There is a command group 'az_network_vnet gateway_vpn client_ipsec policy'. This group of commands could 'manage the vpn client connection ipsec policy for p2s client connection of the virtual network gateway'. The group of commands has global parameter '--debug' which means 'Increase logging verbosity to show all debug logs.'. The group of commands has global parameter '--help -h' which means 'Show this help message and exit.'. The group of commands has global parameter '--only-show-errors' which means 'Only show errors, suppressing warnings.'. The group of commands has global parameter '--output -o' which means 'Output format.'. The group of commands has global parameter '--query' which means 'JMESPath query string. See <a href="http://jmespath.org/">http://jmespath.org/</a> for more information and examples.'. The group of commands has global parameter '--subscription' which means 'Name or ID of subscription. You can configure the default subscription using `az account set -s NAME_OR_ID`.'. The group of commands has global parameter '--verbose' which means 'Increase logging verbosity. Use --debug for full debug logs.'. This group contains a child command 'az_network_vnet gateway_vpn client_ipsec policy_set'.The syntax is: az network vnet-gateway vpn-client ipsec-policy set --dh-group {dhgroup1, dhgroup14, dhgroup2, dhgroup2048, dhgroup24, ecp256, ecp384, none}
                                                    --ike-encryption {aes128, aes192, aes256, des, des3, gcmaes128, gcmaes256}
                                                    --ike-integrity {gcmaes128, gcmaes256, md5, sha1, sha256, sha384}
                                                    --ipsec-encryption {aes128, aes192, aes256, des, des3, gcmaes128, gcmaes192, gcmaes256, none}
                                                    --ipsec-integrity {gcmaes128, gcmaes192, gcmaes256, md5, sha1, sha256}
                                                    --pfs-group {ecp256, ecp384, none, pfs1, pfs14, pfs2, pfs2048, pfs24, pfsmm}
                                                    --sa-lifetime
                                                    --sa-max-size
                                                    [--ids]
                                                    [--name]
                                                    [--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
                                                    [--resource-group]
                                                    [--subscription]. The 1th example of the child command would be to use it to 'set the vpn client connection ipsec policy per p2s client connection of the virtual network gateway', the syntax is: az network vnet-gateway vpn-client ipsec-policy set -g MyResourceGroup -n MyVnetGateway --dh-group DHGroup14 --ike-encryption AES256 --ike-integrity SHA384 --ipsec-encryption DES3 --ipsec-integrity GCMAES256 --pfs-group PFS2048 --sa-lifetime 27000 --sa-max-size 102400000. The parameter '--dh-group' is required. It is used to the dh groups used for initial sa.. The parameter '--ike-encryption' is required. It is used to the ike encryption algorithm.. The parameter '--ike-integrity' is required. It is used to the ike integrity algorithm.. The parameter '--ipsec-encryption' is required. It is used to the ipsec encryption algorithm.. The parameter '--ipsec-integrity' is required. It is used to the ipsec integrity algorithm.. The parameter '--pfs-group' is required. It is used to the pfs groups used for new child sa.. The parameter '--sa-lifetime' is required. It is used to the lifetime in seconds for p2s client.. The parameter '--sa-max-size' is required. It is used to the payload size in kb for p2s client.. The parameter '--ids' is optional. one or more resource ids (space-delimited). it should be a complete resource id containing all information of 'resource id' arguments. you should provide either --ids or other 'resource id' arguments.. The parameter '--name -n' is optional. name of the vnet gateway.. The parameter '--no-wait' is optional. do not wait for the long-running operation to finish.. The parameter '--resource-group -g' is optional. name of resource group. you can configure the default group using `az configure --defaults group=<name>`.. The parameter '--subscription' is optional. name or id of subscription. you can configure the default subscription using `az account set -s name_or_id`.. 