--- schema_version: "1" id: 30ba255c6d2afc750363c5e6af11f3091a5bec6d8f385015191429e09c25157c title: Attach to Transit Gateways collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/cloudhub/tgw-attach-arm.md canonical_url: https://docs.mulesoft.com/cloudhub/tgw-attach-arm source_site: docs.mulesoft.com content_type: documentation content_hash: afbcfb2231ced13c16142cdfd5670e8a2d316e7eed3920400df69d3d23d430aa description: MuleSoft Documentation Site latest: true --- --- product: CloudHub --- # Attach to Transit Gateways > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Use Anypoint Runtime Manager to add a transit gateway and connect your Anypoint Virtual Private Cloud (VPC) to your private corporate network. ## Prerequisites Before you can add a transit gateway to CloudHub: - Create a transit gateway on your corporate AWS account. See [Getting started with transit gateways](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-getting-started.html) in the AWS documentation for information about creating a transit gateway on AWS. One transit gateway can support up to 10 VPC attachments. - The number of attachments you can make to AWS Transit Gateways depends on the network connections available to your Business Group. > [!NOTE] The **Transit Gateways** page is visible in Runtime Manager to Anypoint organizations > that have an Anypoint VPC and VPN license. > > Attaching one Anypoint VPC to an AWS Transit Gateway uses one Anypoint VPN license. You can > check or edit the licenses allocated to the Business Group by navigating to **Access > Management** > **Organizations** and choosing the relevant Business Group. Update or view the > **Network Connection** options as required, and save any changes. - Sign in to an Anypoint Platform account with either the CloudHub Network Administrator or the CloudHub Network Viewer user permission. See [Grant Permissions and Roles to Users](https://docs.mulesoft.com/access-management/users#grant-permissions-and-roles-to-users). - Create an Anypoint VPC in Anypoint Platform. See [Create and Update a VPC for Runtime Manager](https://docs.mulesoft.com/cloudhub/vpc-tutorial). - Identify the subnets in your network (in CIDR notation) that you want to make accessible through the transit gateway. ## Transit Gateway Attachment Workflow The steps for attaching to a transit gateway are: 1. [Add the transit gateway](#add_tgw) to Anypoint Platform by [creating a resource share in AWS](#create_resource_share) to share your transit gateway with Anypoint Platform. 2. [Attach your VPCs](#attach_vpc_tgw) to the transit gateway and [accept the VPC attachments](#accept_attachment) in AWS. 3. [Configure transit gateway routing](#configure_tgw_routing): 1. [Enable outbound traffic from Anypoint VPC](#enable_outbound_traffic_from_vpc). 2. [Enable inbound traffic through the transit gateway on AWS](#enable_inbound_traffic_on_aws). ## Add a Transit Gateway To add a transit gateway: 1. Sign in to Anypoint Platform and select **Runtime Manager**. 2. From the Runtime Manager navigation menu, click **Transit Gateways**, and then click **Add Transit Gateway**. The **Here’s what’s coming** page lists the steps to add the transit gateway: ![Here’s what’s coming page](/mulesoft/current/en-us/cloudhub/_images/tgw-process-overview.png) 3. Click **I’m ready**. 4. Specify a name for your transit gateway: ![Add transit gateway page](/mulesoft/current/en-us/cloudhub/_images/tgw-add.png) Use the same name for your transit gateway in AWS. You can change this name later. The name can contain up to 255 alphanumeric characters (a-z, A-Z, 0-9) and hyphens (-). 5. Select the region that corresponds to the location of your AWS Transit Gateway. See [Regional Services](https://docs.mulesoft.com/cloudhub/cloudhub-networking-guide#regional-services). Your Anypoint VPC and AWS Transit Gateway must be in the same region. 6. Click **Next**. The **Add transit gateway** page lists the steps to create a resource share in AWS: ![Add transit gateway page: Steps to create a resource share](/mulesoft/current/en-us/cloudhub/_images/tgw-add-overview.png) > [!NOTE] The MuleSoft AWS Account ID relevant for your Anypoint VPC is displayed at this step. > As this ID varies, always use the Account ID displayed in this step for your AWS > configuration. If the AWS configuration is performed by other teams or resources within your > organization, please share this MuleSoft AWS account ID with them. ## Create a Resource Share 1. Sign in to your AWS corporate account. 2. In Anypoint Platform, click the **Create resource share** link on the **Add transit gateway** page. The link opens the AWS RAM console to the page for creating a resource share in the region you specified. 3. Take the following actions on the AWS **Create resource share** page: 1. Under **Description**, enter a descriptive name for the resource share in the **Name** field. 2. Under **Resources - _optional_**, select **Transit Gateways** from the **Select resource type** menu and select the transit gateway resource to share. The transit gateway ID appears in the **Selected resources** field. 3. Under **Principals - _optional_**, ensure that **Allow external accounts** is selected, enter the MuleSoft AWS account ID that appears on the **Add transit gateway** page, and click **Add**. The AWS account number appears in the **Selected principals** field. 4. Under **Tags**, add a tag if you want. 5. Click **Create resource share**. 6. Copy the **ID** and **Owner** values for the resource share you just created. 4. Take the following actions in the Anypoint Platform **Add transit gateway** window: 1. Click **Next**. 2. Paste the values you copied from AWS in the **ID** and **Owner** fields: ![Add transit gateway page: Resource share ID and owner ID](/mulesoft/current/en-us/cloudhub/_images/tgw-add-resource-share.png) - The resource share **ID** field contains alphanumeric characters (a-z, A-Z, 0-9) and hyphens (-). - The resource share **Owner** field contains only numbers. 