fix(s2svpn): update content

pages/account/how-to/log-in-to-the-console.mdx

@@ -9,7 +9,7 @@ dates:
 import LoginMember from '@macros/iam/login-member.mdx'
 import Requirements from '@macros/iam/requirements.mdx'
 
-import image from './assets/scaleway-auth-code.jpg'
+import image from './assets/scaleway-auth-code.webp'
 
 
 <Requirements />

pages/site-to-site-vpn/reference-content/statuses.mdx

@@ -35,8 +35,8 @@ This section explains the different statuses possible for a connection, and how
 
 | **Status**             | **Description**                         | 
 |------------------------|-----------------------------------------|
-| **Ready**             | The connection has been created and is ready to connect. The tunnel(s) cannot be established because the customer gateway device is not yet successfully configured. |
-| **Active**             | The connection has been created, and all expected BGP session(s) between the two gateways are up. Traffic can flow through the connection's tunnel(s). |
+| **Ready**             | The connection has been created and is ready to connect. The tunnel cannot be established because the customer gateway device is not yet successfully configured. |
+| **Active**             | The connection has been created, and all expected BGP session(s) between the two gateways are up. Traffic can flow through the connection's tunnel. |
 | **Limited connectivity**   | The connection has been created, but IP connectivity is limited. This may be the case if the connection has both an IPv4 and an IPv6 routing policy attached, but only one of the two associated BGP sessions is up.|
 | **Down**       | The connection has been created, but no BGP sessions (neither IPv4 not IPv6) are up, and without route announcements no traffic can flow through the tunnel.|
 | **Locked**             | The connection has been locked by the Trust and Safety team. You cannot carry out any actions on the connection. Open a support ticket. |

pages/site-to-site-vpn/reference-content/understanding-s2svpn.mdx

@@ -9,7 +9,6 @@ dates:
 ---
 
 import image1 from './assets/scaleway-s2svpn-conceptual.webp'
-import image2 from './assets/scaleway-vpn-two-tunnels.webp'
 import image3 from './assets/scaleway-vpn-one-tunnel-both.webp'
 import image4 from './assets/scaleway-vpn-one-tunnel-one-type.webp'
 import image5 from './assets/scaleway-vpn-tunnel-detail.webp'
@@ -30,7 +29,7 @@ Scaleway Site-to-Site VPN consists of:
 - A **VPN gateway**: the connection point on the Scaleway side
 - A **customer gateway**: the connection point on the remote side (representing a corresponding physical customer gateway device)
 - A **routing policy**: defines the traffic allowed to flow through the tunnel
-- A **connection**: brings together the three above elements, and defines the configuration for the VPN tunnel(s)
+- A **connection**: brings together the three above elements, and defines the configuration for the VPN tunnel
 
 You must create all of the above elements, and correctly configure your customer gateway device, for a functional Site-to-Site VPN.
 
@@ -44,7 +43,7 @@ The VPN gateway provides a connection point on the Scaleway side of a Site-to-Si
 - **Name** and (optionally) **tags**: A name and tags to identify the gateway.
 - **Gateway type**: Different gateway types are available for different prices. Pricing is based on **bandwidth**, and the **maximum number of connections** the gateway can be used for.
 - **Private Network**: Each gateway must be attached to a single Scaleway Private Network. The network chosen cannot be modified after creation of the gateway. The gateway will get both an IPv4 and IPv6 address on the Private Network. Other Private Networks in the VPC will be able to learn the route through the VPN gateway.
-- **Public IP address(es)**: The address(es) used to establish the VPN tunnel. Maximum of one IPv4 /32 and one IPv6 /128 address per gateway. Gateways with both types of IP will be able to support dual tunnels for a single connection, one IPv4 and one IPv6, providing increased redundancy.
+- **Public IP address(es)**: The address(es) used to establish the VPN tunnel. Maximum of one IPv4 /32 and one IPv6 /128 address per gateway. VPN gateways with both types of IP will be able to support two connections to a single customer gateway, corresponding to one IPv4 tunnel and one IPv6 tunnel, providing increased redundancy.
 
