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dhcpIpsec")]
        public Input<string>? DhcpIpsec { get; set; }

        /// <summary>
        /// Phase2 DH group. Valid values: `1`, `2`, `5`, `14`, `15`, `16`, `17`, `18`, `19`, `20`, `21`, `27`, `28`, `29`, `30`, `31`, `32`.
        /// </summary>
        [Input("dhgrp")]
        public Input<string>? Dhgrp { get; set; }

        /// <summary>
        /// Enable/disable applying DSCP value to the IPsec tunnel outer IP header. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("diffserv")]
        public Input<string>? Diffserv { get; set; }

        /// <summary>
        /// DSCP value to be applied to the IPsec tunnel outer IP header.
        /// </summary>
        [Input("diffservcode")]
        public Input<string>? Diffservcode { get; set; }

        /// <summary>
        /// Remote proxy ID type. Valid values: `subnet`, `range`, `ip`, `name`.
        /// </summary>
        [Input("dstAddrType")]
        public Input<string>? DstAddrType { get; set; }

        /// <summary>
        /// Remote proxy ID IPv4 end.
        /// </summary>
        [Input("dstEndIp")]
        public Input<string>? DstEndIp { get; set; }

        /// <summary>
        /// Remote proxy ID IPv6 end.
        /// </summary>
        [Input("dstEndIp6")]
        public Input<string>? DstEndIp6 { get; set; }

        /// <summary>
        /// Remote proxy ID name.
        /// </summary>
        [Input("dstName")]
        public Input<string>? DstName { get; set; }

        /// <summary>
        /// Remote proxy ID name.
        /// </summary>
        [Input("dstName6")]
        public Input<string>? DstName6 { get; set; }

        /// <summary>
        /// Quick mode destination port (1 - 65535 or 0 for all).
        /// </summary>
        [Input("dstPort")]
        public Input<int>? DstPort { get; set; }

        /// <summary>
        /// Remote proxy ID IPv4 start.
        /// </summary>
        [Input("dstStartIp")]
        public Input<string>? DstStartIp { get; set; }

        /// <summary>
        /// Remote proxy ID IPv6 start.
        /// </summary>
        [Input("dstStartIp6")]
        public Input<string>? DstStartIp6 { get; set; }

        /// <summary>
        /// Remote proxy ID IPv4 subnet.
        /// </summary>
        [Input("dstSubnet")]
        public Input<string>? DstSubnet { get; set; }

        /// <summary>
        /// Remote proxy ID IPv6 subnet.
        /// </summary>
        [Input("dstSubnet6")]
        public Input<string>? DstSubnet6 { get; set; }

        /// <summary>
        /// ESP encapsulation mode. Valid values: `tunnel-mode`, `transport-mode`.
        /// </summary>
        [Input("encapsulation")]
        public Input<string>? Encapsulation { get; set; }

        /// <summary>
        /// Enable/disable copying of the DSCP field in the ESP header to the inner IP header. Valid values: `phase1`, `enable`, `disable`.
        /// </summary>
        [Input("inboundDscpCopy")]
        public Input<string>? InboundDscpCopy { get; set; }

        /// <summary>
        /// Enable/disable traffic selector narrowing for IKEv2 initiator. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("initiatorTsNarrow")]
        public Input<string>? InitiatorTsNarrow { get; set; }

        /// <summary>
        /// Enable/disable setting and resetting of IPv4 'Don't Fragment' bit. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("ipv4Df")]
        public Input<string>? Ipv4Df { get; set; }

        /// <summary>
        /// Enable/disable keep alive. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("keepalive")]
        public Input<string>? Keepalive { get; set; }

        /// <summary>
        /// Keylife type. Valid values: `seconds`, `kbs`, `both`.
        /// </summary>
        [Input("keylifeType")]
        public Input<string>? KeylifeType { get; set; }

