There is a command group 'az_network_vpn gateway_connection_vpn site link conn_ipsec policy'. This group of commands could 'manage site to site vpn gateway connection vpn site link ipsec policies'. The group of commands has global parameter '--debug' which means 'Increase logging verbosity to show all debug logs.'. The group of commands has global parameter '--help -h' which means 'Show this help message and exit.'. The group of commands has global parameter '--only-show-errors' which means 'Only show errors, suppressing warnings.'. The group of commands has global parameter '--output -o' which means 'Output format.'. The group of commands has global parameter '--query' which means 'JMESPath query string. See <a href="http://jmespath.org/">http://jmespath.org/</a> for more information and examples.'. The group of commands has global parameter '--subscription' which means 'Name or ID of subscription. You can configure the default subscription using `az account set -s NAME_OR_ID`.'. The group of commands has global parameter '--verbose' which means 'Increase logging verbosity. Use --debug for full debug logs.'. This group contains a child command 'az_network_vpn gateway_connection_vpn site link conn_ipsec policy_add'.The syntax is: az network vpn-gateway connection vpn-site-link-conn ipsec-policy add --dh-group {dhgroup1, dhgroup14, dhgroup2, dhgroup2048, dhgroup24, ecp256, ecp384, none}
                                                                      --ike-encryption {aes128, aes192, aes256, des, des3, gcmaes128, gcmaes256}
                                                                      --ike-integrity {gcmaes128, gcmaes256, md5, sha1, sha256, sha384}
                                                                      --ipsec-encryption {aes128, aes192, aes256, des, des3, gcmaes128, gcmaes192, gcmaes256, none}
                                                                      --ipsec-integrity {gcmaes128, gcmaes192, gcmaes256, md5, sha1, sha256}
                                                                      --pfs-group {ecp256, ecp384, none, pfs1, pfs14, pfs2, pfs2048, pfs24, pfsmm}
                                                                      --sa-data-size
                                                                      --sa-lifetime
                                                                      [--connection-name]
                                                                      [--gateway-name]
                                                                      [--ids]
                                                                      [--name]
                                                                      [--no-wait]
                                                                      [--resource-group]
                                                                      [--subscription]. The 1th example of the child command would be to use it to 'add an ipsec policy to a site to site vpn gateway connection vpn site link', the syntax is: az network vpn-gateway connection vpn-site-link-conn ipsec-policy add -g MyRG --connection-name MyConnection --gateway-name MyGateway -n MyVPNSiteLinkConn --ipsec-encryption AES256 --ipsec-integrity SHA256 --sa-lifetime 86471 --sa-data-size 429496 --ike-encryption AES256 --ike-integrity SHA384 --dh-group DHGroup14 --pfs-group PFS14. The parameter '--dh-group' is required. It is used to dh groups used in ike phase 1 for initial sa.. The parameter '--ike-encryption' is required. It is used to ike encryption algorithm (ike phase 2).. The parameter '--ike-integrity' is required. It is used to ike integrity algorithm (ike phase 2).. The parameter '--ipsec-encryption' is required. It is used to ipsec encryption algorithm (ike phase 1).. The parameter '--ipsec-integrity' is required. It is used to ipsec integrity algorithm (ike phase 1).. The parameter '--pfs-group' is required. It is used to the pfs groups used in ike phase 2 for new child sa.. The parameter '--sa-data-size' is required. It is used to ipsec security association (also called quick mode or phase 2 sa) payload size in kb for a site-to-site vpn tunnel.. The parameter '--sa-lifetime' is required. It is used to ipsec security association (also called quick mode or phase 2 sa) lifetime in seconds for a site-to-site vpn tunnel.. The parameter '--connection-name' is optional. name of the vpn gateway connection.. The parameter '--gateway-name' is optional. name of the vpn gateway.. The parameter '--ids' is optional. one or more resource ids (space-delimited). it should be a complete resource id containing all information of 'resource id' arguments. you should provide either --ids or other 'resource id' arguments.. The parameter '--name -n' is optional. name of the vpn site link connection.. The parameter '--no-wait' is optional. do not wait for the long-running operation to finish.. The parameter '--resource-group -g' is optional. name of resource group. you can configure the default group using `az configure --defaults group=<name>`.. The parameter '--subscription' is optional. name or id of subscription. you can configure the default subscription using `az account set -s name_or_id`.. 