3. Click **Add**. The **Transit Gateways** page shows the progress for connecting to AWS and adding the transit gateway to Anypoint Platform. When the transit gateway addition succeeds, the **Transit Gateways** page displays the **Transit gateway added** message. The **Transit Gateways** page updates the owner and ID from AWS and the state as **Available**: ![Transit gateway added](/mulesoft/current/en-us/cloudhub/_images/tgw-resource-share-available.png) If the transit gateway addition fails, see [Troubleshoot Transit Gateway Attachments](https://docs.mulesoft.com/cloudhub/tgw-troubleshoot). ## Attach Anypoint VPC to the Transit Gateway After the transit gateway attachment succeeds, attach your Anypoint VPC to enable apps to access the transit gateway. For information about limitations when attaching an Anypoint VPC to a transit gateway, see [Transit gateway attachments to a VPC](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-vpc-attachments.html) in the AWS documentation. To attach Anypoint VPC to the transit gateway: 1. In Anypoint Platform, on the **Transit Gateways** page, click **Attach VPC**. The **Attach VPC** button is disabled if no VPCs are available to attach or if the transit gateway addition failed. 2. From the **Select VPC** window, select the VPC to attach: ![Select VPC window](/mulesoft/current/en-us/cloudhub/_images/tgw-select-vpc.png) The window displays only the VPCs that are: - In the same region as the transit gateway - Not already attached to the transit gateway - In business groups for which you have CloudHub Network Administrator permissions 3. Click **Next**. ## Accept the VPC Attachment 1. Sign in to your AWS corporate account. 2. In Anypoint Platform, on the **Accept VPC Attachment** page, click the **Transit Gateway Attachments** link: ![Accept VPC Attachment page](/mulesoft/current/en-us/cloudhub/_images/tgw-accept-vpc-attachment.png) The link opens the AWS RAM console to the **Create Transit Gateway Attachment** page. 3. In the AWS console: 1. Select the attachment that shows **pending acceptance** in the **State** column. The attachment might take a few minutes to appear. 2. Select the transit gateway attachment ID and, on the **Details** tab, ensure that **Resource owner account ID** is the MuleSoft AWS account ID. 3. Click the pencil icon for the attachment and enter a name. 4. Select **Actions** > **Accept** and click **Accept** to confirm. When the attachment acceptance succeeds, the **State** column shows **available**. 4. In Anypoint Platform, in the **Accept VPC Attachment** window, click **Done**. The **Transit Gateways** page shows the progress for accepting the VPC attachment from Anypoint Platform to AWS: ![Checking VPC attachment status](/mulesoft/current/en-us/cloudhub/_images/tgw-checking-attachment-status.png) 5. Click **Refresh** to update the attachment status. When the VPC attachment succeeds, the **Transit Gateways** page displays the **VPC attached** message and the attachment state indicates that it’s attached to AWS Transit Gateway: ![VPC attached successfully](/mulesoft/current/en-us/cloudhub/_images/tgw-attached.png) If the VPC attachment state is `Rejected`, see [Troubleshoot Transit Gateway Attachments](https://docs.mulesoft.com/cloudhub/tgw-troubleshoot). ## Configure Transit Gateway Routing Anypoint VPC supports static routing for transit gateways. Configure the network routes (subnets) that you want to be accessible through the transit gateway: - On Anypoint Platform, [enable outbound traffic from Anypoint VPC](#enable_outbound_traffic_from_vpc) to an external destination. - On AWS, [enable inbound traffic](#enable_inbound_traffic_on_aws) through your transit gateway. ### Prerequisites Before configuring routing, consolidate networks to the fewest number possible. A maximum of 95 route table entries is permitted per VPC, regardless of the number of transit gateway attachments. ### Enable Outbound Traffic from Anypoint VPC After attaching the VPC, enable outbound traffic from Anypoint VPC to an external destination so that apps can access the transit gateway and the transit gateway routes traffic correctly. To do this, add routes to the transit gateway route table: 1. In Anypoint Platform, navigate to **Transit Gateways** > **VPCs** and click **Add Route**. 2. On the **Add VPC Route** window, use CIDR notation to enter a single subnet for your AWS VPC: ![Add VPC route](/mulesoft/current/en-us/cloudhub/_images/tgw-add-vpc-route.png) 3. Click **Add Route**. Anypoint Platform submits the new route to AWS. When the route addition succeeds, the **Transit Gateways** page shows the **Route added** message and the **Transit Gateways** page shows the route CIDR in the route tables. In the route tables, added routes show **Transit Gateway** as the value in the **Next Hop** column. Specific routes attached to the transit gateway show under **Transit Gateway Routes**. Other routes in the VPC show under **VPC Routes**. ![Transit Gateway in the Next Hop column of the route table](/mulesoft/current/en-us/cloudhub/_images/tgw-route-added.png) ### Enable Inbound Traffic Through the Transit Gateway After successfully adding routes to the transit gateway route table in Anypoint Platform, enable inbound traffic through your transit gateway on AWS. You might need to coordinate with your network administrator to enable inbound traffic. ## See Also - [Troubleshoot Transit Gateway Attachments](https://docs.mulesoft.com/cloudhub/tgw-troubleshoot) - [Manage Transit Gateway Attachments](https://docs.mulesoft.com/cloudhub/tgw-manage-arm) - [Transit Gateway Attachments](https://docs.mulesoft.com/cloudhub/tgw-about) - [Transit gateway attachments to a VPC](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-vpc-attachments.html) in the AWS documentation - [Transit gateway route tables](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-route-tables.html) in the AWS documentation - [Virtual Private Cloud](https://docs.mulesoft.com/cloudhub/virtual-private-cloud) - [Create and Update a VPC for Runtime Manager](https://docs.mulesoft.com/cloudhub/vpc-tutorial) - [Grant Permissions and Roles to Users](https://docs.mulesoft.com/access-management/users#grant-permissions-and-roles-to-users)