        /// <summary>
        /// Phase2 key life in number of bytes of traffic (5120 - 4294967295).
        /// </summary>
        [Input("keylifekbs")]
        public Input<int>? Keylifekbs { get; set; }

        /// <summary>
        /// Phase2 key life in time in seconds (120 - 172800).
        /// </summary>
        [Input("keylifeseconds")]
        public Input<int>? Keylifeseconds { get; set; }

        /// <summary>
        /// Enable/disable L2TP over IPsec. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("l2tp")]
        public Input<string>? L2tp { get; set; }

        /// <summary>
        /// IPsec tunnel name.
        /// </summary>
        [Input("name")]
        public Input<string>? Name { get; set; }

        /// <summary>
        /// Enable/disable PFS feature. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("pfs")]
        public Input<string>? Pfs { get; set; }

        /// <summary>
        /// Phase 1 determines the options required for phase 2.
        /// </summary>
        [Input("phase1name", required: true)]
        public Input<string> Phase1name { get; set; } = null!;

        /// <summary>
        /// Phase2 proposal. Valid values: `null-md5`, `null-sha1`, `null-sha256`, `null-sha384`, `null-sha512`, `des-null`, `des-md5`, `des-sha1`, `des-sha256`, `des-sha384`, `des-sha512`, `3des-null`, `3des-md5`, `3des-sha1`, `3des-sha256`, `3des-sha384`, `3des-sha512`, `aes128-null`, `aes128-md5`, `aes128-sha1`, `aes128-sha256`, `aes128-sha384`, `aes128-sha512`, `aes128gcm`, `aes192-null`, `aes192-md5`, `aes192-sha1`, `aes192-sha256`, `aes192-sha384`, `aes192-sha512`, `aes256-null`, `aes256-md5`, `aes256-sha1`, `aes256-sha256`, `aes256-sha384`, `aes256-sha512`, `aes256gcm`, `chacha20poly1305`, `aria128-null`, `aria128-md5`, `aria128-sha1`, `aria128-sha256`, `aria128-sha384`, `aria128-sha512`, `aria192-null`, `aria192-md5`, `aria192-sha1`, `aria192-sha256`, `aria192-sha384`, `aria192-sha512`, `aria256-null`, `aria256-md5`, `aria256-sha1`, `aria256-sha256`, `aria256-sha384`, `aria256-sha512`, `seed-null`, `seed-md5`, `seed-sha1`, `seed-sha256`, `seed-sha384`, `seed-sha512`.
        /// </summary>
        [Input("proposal", required: true)]
        public Input<string> Proposal { get; set; } = null!;

        /// <summary>
        /// Quick mode protocol selector (1 - 255 or 0 for all).
        /// </summary>
        [Input("protocol")]
        public Input<int>? Protocol { get; set; }

        /// <summary>
        /// Enable/disable replay detection. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("replay")]
        public Input<string>? Replay { get; set; }

        /// <summary>
        /// Action for overlapping routes. Valid values: `use-old`, `use-new`, `allow`.
        /// </summary>
        [Input("routeOverlap")]
        public Input<string>? RouteOverlap { get; set; }

        /// <summary>
        /// Match type to use when comparing selectors. Valid values: `exact`, `subset`, `auto`.
        /// </summary>
        [Input("selectorMatch")]
        public Input<string>? SelectorMatch { get; set; }

        /// <summary>
        /// Enable/disable single source IP restriction. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("singleSource")]
        public Input<string>? SingleSource { get; set; }

        /// <summary>
        /// Local proxy ID type. Valid values: `subnet`, `range`, `ip`, `name`.
        /// </summary>
        [Input("srcAddrType")]
        public Input<string>? SrcAddrType { get; set; }

        /// <summary>
        /// Local proxy ID end.
        /// </summary>
        [Input("srcEndIp")]
        public Input<string>? SrcEndIp { get; set; }

        /// <summary>
        /// Local proxy ID IPv6 end.
        /// </summary>
        [Input("srcEndIp6")]
        public Input<string>? SrcEndIp6 { get; set; }

