salesforce Dreamforce On-Demand
Contact Us 1-800-596-4880
  1. Homepage
  2. CloudHub
  3. Transit Gateway Attachments

  4. Attach to Transit Gateways

Attach to Transit Gateways

Use Anypoint Runtime Manager to add a transit gateway and connect your Anypoint Virtual Private Cloud (VPC) to your private corporate network.

Prerequisites

Before you can add a transit gateway to CloudHub:

  • Create a transit gateway on your corporate AWS account.

    See Getting started with transit gateways in the AWS documentation for information about creating a transit gateway on AWS.

    One transit gateway can support up to 10 VPC attachments.

  • The number of attachments you can make to AWS Transit Gateways depends on the network connections available to your Business Group.

    The Transit Gateways page is visible in Runtime Manager to Anypoint organizations that have an Anypoint VPC and VPN license.

    Attaching one Anypoint VPC to an AWS Transit Gateway uses one Anypoint VPN license. You can check or edit the licenses allocated to the Business Group by navigating to Access Management > Organizations and choosing the relevant Business Group. Update or view the Network Connection options as required, and save any changes.

  • Sign in to an Anypoint Platform account with either the CloudHub Network Administrator or the CloudHub Network Viewer user permission.

    See Grant Permissions and Roles to Users.

  • Create an Anypoint VPC in Anypoint Platform.

    See Create and Update a VPC for Runtime Manager.

  • Identify the subnets in your network (in CIDR notation) that you want to make accessible through the transit gateway.

Transit Gateway Attachment Workflow

The steps for attaching to a transit gateway are:

  1. Add the transit gateway to Anypoint Platform by creating a resource share in AWS to share your transit gateway with Anypoint Platform.

  2. Attach your VPCs to the transit gateway and accept the VPC attachments in AWS.

  3. Configure transit gateway routing:

    1. Enable outbound traffic from Anypoint VPC.

    2. Enable inbound traffic through the transit gateway on AWS.

Add a Transit Gateway

To add a transit gateway:

  1. Sign in to Anypoint Platform and select Runtime Manager.

  2. From the Runtime Manager navigation menu, click Transit Gateways, and then click Add Transit Gateway.

    The Here’s what’s coming page lists the steps to add the transit gateway:

    Here’s what’s coming page

  3. Click I’m ready.

  4. Specify a name for your transit gateway:

    Add transit gateway page

    Use the same name for your transit gateway in AWS. You can change this name later. The name can contain up to 255 alphanumeric characters (a-z, A-Z, 0-9) and hyphens (-).

  5. Select the region that corresponds to the location of your AWS Transit Gateway.

    See Regional Services.

    Your Anypoint VPC and AWS Transit Gateway must be in the same region.

  6. Click Next.

    The Add transit gateway page lists the steps to create a resource share in AWS:

    Add transit gateway page: Steps to create a resource share
    The MuleSoft AWS Account ID relevant for your Anypoint VPC is displayed at this step. As this ID varies, always use the Account ID displayed in this step for your AWS configuration. If the AWS configuration is performed by other teams or resources within your organization, please share this MuleSoft AWS account ID with them.

Create a Resource Share

  1. Sign in to your AWS corporate account.

  2. In Anypoint Platform, click the Create resource share link on the Add transit gateway page.

    The link opens the AWS RAM console to the page for creating a resource share in the region you specified.

  3. Take the following actions on the AWS Create resource share page:

    1. Under Description, enter a descriptive name for the resource share in the Name field.

    2. Under Resources - optional, select Transit Gateways from the Select resource type menu and select the transit gateway resource to share.

      The transit gateway ID appears in the Selected resources field.

    3. Under Principals - optional, ensure that Allow external accounts is selected, enter the MuleSoft AWS account ID that appears on the Add transit gateway page, and click Add.

      The AWS account number appears in the Selected principals field.

    4. Under Tags, add a tag if you want.

    5. Click Create resource share.

    6. Copy the ID and Owner values for the resource share you just created.

  4. Take the following actions in the Anypoint Platform Add transit gateway window:

    1. Click Next.

    2. Paste the values you copied from AWS in the ID and Owner fields:

      Add transit gateway page: Resource share ID and owner ID

      • The resource share ID field contains alphanumeric characters (a-z, A-Z, 0-9) and hyphens (-).

