def create_ipsec_endpoint(cls, gateway, tunnel_interface=None):
        """    
        Create the VPN tunnel endpoint. If the VPN tunnel endpoint
        is an SMC managed device, both a gateway and a tunnel interface
        is required. If the VPN endpoint is an externally managed
        device, only a gateway is required.
        
        :param InternalGateway,ExternalGateway gateway: the gateway
            for this tunnel endpoint
        :param TunnelInterface tunnel_interface: Tunnel interface for
            this RBVPN. This can be None if the gateway is a non-SMC
            managed gateway.
        :rtype: TunnelEndpoint
        """
        tunnel_interface = tunnel_interface.href if tunnel_interface else None
        return TunnelEndpoint(
            gateway_ref=gateway.href,
            tunnel_interface_ref=tunnel_interface)