        /// <summary>
        /// Local proxy ID name.
        /// </summary>
        [Input("srcName")]
        public Input<string>? SrcName { get; set; }

        /// <summary>
        /// Local proxy ID name.
        /// </summary>
        [Input("srcName6")]
        public Input<string>? SrcName6 { get; set; }

        /// <summary>
        /// Quick mode source port (1 - 65535 or 0 for all).
        /// </summary>
        [Input("srcPort")]
        public Input<int>? SrcPort { get; set; }

        /// <summary>
        /// Local proxy ID start.
        /// </summary>
        [Input("srcStartIp")]
        public Input<string>? SrcStartIp { get; set; }

        /// <summary>
        /// Local proxy ID IPv6 start.
        /// </summary>
        [Input("srcStartIp6")]
        public Input<string>? SrcStartIp6 { get; set; }

        /// <summary>
        /// Local proxy ID subnet.
        /// </summary>
        [Input("srcSubnet")]
        public Input<string>? SrcSubnet { get; set; }

        /// <summary>
        /// Local proxy ID IPv6 subnet.
        /// </summary>
        [Input("srcSubnet6")]
        public Input<string>? SrcSubnet6 { get; set; }

        /// <summary>
        /// Enable to use the FortiGate public IP as the source selector when outbound NAT is used. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("useNatip")]
        public Input<string>? UseNatip { get; set; }

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Input("vdomparam")]
        public Input<string>? Vdomparam { get; set; }

        public VpnipsecPhase2Args()
        {
        }
        public static new VpnipsecPhase2Args Empty => new VpnipsecPhase2Args();
    }

    public sealed class VpnipsecPhase2State : global::Pulumi.ResourceArgs
    {
        /// <summary>
        /// Enable/disable automatic route addition. Valid values: `phase1`, `enable`, `disable`.
        /// </summary>
        [Input("addRoute")]
        public Input<string>? AddRoute { get; set; }

        /// <summary>
        /// Enable/disable IPsec SA auto-negotiation. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("autoNegotiate")]
        public Input<string>? AutoNegotiate { get; set; }

        /// <summary>
        /// Comment.
        /// </summary>
        [Input("comments")]
        public Input<string>? Comments { get; set; }

        /// <summary>
        /// Enable/disable DHCP-IPsec. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dhcpIpsec")]
        public Input<string>? DhcpIpsec { get; set; }

        /// <summary>
        /// Phase2 DH group. Valid values: `1`, `2`, `5`, `14`, `15`, `16`, `17`, `18`, `19`, `20`, `21`, `27`, `28`, `29`, `30`, `31`, `32`.
        /// </summary>
        [Input("dhgrp")]
        public Input<string>? Dhgrp { get; set; }

        /// <summary>
        /// Enable/disable applying DSCP value to the IPsec tunnel outer IP header. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("diffserv")]
        public Input<string>? Diffserv { get; set; }

        /// <summary>
        /// DSCP value to be applied to the IPsec tunnel outer IP header.
        /// </summary>
        [Input("diffservcode")]
        public Input<string>? Diffservcode { get; set; }

        /// <summary>
        /// Remote proxy ID type. Valid values: `subnet`, `range`, `ip`, `name`.
        /// </summary>
        [Input("dstAddrType")]
        public Input<string>? DstAddrType { get; set; }

        /// <summary>
        /// Remote proxy ID IPv4 end.
        /// </summary>
        [Input("dstEndIp")]
        public Input<string>? DstEndIp { get; set; }

        /// <summary>
        /// Remote proxy ID IPv6 end.
        /// </summary>
        [Input("dstEndIp6")]
        public Input<string>? DstEndIp6 { get; set; }

        /// <summary>
        /// Remote proxy ID name.
        /// </summary>
        [Input("dstName")]
        public Input<string>? DstName { get; set; }

