--- schema_version: "1" id: b13ac490b7f183d4ed7ac23b1b4d60b8da60a60cfe335b4db5d735d599c35e66 title: Creating Transit Gateway Attachments collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/cloudhub-2/ps-create-configure-tgw.md canonical_url: https://docs.mulesoft.com/cloudhub-2/ps-create-configure-tgw source_site: docs.mulesoft.com content_type: documentation content_hash: a680a69fe46660f7899b86ce4fd872730bfa15aa8d49d0372ec4cb3c667f5b59 description: MuleSoft Documentation Site latest: true --- --- product: CloudHub 2.0 --- # Creating Transit Gateway Attachments > For the full documentation index, see: https://docs.mulesoft.com/llms.txt When you attach a transit gateway to a private space, CloudHub 2.0 creates a _transit gateway attachment_ to represent the connection on Amazon Web Services (AWS). You can attach the same transit gateway to on-premises VPCs in your own AWS account to enable communication between private spaces and VPCs. Multiple private spaces can connect to an internal VPC. You can reuse a transit gateway attachment by connecting another private space to it and accepting the attachment. You don’t need to create the resource share again. ## Before You Begin - Before creating a transit gateway attachment, [create the private network](https://docs.mulesoft.com/cloudhub-2/ps-create-configure#create-private-network). - Ensure the private space belongs to the same region in which you are creating the transit gateway attachment. Inter-region peering is not supported. For example, you cannot attach transit gateway attachment from region A to a private space belonging to region B. > [!IMPORTANT] Update your infrastructure (such as firewalls, routes, and connections) before > creating transit gateway attachments. When a transit gateway is pending acceptance, all > infrastructure updates are delayed until you accept the attachment. ## Connect to a Transit Gateway For information about limitations when attaching a VPC to a transit gateway, see [Transit gateway attachments to a VPC](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-vpc-attachments.html) in the AWS documentation. To connect to a transit gateway: 1. From Anypoint Platform, select **Runtime Manager** > **Private Spaces**. 2. Click the name of the private space to manage. 3. On the **Network** tab, in the **Connections** section, **Create Connection**. 4. On the **Create Connection** page, select **Transit Gateway**. If CloudHub 2.0 finds any existing transit gateways in the organization, you can select a transit gateway or click **Add a new transit gateway** and then enter the [name](https://docs.mulesoft.com/cloudhub-2/ps-gather-setup-info#transit-gateway-name) in the **Connection Name** field. Use the same name for your transit gateway in AWS. You can change this name later. Connection names can contain up to 60 alphanumeric characters (a-z, A-Z, 0-9), spaces, and hyphens (-). Runtime Manager supports Unicode characters in connection names. 5. Click **Next**. Depending on whether you selected an existing transit gateway or are adding a new one, the **Add Transit Gateway** page lists the steps to create a resource share in AWS: 1. [Configure routes](#configure-tgw-routes). 2. [Create a resource share](#create-resource-share). (new gateway only) 3. [Verify the resource share](#verify-resource-share). (new gateway only) 4. [Accept the attachment](#accept-tgw-attachment). ## Configure Routes In **Static Routes**, enter the IP prefixes of the external networks to connect through the transit gateway, and then click **Next**. The routes should match VPC CIDR range so traffic can flow between the private VPC in AWS and the private space in CloudHub 2.0. After you attach the transit gateway, the private space includes the routes you specify here. To display the existing routes for the network, click **Show Existing Routes for this Network**. You can add or remove routes later. For information, see [Add or Remove a Route from the Route Table](https://docs.mulesoft.com/cloudhub-2/ps-manage#add-remove-routes). ## Create a Resource Share 1. In another browser window, sign in to your AWS corporate account. 2. In Anypoint Platform, click the **Create Resource Share** link on the **Add Transit Gateway** page. The link opens the AWS RAM console to the page for creating a resource share in the region you specified for your private space. 3. Take the following actions on the AWS **Create resource share** page: 1. Under **Description**, enter a descriptive name for the resource share in the **Name** field. 2. Under **Resources - _optional_**, select **Transit Gateways** from the **Select resource type** menu and select the transit gateway resource to share. The transit gateway ID appears in the **Selected resources** field. 