Contact Us 1-800-596-4880
  1. Homepage
  2. CloudHub
  3. Virtual Private Cloud

  4. VPC Connectivity Methods

Anypoint VPC Connectivity Methods

You can connect an Anypoint Virtual Private Cloud (Anypoint VPC) to your private network using these methods:

  • IPsec tunnel

  • Transit gateway attachment

  • VPC peering

    To connect your Anypoint VPC using VPC peering, contact your MuleSoft Support representative.

  • AWS Direct Connect

    To connect your Anypoint VPC using AWS Direct Connect, contact your MuleSoft Support representative.

A maximum of 95 route table entries is allowed per VPC, regardless of the number of connections. To avoid exceeding the limit, consolidate networks to the fewest number possible.

IPsec Tunnel

You can use an IPsec tunnel with network-to-network configuration to connect your on-premises data centers to your Anypoint VPC. An IPsec VPN tunnel is generally the recommended solution for VPC to on-premises connectivity, as it provides a standardized, secure way to connect. This method also integrates well with existing IT infrastructure such as routers and appliances.

IPsec Tunnel Overview
If you are using a legacy VPN, migrate to Anypoint VPN before making changes.

To create an Anypoint VPN connection to your network, see Anypoint VPN.

Transit Gateway Attachments

AWS Transit Gateway acts as a cloud router in AWS, simplifying network access between VPCs, on-premises data centers, and third-party software, while providing increased visibility and control over the network. Transit gateways effectively merge your organization’s cloud resources and on-premises datacenters into one network topology.

On CloudHub, you can take advantage of this network simplification by securely attaching Anypoint VPC to an AWS Transit Gateway in your AWS account.

To use transit gateway attachments, your Anypoint VPC and AWS transit gateway must be in the same region.

Transit Gateway Overview

To attach your Anypoint VPC to your transit gateway, see Transit Gateway Attachments.

VPC Peering

VPC peering provides a connection between two VPCs. In this case, it pairs your private Amazon VPC directly to your Anypoint VPC. This enables you to route traffic between the two VPCs so they can communicate as though they are in the same network.

VPC Peering Overview

To use VPC Peering, your AWS and Anypoint VPCs must be located in the same region.

AWS Direct Connect

To create a Direct Connect connection to Anypoint VPC, create or use an existing AWS Transit Gateway in your AWS account and set up the Direct Connect connection to the Transit Gateway. Then, attach Anypoint VPC to the Transit Gateway and configure the required routing to enable Anypoint VPC on-premises connectivity.

On your AWS account, attach Direct Connect connections to a Direct Connect Gateway and associate that Direct Connect Gateway with your Transit Gateway. Anypoint VPC attaches to the Transit Gateway.

AWS Direct Connect Overview

To use Direct Connect, your AWS Direct Connect Partner and the Anypoint VPCs must be located in the same region. Direct Connect requires the Border Gateway Protocol (BGP) for dynamic routing. Static routing isn’t supported.

Direct Connect High Availability

A single Direct Connect connection isn’t sufficient for high availability. A failure at the facility, hardware, or connection level can cause total connectivity loss.

For workloads that require high availability, use multiple Direct Connect connections that enter the AWS Global Network at two AWS Direct Connect locations and converge at a Transit Gateway in your AWS account. Attach Anypoint VPC to that Transit Gateway.

High Availability Direct Connect for Anypoint VPC

This HA topology uses these components:

  • On-premises infrastructure
    Network traffic originates from your on-premises environment. Use a single data center with redundant edge routers, or distribute traffic across multiple physical data centers.

  • Two AWS Direct Connect locations
    To provide path redundancy, Direct Connect connections must enter the AWS Global Network at two AWS facilities. See AWS Direct Connect Locations.

  • AWS Transit Gateway
    The Transit Gateway in your AWS account acts as a centralized cloud router. Attach both Direct Connect connections to a Direct Connect Gateway, and associate that Direct Connect Gateway with the Transit Gateway.

  • Anypoint VPC
    Attach Anypoint VPC to your Transit Gateway to route traffic privately to your on-premises resources.

Prerequisites

Before you configure Direct Connect high availability:

  • Provision the Transit Gateway and Anypoint VPC in the same AWS region.

  • Use BGP for dynamic routing. Static routing isn’t supported.

  • Plan Direct Connect connections at two AWS Direct Connect locations.

  • Stay within the 95 route table entries allowed per Anypoint VPC. Consolidate networks with summary routes so you don’t exceed the limit.

Configure Direct Connect High Availability

  1. In your AWS account, create a Transit Gateway in the same region as your Anypoint VPC.

  2. Work with AWS or your AWS Direct Connect Partner to provision dedicated or hosted connections at two physical locations:

    1. Establish connection A between your on-premises network and AWS Direct Connect Location 1.

    2. Establish connection B between your on-premises network and AWS Direct Connect Location 2.

    3. Create the virtual interfaces (VIFs) required to attach both Direct Connect connections to your Transit Gateway through a Direct Connect Gateway.

  3. Enable BGP over both Direct Connect connections.

    To manage traffic as active/passive or active/active, configure your on-premises edge routers. For an active/standby setup, use AS path prepending on the secondary connection so it’s a less preferred route during normal operations. See Routing policies for Direct Connect in the AWS documentation.

  4. Verify that routes propagate from the Direct Connect Gateway into the Transit Gateway route table associated with Anypoint VPC.

  5. Attach Anypoint VPC to the Transit Gateway. See Attach to Transit Gateways.

  6. In your Transit Gateway route tables, route traffic destined for your on-premises network over the Direct Connect links, and route traffic destined for Anypoint VPC to the VPC attachment.

Failover Behavior

Because this architecture uses BGP for dynamic routing across redundant paths, failover is automatic:

  • If the primary network link, on-premises router, or AWS Direct Connect location fails, BGP withdraws the primary routes.

  • If the Transit Gateway moves active traffic to the secondary Direct Connect connection.

  • When the primary connection is restored, BGP re-advertises the preferred routes and traffic returns to its normal path. You don’t need to update routing manually in CloudHub or AWS.

Before deleting a VPC that uses Direct Connect, contact MuleSoft Support to remove the Direct Connect connection.

MuleSoft Support manually provisions and removes Direct Connect connections. If you delete a VPC before removing Direct Connect, the deletion can fail and leave resources (VPCs, virtual gateway attachments, and hosted connections) in AWS.

See Also