        /// <summary>
        /// Remote proxy ID name.
        /// </summary>
        [Input("dstName6")]
        public Input<string>? DstName6 { get; set; }

        /// <summary>
        /// Quick mode destination port (1 - 65535 or 0 for all).
        /// </summary>
        [Input("dstPort")]
        public Input<int>? DstPort { get; set; }

        /// <summary>
        /// Remote proxy ID IPv4 start.
        /// </summary>
        [Input("dstStartIp")]
        public Input<string>? DstStartIp { get; set; }

        /// <summary>
        /// Remote proxy ID IPv6 start.
        /// </summary>
        [Input("dstStartIp6")]
        public Input<string>? DstStartIp6 { get; set; }

        /// <summary>
        /// Remote proxy ID IPv4 subnet.
        /// </summary>
        [Input("dstSubnet")]
        public Input<string>? DstSubnet { get; set; }

        /// <summary>
        /// Remote proxy ID IPv6 subnet.
        /// </summary>
        [Input("dstSubnet6")]
        public Input<string>? DstSubnet6 { get; set; }

        /// <summary>
        /// ESP encapsulation mode. Valid values: `tunnel-mode`, `transport-mode`.
        /// </summary>
        [Input("encapsulation")]
        public Input<string>? Encapsulation { get; set; }

        /// <summary>
        /// Enable/disable copying of the DSCP field in the ESP header to the inner IP header. Valid values: `phase1`, `enable`, `disable`.
        /// </summary>
        [Input("inboundDscpCopy")]
        public Input<string>? InboundDscpCopy { get; set; }

        /// <summary>
        /// Enable/disable traffic selector narrowing for IKEv2 initiator. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("initiatorTsNarrow")]
        public Input<string>? InitiatorTsNarrow { get; set; }

        /// <summary>
        /// Enable/disable setting and resetting of IPv4 'Don't Fragment' bit. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("ipv4Df")]
        public Input<string>? Ipv4Df { get; set; }

        /// <summary>
        /// Enable/disable keep alive. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("keepalive")]
        public Input<string>? Keepalive { get; set; }

        /// <summary>
        /// Keylife type. Valid values: `seconds`, `kbs`, `both`.
        /// </summary>
        [Input("keylifeType")]
        public Input<string>? KeylifeType { get; set; }

        /// <summary>
        /// Phase2 key life in number of bytes of traffic (5120 - 4294967295).
        /// </summary>
        [Input("keylifekbs")]
        public Input<int>? Keylifekbs { get; set; }

        /// <summary>
        /// Phase2 key life in time in seconds (120 - 172800).
        /// </summary>
        [Input("keylifeseconds")]
        public Input<int>? Keylifeseconds { get; set; }

        /// <summary>
        /// Enable/disable L2TP over IPsec. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("l2tp")]
        public Input<string>? L2tp { get; set; }

        /// <summary>
        /// IPsec tunnel name.
        /// </summary>
        [Input("name")]
        public Input<string>? Name { get; set; }

        /// <summary>
        /// Enable/disable PFS feature. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("pfs")]
        public Input<string>? Pfs { get; set; }

        /// <summary>
        /// Phase 1 determines the options required for phase 2.
        /// </summary>
        [Input("phase1name")]
        public Input<string>? Phase1name { get; set; }

