​
Overview

The VPC’s VPN endpoint — “Configure secure site-to-site VPN connections”. Everything in VPN Connections is built on top of what you create here, including Fabric links.
Navigation: Networking → VPC → click a VPC → VPN Gateway.

​
What a row shows

The gateway’s public IP and the owning VPC. That’s it — a VPN gateway has very little state of its own.

​
Creating one is a selection, not a form

You pick an existing public IP from the VPC’s addresses, and that address becomes the gateway endpoint. There are no cryptographic settings here — those live on the connection, not the gateway. With no addresses available you get:
Acquire one from Public IP Addresses, then come back.

​
Two things to know

This section has no error state. A failed load renders as the empty state, so “no VPN gateways” can also mean “we couldn’t check”. Press Refresh before concluding a VPC has no gateway — especially before creating a second one.
Deleting a VPN gateway breaks every VPN connection built on it.That includes Fabric links, which are built on the same gateways even though Fabric manages them for you. Fabric will not notice — the link simply stops working, and the Fabric screen won’t explain why.Never delete a gateway Fabric is using. Disconnect from the Fabric screen instead, which tears the link down properly on both sides.

​
Choosing which address to use

Use an address you won’t want for anything else, and note what it’s for. Once an address is a VPN gateway endpoint it’s effectively permanent: the far end of every tunnel has it configured, so changing it means reconfiguring every peer.Don’t use an address that already has Static NAT, and don’t use the Source NAT address. See Public IP Addresses.

VPN Connections

Fabric links, tunnels and remote access.

Fabric

Managed links, which use these gateways.

Customer Gateways

The far end of a site-to-site tunnel.

Public IP Addresses

Acquiring the address to build on.