Method and device for managing one or more secure gateway virtual private network, VPN, devices (104, 105) in a secure VPN for cryptographically separated and tunnelled VPN communication. VPN configuration data provided by a management system (110) is received (401); and the received VPN configuration data and a domain type encapsulating (402,403), wherein said domain type identifying an administrative network domain for cryptographically separated and tunnelled management communication with a hardware separated administrative controller (121) of said one or more secure gateway VPN devices (104, 105), exclusively for management of said one or more secure gateway VPN devices (104, 105).