 ### Customer gateway
 
@@ -57,7 +56,8 @@ A customer gateway has the following properties, which you can customize when yo
 
 The rest of the properties **must** correspond to the real properties of the corresponding real customer gateway device:
 
-- **Public IP address**: The address(es) used to establish the VPN tunnel. Maximum of one IPv4 and one IPv6 address per gateway. Gateways with both types of IP will be able to support dual tunnels for a single connection, one IPv4 and one IPv6, providing increased redundancy.
+- **Public IP address**: The address(es) used to establish the VPN tunnel. Maximum of one IPv4 and one IPv6 address per gateway. Customer gateways with both types of IP will be able to support two connections to a single VPN gateway, corresponding to one IPv4 tunnel and one IPv6 tunnel, providing increased redundancy.
+
 - **Autonomous System Number (ASN)**: The unique identifier assigned to the customer's network, used by BGP (Border Gateway Protocol) to exchange routing information with other networks.
 
 <Message type="note">
@@ -83,38 +83,33 @@ You can whitelist multiple **outgoing routes** and multiple **incoming routes**
 
 ### Connection
 
-A connection represents the configuration of a secure link between a VPN gateway and a customer gateway. It defines all the characteristics of the Site-to-Site VPN tunnel(s), including routing policy and encryption method.
+A connection represents the configuration of a secure link between a VPN gateway and a customer gateway. It defines all the characteristics of the Site-to-Site VPN tunnel, including routing policy and encryption method.
 
 A connection has the following properties, which you can customize when you create the policy:
 
 - **Region**: The geographical location in which the connection is created. It must be in the same region as the other Site-to-Site VPN resources (VPN gateways, customer gateways, routing policies) that it uses.
 - **Name** and (optionally) **tags**: A name and tags to identify the policy.
 - **VPN gateway**: The VPN gateway to use for the connection.
 - **Customer gateway**: The customer gateway to use for the connection. It must have at least one public IP type in common with the VPN gateway (IPv4 and/or IPv6).
-
-    Based on the gateways selected, the connection will establish either one or two VPN tunnels between them:
-      - IPv4 tunnel: If both gateways have a public IPv4 address
-      - IPv6 tunnel: If both gateways have a public IPv6 address
-      - IPv4 and IPv6 tunnels: If both gateways have a public IPv4 and a public IPv6 address.
-
+- **Tunnel details**: Based on the gateways selected, you may need to define how the connection should establish the VPN tunnel between them.
+  - If both gateways have public IPv4 and public IPv6 addresses, you must explicitly choose the IP type (IPv4 or IPv6) to be used for the tunnel.
+  - If the gateways share only one public IP type, that IP type will be used automatically for the tunnel.
+  - A maximum of two connections can be created between the same gateway pair: one with an IPv4 tunnel and one with an IPv6 tunnel. Creating two connections/tunnels per gateway pair increases redundancy. Once an IPv4 tunnel is created, only one additional IPv6 tunnel can be established, and vice versa. No further connections are permitted beyond this limit.
+
 - **Routing policy(ies)**: For each traffic type (IPv4 and/or IPv6) to be routed over the connection, an associated routing policy must be attached (see [above](#routing-policy)).
 
     <Message type="tip">
-    IPv6 traffic can travel through a tunnel established between two public IPv4 addresses, and vice versa. You can still attach an IPv4 and an IPv6 routing policy to your VPN connection to allow routing of both types of traffic, even if it only has one VPN tunnel established between one type of public IP. 
-    <br/><br/>
-    Having both types of public IP for both gateways types increases redundancy by providing two tunnels per connection, but it is not this in itself which determines the traffic types which can be routed.
+    IPv6 traffic can travel through a tunnel established between two public IPv4 addresses, and vice versa. You can still attach an IPv4 and an IPv6 routing policy to your VPN connection to allow routing of both types of traffic, even if it only has an IPv4 tunnel. 
     <br/><br/>
-    The following diagram shows a connection with two tunnels, configured to route both types of IP traffic:
-    <Lightbox image={image2} alt="A diagram shows a VPN gateway and a customer gateway, with two tunnels between them. One is via the gateways' public IPv4 addresses, the other via their public IPv6 addresses. Both IPv4 and IPv6 traffic flow through both tunnels."/>
 
