---
title: How to create and manage a customer gateway
description: Learn how to create and manage a customer gateway on Scaleway to establish a Site-to-Site VPN. This guide covers setting up the gateway object, configuring ASN and public IP details, and preparing for on-premises device configuration.
tags: site-to-site-vpn vpn customer-gateway vpn-gateway networking vpc ipsec bgp routing-policy remote-access network-infrastructure on-premises
dates:
  validation: 2025-12-31
  posted: 2025-12-31
---
import Requirements from '@macros/iam/requirements.mdx'

import s2sDiagram from './assets/scaleway-s2svpn-conceptual.webp'

A customer gateway is one of the essential building blocks of a Site-to-Site VPN. It provides the connection point on the remote side of a VPN tunnel.

<Lightbox image={s2sDiagram} alt="A diagram shows how a VPN gateway connects to a Private Network within a Scaleway VPC, and how a VPN connection then links it to a customer gateway " />

This document explains how to create and manage a **customer gateway** with the Scaleway console. 

<Message type="note">
A customer gateway in this context is an object representing a **real** corresponding physical (or virtual) customer gateway device on your remote infrastructure. You, as the customer, must also [set up the real customer gateway networking device](/site-to-site-vpn/reference-content/configuring-customer-gateway-device/), which can be physical or software-based.
</Message>

<Requirements />

- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization

## How to create a customer gateway

1. Click **Site-to-Site VPN** in the **Network** section of the [Scaleway console](https://console.scaleway.com) side menu. A listing of your VPN connections displays.

2. Click the **Customer gateways** tab, then **Create Customer gateway**. The creation wizard displays.

3. **Choose a region** in which to create your customer gateway. The resource will be created in this geographical location. Customer gateways must be in the same region as the resources (VPN gateways, connections etc.) that you link them with to create a Site-to-Site VPN tunnel.

4. **Define connectivity parameters**, to supply Scaleway with essential details of your remote customer gateway device:

    - **IP address**: Provide the public IP address(es) of your customer gateway device, used to establish the VPN tunnel. If you want to be able to create two connections between this gateway and a single VPN gateway (for dual tunnels, increasing redundancy), provide an address for each IP type.
    - **ASN**: Provide the unique identifier assigned to the customer's network, used by BGP (Border Gateway Protocol) to exchange routing information with other networks.

    <Message type="tip">
    The ASN must be different to Scaleway's ASN (12876). This means you cannot use Site-to-Site VPN to create a VPN tunnel between two Scaleway VPCs (peering). Watch this space for our official VPC peering solution, planned for the future.

    ASNs can be public (globally unique) or private (unique within an organization). If you are unsure of your customer gateway device's ASN, we recommend entering a private ASN, in range `64512` to `65534`.
    </Message>

5. **Enter a name and (optionally) tags** for the customer gateway.

6. Click **Create customer gateway** to finish.

Your gateway is created, and you are directed to its **Overview** page.

To continue setting up a Site-to-Site VPN, [create a routing policy](/site-to-site-vpn/how-to/create-manage-routing-policy/) or [create a connection](/site-to-site-vpn/how-to/create-manage-vpn-connection/).

## How to view a customer gateway's details

1. Click **Site-to-Site VPN** in the **Network** section of the [Scaleway console](https://console.scaleway.com) side menu. A listing of your VPN connections displays.

2. Click the **Customer gateways** tab.

3. Use the **region selector** at the top of the page to filter for the region of the customer gateway you want to configure, then click the gateway in the listing. The gateway's **Overview** page displays.

Here you can view the gateway's:
  - Region
  - ID
  - ASN
  - Public IP addresses
  - Number of [VPN connections](/site-to-site-vpn/concepts/#connection) it is used in

## How to edit a customer gateway

Currently, the only parameters of a customer gateway that can be edited after creation are its **name** and **tags**.

1. Click **Site-to-Site VPN** in the **Network** section of the [Scaleway console](https://console.scaleway.com) side menu. A listing of your VPN connections displays.

2. Click the **Customer gateways** tab.

3. Use the **region selector** at the top of the page to filter for the region of the customer gateway you want to configure, then click the gateway in the listing. The gateway's **Overview** page displays.

4. Click the **Settings** tab.

5. Make your edits as required:
    - Click directly on the gateway's name at the top of the page to edit it.
    - Type new tags directly in the **Tags** box, or use the **x** icon to remove an existing tag.

## How to configure a customer gateway device

Your customer gateway device is a real physical or software-based networking device, located on the remote network you want to connect to your Scaleway VPC. The customer gateway that you create in Scaleway is a logical representation of this device.

Creating the customer gateway on the Scaleway side does not automatically configure the corresponding physical or virtual device. This must be set up separately by you or your network administrator to establish the Site-to-Site VPN connection.

See our [dedicated page](/site-to-site-vpn/reference-content/configuring-customer-gateway-device/) for advice on configuring your customer gateway device.

## How to delete a customer gateway

You must [deactivate route propagation](/site-to-site-vpn/how-to/create-manage-vpn-connection/#how-to-activate-or-deactivate-route-propagation) on any VPN connections linked to the customer gateway, before you can delete the gateway.

1. Click **Site-to-Site VPN** in the **Network** section of the [Scaleway console](https://console.scaleway.com) side menu. A listing of your VPN connections displays.

2. Click the **Customer gateways** tab.

3. Use the **region selector** at the top of the page to filter for the region of the VPN gateway you want to configure, then click the gateway in the listing. The gateway's **Overview** page displays.

4. Click the **Settings** tab.

5. Click **Delete customer gateway**.

    A pop-up displays, informing you that any [VPN connections](/site-to-site-vpn/concepts/#connection) using this gateway will be auto-deleted.

    You must manually delete any other objects associated with the gateway, such as VPN gateways or routing policies, if you do not need them anymore.

6. Type **DELETE** to confirm you want to proceed, then click the **Delete** button.

The gateway is deleted, and you are returned to the list of your customer gateways.