Gathering Required Setup Information

Private space names can contain between 1 and 36 alphanumeric characters (a-z, A-Z, 0-9) and hyphens (-). Runtime Manager supports Unicode characters in private space names.

The private space name appears in the list when you select a deployment target for your apps.

You cannot rename a private space.

The region is the Amazon region to deploy your apps to, such as usa-e1.

The complete list of supported regions is:

The CIDR block is the range of IPv4 addresses, in CIDR (Classless Inter-Domain Routing) notation that the apps deployed in your private space use. The CIDR block defines the size of the private space. For example, to grant your private network 256 IP addresses between 10.111.0.0 and 10.111.0.255, set the CIDR block to 10.111.0.0/24.

When you create a private space, you must specify the CIDR block. You can’t resize or change the CIDR block after you create the private space. For this reason, ensure that you correctly anticipate your requirements before configuring this parameter.

We recommend a /22 block.

Because some addresses are reserved for fault tolerance, infrastructure, and zero-downtime, the allowed block size that you can assign for your Anypoint VPC is between /16 and /24. Note that the size of the block does not limit the number of IPs that your apps can use.

When specifying CIDR blocks, ensure that the CIDR blocks:

MuleSoft recommends using subnets from standard RFC 1918 addresses, such as 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

If your corporate network uses internal DNS servers to resolve requests to custom domains, you must configure those servers to enable apps deployed to a private space to access internal resources that are not reachable from the public internet.

To configure internal DNS servers, specify the IP addresses for your internal domain servers and the domains that you want to be resolved by internal DNS.

The private space resolves the domains using the specified DNS server, enabling you to use internal host names in your private network as long as your applications use the FQDN to request back-end resources.

The VPN name is the name of the VPN connection.

The remote IP address is the public (single, static) IP address of your VPN endpoint.

For dynamic routing, your device uses Border Gateway Protocol (BGP) to advertise routes to Anypoint VPN. If your device supports BGP, you can select dynamic routing; otherwise, select static routing.

To create a dynamic VPN connection, in addition to the static VPN connection requirements, your VPN device must be able to:

If your gateway device doesn’t support BGP, you must use static routing. You might also want to use static routing if you want to provide your own secrets.

Static routing requires you to specify the routes (subnets) in your network that are accessible through Anypoint VPN.

To create a static VPN connection, your VPN endpoint must be able to:

The local ASN (Autonomous System Number) specifies a private ASN (64512–65534) to assign to the Anypoint Platform side of the VPN.

Use a private ASN that is not already assigned to your network. The default value is 64512.

Although the local ASN isn’t used for static routing, you must specify this value when you create the first VPN because it is required for any future VPN connections using BGP for this private space. For subsequent VPNs that you create in the private space, the Local ASN option is not available for static routing.

To change the local ASN after creating the VPN, you must delete all existing connections first.

The remote ASN specifies a private ASN that corresponds to your backend.

Use either an existing ASN assigned to your network or a private ASN (64512–65534) that is not already assigned to your network. The default value is 65001.

The static IP prefixes are IP prefixes to advertise to your private network in Anypoint Platform, in CIDR notation.

A maximum of 95 route table entries is allowed per private network, regardless of the number of VPN connections. To avoid exceeding the limit, consolidate networks to the fewest number possible.

You can customize the tunnel configuration if you want to specify custom values for inside IP CIDRs and pre-shared keys, or if you want to disable automatic tunnel initiation.

Any values that you don’t specify are set to the default.

A gateway device is a physical or software appliance on your organization’s side of the VPN connection.

Your network administrator must configure the device to work with the Anypoint VPN connection.

The following gateway network devices are known to work with Anypoint VPN. If your device does not appear in the list of tested devices, check the requirements to verify that your device is suitable for use with Anypoint VPN. See Dynamic VPN Routing (BGP) and Static VPN Routing.

Before you can add a transit gateway to CloudHub:

Transit gateway attachment names can contain up to 255 alphanumeric characters (a-z, A-Z, 0-9) and hyphens (-). Runtime Manager supports Unicode characters in private space names.

Use the same name for your transit gateway in AWS. You can change this name later.

The region corresponds to the location of your AWS Transit Gateway.

Your private space and AWS Transit Gateway must be in the same region.

A maximum of 95 route table entries is permitted per VPC, regardless of the number of transit gateway attachments. Consolidate networks to the fewest number possible to avoid exceeding the limit.

The MuleSoft AWS account ID varies depending on your control plane, for example, US Cloud or EU Cloud, and appears in Add transit gateway page when you select to create the transit gateway connection.

When you create a resource share in AWS, you specify this ID to allow Anypoint Platform to access the resource share.

If another team performs AWS configuration, share this MuleSoft AWS account ID with them.

The resource share ID and owner appear on the Create a resource share page on AWS. You use these values to verify the resource share in Anypoint Platform.