        /// <summary>
        /// Phase2 proposal. Valid values: `null-md5`, `null-sha1`, `null-sha256`, `null-sha384`, `null-sha512`, `des-null`, `des-md5`, `des-sha1`, `des-sha256`, `des-sha384`, `des-sha512`, `3des-null`, `3des-md5`, `3des-sha1`, `3des-sha256`, `3des-sha384`, `3des-sha512`, `aes128-null`, `aes128-md5`, `aes128-sha1`, `aes128-sha256`, `aes128-sha384`, `aes128-sha512`, `aes128gcm`, `aes192-null`, `aes192-md5`, `aes192-sha1`, `aes192-sha256`, `aes192-sha384`, `aes192-sha512`, `aes256-null`, `aes256-md5`, `aes256-sha1`, `aes256-sha256`, `aes256-sha384`, `aes256-sha512`, `aes256gcm`, `chacha20poly1305`, `aria128-null`, `aria128-md5`, `aria128-sha1`, `aria128-sha256`, `aria128-sha384`, `aria128-sha512`, `aria192-null`, `aria192-md5`, `aria192-sha1`, `aria192-sha256`, `aria192-sha384`, `aria192-sha512`, `aria256-null`, `aria256-md5`, `aria256-sha1`, `aria256-sha256`, `aria256-sha384`, `aria256-sha512`, `seed-null`, `seed-md5`, `seed-sha1`, `seed-sha256`, `seed-sha384`, `seed-sha512`.
        /// </summary>
        [Input("proposal")]
        public Input<string>? Proposal { get; set; }

        /// <summary>
        /// Quick mode protocol selector (1 - 255 or 0 for all).
        /// </summary>
        [Input("protocol")]
        public Input<int>? Protocol { get; set; }

        /// <summary>
        /// Enable/disable replay detection. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("replay")]
        public Input<string>? Replay { get; set; }

        /// <summary>
        /// Action for overlapping routes. Valid values: `use-old`, `use-new`, `allow`.
        /// </summary>
        [Input("routeOverlap")]
        public Input<string>? RouteOverlap { get; set; }

        /// <summary>
        /// Match type to use when comparing selectors. Valid values: `exact`, `subset`, `auto`.
        /// </summary>
        [Input("selectorMatch")]
        public Input<string>? SelectorMatch { get; set; }

        /// <summary>
        /// Enable/disable single source IP restriction. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("singleSource")]
        public Input<string>? SingleSource { get; set; }

        /// <summary>
        /// Local proxy ID type. Valid values: `subnet`, `range`, `ip`, `name`.
        /// </summary>
        [Input("srcAddrType")]
        public Input<string>? SrcAddrType { get; set; }

        /// <summary>
        /// Local proxy ID end.
        /// </summary>
        [Input("srcEndIp")]
        public Input<string>? SrcEndIp { get; set; }

        /// <summary>
        /// Local proxy ID IPv6 end.
        /// </summary>
        [Input("srcEndIp6")]
        public Input<string>? SrcEndIp6 { get; set; }

        /// <summary>
        /// Local proxy ID name.
        /// </summary>
        [Input("srcName")]
        public Input<string>? SrcName { get; set; }

        /// <summary>
        /// Local proxy ID name.
        /// </summary>
        [Input("srcName6")]
        public Input<string>? SrcName6 { get; set; }

        /// <summary>
        /// Quick mode source port (1 - 65535 or 0 for all).
        /// </summary>
        [Input("srcPort")]
        public Input<int>? SrcPort { get; set; }

        /// <summary>
        /// Local proxy ID start.
        /// </summary>
        [Input("srcStartIp")]
        public Input<string>? SrcStartIp { get; set; }

        /// <summary>
        /// Local proxy ID IPv6 start.
        /// </summary>
        [Input("srcStartIp6")]
        public Input<string>? SrcStartIp6 { get; set; }

        /// <summary>
        /// Local proxy ID subnet.
        /// </summary>
        [Input("srcSubnet")]
        public Input<string>? SrcSubnet { get; set; }

        /// <summary>
        /// Local proxy ID IPv6 subnet.
        /// </summary>
        [Input("srcSubnet6")]
        public Input<string>? SrcSubnet6 { get; set; }

        /// <summary>
        /// Enable to use the FortiGate public IP as the source selector when outbound NAT is used. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("useNatip")]
        public Input<string>? UseNatip { get; set; }

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Input("vdomparam")]
        public Input<string>? Vdomparam { get; set; }

        public VpnipsecPhase2State()
        {
        }
        public static new VpnipsecPhase2State Empty => new VpnipsecPhase2State();
    }
}
