​
Overview

A customer gateway describes the remote end of a VPN tunnel: a device you operate, its public address, the networks behind it, and the cryptographic parameters. It’s a definition, not a connection — you define the gateway here, then create a site-to-site VPN that uses it.
Navigation: Networking → Customer Gateways. Titled Customer Gateways, subtitled “Remote endpoints for site-to-site VPN connections”.

​
Grouped by remote endpoint

This screen groups rows by remote IP rather than listing them flat, because one physical remote device commonly connects to several zones. Each group header shows the Remote IP, its CIDR, and how many zone connections use it. Filters are pills rather than dropdowns: Search matches name, IP, and CIDR.

​
What a row shows

Encryption badges are colour-coded by strength — green for 256-bit and above, amber below. An amber badge isn’t broken, but it’s worth knowing you’re on weaker parameters than the remote device may support.
The status dot on every row is always green. It reflects that the definition exists, not that a tunnel is up. For actual tunnel state, look at the site-to-site VPN connection using this gateway.

​
Adding a gateway

Add Gateway — “Define a remote endpoint for a site-to-site VPN connection”. Missing anything required gives one combined message: Name, gateway IP, CIDR list, and IPSec PSK are required.
There is no format validation on the IP or the CIDR. A typo in either is accepted and saved, and only surfaces later as a tunnel that won’t establish — with no error pointing at the cause.Check both against the remote device’s actual configuration before saving. A transposed digit here can cost an afternoon of debugging on the wrong side.

​
About the parameters

The pre-shared key is a secret. Generate a long random value, store it in your password manager, and don’t paste it into tickets or chat. If it leaks, anyone reaching your gateway address can attempt to establish a tunnel.
Almost every failed site-to-site VPN comes down to a mismatch: the PSK differs, or the IKE and ESP proposals don’t overlap. Get the remote device’s configuration in front of you and set both ends from the same source rather than from memory.

​
Naming

Names are parsed as cgw-<from>-to-<to> and rendered as two endpoints with an arrow. A name in that shape reads well in the table; anything else displays as-is.
Follow the convention — cgw-ca-east-a-to-hq beats office. The Source → Destination column is the fastest way to scan this screen, and it only works if the names cooperate.

​
Deleting

Delete asks: “Delete customer gateway ""? Any site-to-site VPN connections using this gateway must be removed first. This action cannot be undone.”
Remove the VPN connections that use a gateway before deleting it. The dialog states the dependency but won’t list which connections are in the way.

​
Worked example: connect your office network

1

Collect the remote details first

From whoever runs the office firewall: its public address, the LAN ranges you need to reach, and the IKE and ESP proposals it’s configured for. Guessing any of these produces a tunnel that fails silently.
2

Check for CIDR overlap

If the office is 192.168.1.0/24, no Simnet VPC involved may use that range. Overlapping networks cannot be routed between, and a VPC’s CIDR can’t be changed later.
3

Generate a strong pre-shared key

Store it in your password manager immediately.
4

Create the gateway

Add Gateway → name cgw-ca-east-a-to-hq, the office’s public IP, CIDR 192.168.1.0/24, the PSK, and the IKE and ESP policies matching the office device.
5

Verify the IP and CIDR by eye

Nothing validated them. Read both back against the source before moving on.
6

Create the VPN connection

From the VPC’s VPN Gateway tab, create a connection referencing this customer gateway. See Site-to-Site VPN.
7

Allow the traffic in your firewall policy

An established tunnel still carries nothing until the firewall policy allows it — ingress from 192.168.1.0/24, plus egress, since policies are stateless.
8

Test from both directions

Ping a Simnet private address from the office, and an office address from a Simnet machine. One direction working and the other not usually means a missing rule rather than a tunnel problem.

​
Empty and error states

Site-to-Site VPN

The Simnet-side gateways these connect to.

Firewall Policies

A tunnel carries nothing without rules.

Fabric

Connecting Simnet VPCs to each other instead.