      • The resource share Owner field contains only numbers.

    3. Click Add.

    The Transit Gateways page shows the progress for connecting to AWS and adding the transit gateway to Anypoint Platform.

When the transit gateway addition succeeds, the Transit Gateways page displays the Transit gateway added message. The Transit Gateways page updates the owner and ID from AWS and the state as Available:

Transit gateway added

If the transit gateway addition fails, see Troubleshoot Transit Gateway Attachments.

Attach Anypoint VPC to the Transit Gateway

After the transit gateway attachment succeeds, attach your Anypoint VPC to enable apps to access the transit gateway.

For information about limitations when attaching an Anypoint VPC to a transit gateway, see Transit gateway attachments to a VPC in the AWS documentation.

To attach Anypoint VPC to the transit gateway:

  1. In Anypoint Platform, on the Transit Gateways page, click Attach VPC.

    The Attach VPC button is disabled if no VPCs are available to attach or if the transit gateway addition failed.

  2. From the Select VPC window, select the VPC to attach:

    Select VPC window

    The window displays only the VPCs that are:

    • In the same region as the transit gateway

    • Not already attached to the transit gateway

    • In business groups for which you have CloudHub Network Administrator permissions

  3. Click Next.

Accept the VPC Attachment

  1. Sign in to your AWS corporate account.

  2. In Anypoint Platform, on the Accept VPC Attachment page, click the Transit Gateway Attachments link:

    Accept VPC Attachment page

    The link opens the AWS RAM console to the Create Transit Gateway Attachment page.

  3. In the AWS console:

    1. Select the attachment that shows pending acceptance in the State column.

      The attachment might take a few minutes to appear.

    2. Select the transit gateway attachment ID and, on the Details tab, ensure that Resource owner account ID is the MuleSoft AWS account ID.

    3. Click the pencil icon for the attachment and enter a name.

    4. Select Actions > Accept and click Accept to confirm.

      When the attachment acceptance succeeds, the State column shows available.

  4. In Anypoint Platform, in the Accept VPC Attachment window, click Done.

    The Transit Gateways page shows the progress for accepting the VPC attachment from Anypoint Platform to AWS:

    Checking VPC attachment status

  5. Click Refresh to update the attachment status.

When the VPC attachment succeeds, the Transit Gateways page displays the VPC attached message and the attachment state indicates that it’s attached to AWS Transit Gateway:

VPC attached successfully

If the VPC attachment state is Rejected, see Troubleshoot Transit Gateway Attachments.

Configure Transit Gateway Routing

Anypoint VPC supports static routing for transit gateways.

Configure the network routes (subnets) that you want to be accessible through the transit gateway:

Prerequisites

Before configuring routing, consolidate networks to the fewest number possible. A maximum of 95 route table entries is permitted per VPC, regardless of the number of transit gateway attachments.

Enable Outbound Traffic from Anypoint VPC

After attaching the VPC, enable outbound traffic from Anypoint VPC to an external destination so that apps can access the transit gateway and the transit gateway routes traffic correctly.

To do this, add routes to the transit gateway route table:

  1. In Anypoint Platform, navigate to Transit Gateways > VPCs and click Add Route.

  2. On the Add VPC Route window, use CIDR notation to enter a single subnet for your AWS VPC:

    Add VPC route

  3. Click Add Route.

    Anypoint Platform submits the new route to AWS.

When the route addition succeeds, the Transit Gateways page shows the Route added message and the Transit Gateways page shows the route CIDR in the route table.

In the route table, added routes show Transit Gateway as the value in the Next Hop column:

Transit Gateway in the Next Hop column of the route table

Enable Inbound Traffic Through the Transit Gateway

After successfully adding routes to the transit gateway route table in Anypoint Platform, enable inbound traffic through your transit gateway on AWS.

You might need to coordinate with your network administrator to enable inbound traffic.

See Also