3. Under **Principals - _optional_**, ensure that **Allow external accounts** is selected, enter the MuleSoft AWS account ID that appears on the **Add Transit Gateway** page in Anypoint Platform, and click **Add**. The AWS account number appears in the **Selected principals** field. 4. Under **Tags**, add a tag if you want. 5. Click **Create resource share**. 6. Copy the **ID** and **Owner** values for the resource share you just created. 7. Click **Next**. ## Verify the Resource Share 1. On the Anypoint Platform **Add Transit Gateway** page, paste the values you copied from AWS in the **ID** and **Owner** fields: - The resource share **ID** field contains alphanumeric characters (a-z, A-Z, 0-9) and hyphens (-). - The resource share **Owner** field contains only numbers. 2. Click **Next**. CloudHub 2.0 uses the resource share owner and ID you provide to attach the associated transit gateway on AWS to the private space. When the attachment succeeds, you see the `Attachment Created` message and you return to the **Add Transit Gateway** page. ## Accept the Attachment 1. On the **Add Transit Gateway** page, click the **Transit Gateway Attachments** link. The link opens the AWS RAM console to the page for accepting the transit gateway attachments in the region you specified. 2. On the **Transit Gateway Attachments** page, select the attachment that shows **pending acceptance** in the **State** column. The attachment might take a few minutes to appear. To verify that the attachment is correct, select the transit gateway attachment ID and, on the **Details** tab, ensure that the **Resource owner account ID** is the MuleSoft AWS account ID from the **Add Transit Gateway** page. 3. From the **Actions** menu, select **Accept**. 4. When the attachment state changes to **available**, return to the **Add Transit Gateway** page and click **Done**. You return to the **Network** tab for the private space. The **Connections** section shows the transit gateway ID and owner from AWS and indicates that the transit gateway state is **Available** and the attachment state is **Attached to Private Network**: If the VPC attachment state is **Not Attached to VPC**, the transit gateway is not attached. Click **Accept the attachment** link and follow the steps again. 5. [Test the connection](#test-connection) from your private space to the transit gateway. ## Configure Transit Gateway Routing CloudHub 2.0 supports static routing for transit gateways. Configure the network routes (subnets) that you want to be accessible through the transit gateway: - On Anypoint Platform, [configure routes for outbound traffic from the private space](#enable-outbound-traffic-from-ps) to an external destination. - On AWS, [enable inbound traffic](#enable-inbound-traffic-on-aws) through your transit gateway. ### Configure Routes for Outbound Traffic from the Private Space After the **Attached to Private Network** message appears, the private spaces adds the routes that you [specified](#connect-tgw) so that apps deployed to the private space can access the transit gateway. To add routes to the transit gateway route table, see [Add or Remove a Route from the Route Table](https://docs.mulesoft.com/cloudhub-2/ps-manage#add-remove-routes). ### Enable Inbound Traffic Through the Transit Gateway After successfully adding routes to the transit gateway route table in Anypoint Platform, enable inbound traffic through your transit gateway on AWS. You might need to coordinate with your network administrator to enable inbound traffic. ## Test the Connection to Your Private Space After you connect to a transit gateway, test the connectivity from CloudHub 2.0 to your networks. To test the connection, use the Network Tools application. For download and usage information about the Network Tools application, see [How To Use Network Tools Application](https://help.salesforce.com/s/articleView?id=001115029&type=1). ## Maintain the Transit Gateway After you test the connection to your private space, periodically check the connection to your transit gateway. If your private space loses access to the transit gateway, the state of the transit gateway changes to `unknown` or `deleted`. If the transit gateway remains in the `unknown` or `deleted` state for 14 days, Anypoint Platform might remove the private space attachments from the transit gateway. However, the transit gateway itself is not removed. Your private space loses access to a transit gateway when: - The transit gateway is deleted from CloudHub 2.0. - The transit gateway is deleted from the AWS console. - A resource share is