-    The following diagram shows a connection with only one tunnel (established via the gateways' public IPv4 addresses), configured to route both types of IP traffic:
-    <Lightbox image={image3} alt="A diagram shows a VPN gateway and a customer gateway, with one tunnel between them, established via their public IPv4 addresses. Both IPv4 and IPv6 traffic flow through the tunnel."/>
+    The following diagram shows a connection with an IPv4 tunnel (i.e., established via the gateways' public IPv4 addresses), configured to route both types of IP traffic:
+    <Lightbox image={image3} alt="A diagram shows a VPN gateway and a customer gateway, with a tunnel between them established via their public IPv4 addresses. Both IPv4 and IPv6 traffic flow through the tunnel."/>
 
-    The following diagram shows a connection with only one tunnel (established via the gateways' public IPv6 addresses), which has been configured to only route IPv4 traffic:
-    <Lightbox image={image4} alt="A diagram shows a VPN gateway and a customer gateway, with one tunnel between them, established via their public IPv6 addresses. IPv4 traffic flows through the tunnel."/>
+    The following diagram shows a connection with an IPv6 tunnel (i.e. established via the gateways' public IPv6 addresses), which has been configured to only route IPv4 traffic:
+    <Lightbox image={image4} alt="A diagram shows a VPN gateway and a customer gateway, with a tunnel between them established via their public IPv6 addresses. IPv4 traffic flows through the tunnel."/>
     </Message>
 
-- **Connection initiation policy**: Which gateway should initiate the tunnel(s). This can be either the VPN gateway, or the customer gateway. The chosen gateway will be responsible for kicking off the secure exchange that sets up the IPsec tunnel(s).
+- **Connection initiation policy**: Which gateway should initiate the tunnel. This can be either the VPN gateway, or the customer gateway. The chosen gateway will be responsible for kicking off the secure exchange that sets up the IPsec tunnel.
 
 - **Security proposal**: Defines the encryption and authentication methods used to secure the VPN tunnel. For full details on available security proposals, see our [dedicated documentation](/site-to-site-vpn/reference-content/security-proposals/).
 
@@ -134,9 +129,9 @@ Scaleway cannot configure your device for you. In order to successfully complete
 
 You also need to set up route announcements and filters on the customer side. For this, you will need the following information:
 
-- **BGP interconnection subnet(s)**: The private subnet used to provide private IP addresses for the VPN gateway and customer gateway over the tunnel(s). The gateways connect over this private subnet to establish a BGP session and exchange routing information. For connections that are configured to route both IPv4 and IPv6 traffic, one IPv4 and one IPv6 subnet will be provided. Subnet information can be accessed via the API.
+- **BGP interconnection subnet(s)**: The private subnet used to provide private IP addresses for the VPN gateway and customer gateway over the tunnel. The gateways connect over this private subnet to establish a BGP session and exchange routing information. For connections that are configured to route both IPv4 and IPv6 traffic, one IPv4 and one IPv6 subnet will be provided. Subnet information can be accessed via the API.
 
-    <Lightbox image={image5} alt="A diagram shows a VPN gateway and a customer gateway, with one tunnel between them, established via their public IPv4 addresses. IPv4 and IPv6 traffic is routed through the tunnel. Two BGP sessions are established within the tunnel between the two gateways over private subnets: one IPv4 and one IPv6, whereby they exchange route announcements for each traffic type."/>
+    <Lightbox image={image5} alt="A diagram shows a VPN gateway and a customer gateway, with a tunnel between them established via their public IPv4 addresses. IPv4 and IPv6 traffic is routed through the tunnel. Two BGP sessions are established within the tunnel between the two gateways over private subnets: one IPv4 and one IPv6, whereby they exchange route announcements for each traffic type."/>
 
 - **Routing policy**: Take into account the routing policy(ies) you attached to the connection, when configuring routing policy on the customer gateway device.