deleted. - The MuleSoft account principal is deleted from the resource share. To remove or delete the transit gateway from CloudHub 2.0, complete the steps in [Delete a Transit Gateway](#delete-tgw) before deleting the transit gateway, transit gateway attachment, or resource share from the AWS console. Removing connections from the AWS console without removing them from CloudHub 2.0 disrupts the connection but does not remove it. ## Troubleshoot States for the Transit Gateway or Transit Gateway Attachment When the transit gateway connection is disrupted, the state of the transit gateway or transit gateway attachment changes to `unknown`, `rejected`, or `deleted`. Depending on the cause of the state change, you can fix the state of the transit gateway or transit gateway attachment by deleting and recreating or detaching and reattaching them. ### Resolve Transit Gateway States The `unknown` state for a transit gateway state occurs when: - The transit gateway or resource share is deleted. To fix this state, delete the transit gateway from CloudHub 2.0 using the steps in [Delete a Transit Gateway](#delete-tgw). - The MuleSoft account principal is deleted. To fix this state, add the principal in the resource share. The `deleted` state occurs when the transit gateway is deleted from the AWS console but not CloudHub 2.0. To fix this state, delete the transit gateway from CloudHub 2.0 using the steps in [Delete a Transit Gateway](#delete-tgw), then create a new transit gateway. ### Resolve Transit Gateway Attachment States The `deleted` state for a transit gateway attachment occurs when the transit gateway attachment is deleted from the AWS console but not CloudHub 2.0. To fix this state, detach the transit gateway attachment from the private space using the steps in [Detach a Transit Gateway from the Private Space](#detach-tgw), then reattach the transit gateway attachment. The `rejected` state for a transit gateway attachment occurs when the transit gateway attachment is rejected. To fix this state, detach the transit gateway attachment from the private space using the steps in [Detach a Transit Gateway from the Private Space](#detach-tgw), then reattach the transit gateway attachment. ## Rename a Transit Gateway Attachment You might want to rename a transit gateway attachment to match the attachment name in AWS. To rename a transit gateway attachment: 1. From Anypoint Platform, select **Runtime Manager** > **Private Spaces**. 2. Click the name of the private space to manage. 3. On the **Network** tab, in the **Connections** section, click the transit gateway menu (**…​**) and select **Rename**: 4. Enter the new name and click **Save**. ## Detach a Transit Gateway from the Private Space You might want to detach a transit gateway attachment for the following reasons: - If you reject an attachment in AWS, the transit gateway attachment appears as `Rejected` in Anypoint Platform. In this case, you must remove the attachment before trying to attach it again. - If an attachment is deleted on AWS, you can remove the attachment from Anypoint Platform. Removing a transit gateway attachment also deletes any associate routes. The resource share on AWS remains unaffected so you can readd the transit gateway without creating a new one. However, detaching a transit gateway from a private space also deletes the attachment in AWS. The transit gateway appears under **Add a transit gateway** if you only detach it and do not delete it from your organization. Any apps deployed to the private space continue to run, but they are no longer connected to your Amazon VPCs and VPNs. To detach the transit gateway: 1. From Anypoint Platform, select **Runtime Manager** > **Private Spaces**. 2. Click the name of the private space to manage. 3. On the **Network** tab, in the **Connections** section, click the transit gateway menu (**…​**) and select **Detach**: 4. At the confirmation prompt, click **Detach**. Detaching a transit gateway might take several minutes. ## Delete a Transit Gateway To completely remove the transit gateway from your Anypoint Platform organization, use the [delete transit gateway API call](https://anypoint.mulesoft.com/exchange/portals/anypoint-platform/f1e97bc6-315a-4490-82a7-23abe036327a.anypoint-platform/cloudhub-20-api/minor/1.0/console/method/%234136/) (`DELETE <>/organizations/:orgId/transitgateways/:tgw-id`) and delete the resources share on AWS. For information, see [Deleting a resource share](https://docs.aws.amazon.com/ram/latest/userguide/working-with-sharing-delete.html) in the AWS documentation. ## See Also - [Gathering Required Setup Information](https://docs.mulesoft.com/cloudhub-2/ps-gather-setup-info)