--- schema_version: "1" id: a154e64a37aab8f6e426c6e16f48a67073118d43a63eb4bbef6e4631406f6095 title: Anypoint VPC Connectivity Methods collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/cloudhub/vpc-connectivity-methods-concept.md canonical_url: https://docs.mulesoft.com/cloudhub/vpc-connectivity-methods-concept source_site: docs.mulesoft.com content_type: documentation content_hash: 6737ffc5329802a6aaf194c96f730dc9a38760ff3a18a962a20cceb8a1c1abfb description: MuleSoft Documentation Site latest: true --- --- product: CloudHub --- # Anypoint VPC Connectivity Methods > For the full documentation index, see: https://docs.mulesoft.com/llms.txt You can connect an Anypoint Virtual Private Cloud (Anypoint VPC) to your private network using these methods: - IPsec tunnel - Transit gateway attachment - VPC peering To connect your Anypoint VPC using VPC peering, contact your MuleSoft Support representative. - AWS Direct Connect To connect your Anypoint VPC using AWS Direct Connect, contact your MuleSoft Support representative. > [!NOTE] A maximum of 95 route table entries is allowed per VPC, regardless of the number of > connections. To avoid exceeding the limit, consolidate networks to the fewest number possible. ## IPsec Tunnel You can use an IPsec tunnel with network-to-network configuration to connect your on-premises data centers to your Anypoint VPC. An IPsec VPN tunnel is generally the recommended solution for VPC to on-premises connectivity, as it provides a standardized, secure way to connect. This method also integrates well with existing IT infrastructure such as routers and appliances. ![IPsec Tunnel Overview](/mulesoft/current/en-us/cloudhub/_images/vpc-overview-ipsec.png) > [!NOTE] If you are using a legacy VPN, migrate to Anypoint VPN before making changes. To create an Anypoint VPN connection to your network, see [Anypoint VPN](https://docs.mulesoft.com/cloudhub/vpn-about). ## Transit Gateway Attachments AWS Transit Gateway acts as a cloud router in AWS, simplifying network access between VPCs, on-premises data centers, and third-party software, while providing increased visibility and control over the network. Transit gateways effectively merge your organization’s cloud resources and on-premises datacenters into one network topology. On CloudHub, you can take advantage of this network simplification by securely attaching Anypoint VPC to an AWS Transit Gateway in your AWS account. To use transit gateway attachments, your Anypoint VPC and AWS transit gateway must be in the same region. ![Transit Gateway Overview](/mulesoft/current/en-us/cloudhub/_images/vpc-overview-tgw.png) To attach your Anypoint VPC to your transit gateway, see [Transit Gateway Attachments](https://docs.mulesoft.com/cloudhub/tgw-about). ## VPC Peering VPC peering provides a connection between two VPCs. In this case, it pairs your private Amazon VPC directly to your Anypoint VPC. This enables you to route traffic between the two VPCs so they can communicate as though they are in the same network. ![VPC Peering Overview](/mulesoft/current/en-us/cloudhub/_images/vpc-overview-peering.png) > [!NOTE] To use VPC Peering, your AWS and Anypoint VPCs must be located in the same region. ## AWS Direct Connect To create a Direct Connect connection to Anypoint VPC, create or use an existing AWS Transit Gateway in your AWS account and set up the Direct Connect connection to the Transit Gateway. Then, attach Anypoint VPC to the Transit Gateway and configure the required routing to enable Anypoint VPC on-premises connectivity. On your AWS account, attach Direct Connect connections to a Direct Connect Gateway and associate that Direct Connect Gateway with your Transit Gateway. Anypoint VPC attaches to the Transit Gateway. ![AWS Direct Connect Overview](/mulesoft/current/en-us/cloudhub/_images/vpc-overview-dx.png) > [!NOTE] To use Direct Connect, your AWS Direct Connect Partner and the Anypoint VPCs must be > located in the same region. Direct Connect requires the Border Gateway Protocol (BGP) for dynamic > routing. Static routing isn’t supported. ## Direct Connect High Availability A single Direct Connect connection isn’t sufficient for high availability. A failure at the facility, hardware, or connection level can cause total connectivity loss. For workloads that require high availability, use multiple Direct Connect connections that enter the AWS Global Network at two AWS Direct Connect locations and converge at a Transit Gateway in your AWS account. Attach Anypoint VPC to that Transit Gateway. ![High Availability Direct Connect for Anypoint VPC](/mulesoft/current/en-us/cloudhub/_images/vpc-overview-dx-ha.png) This HA topology uses these components: - **On-premises infrastructure** Network traffic originates from your on-premises environment. Use a single data center with redundant edge routers, or distribute traffic across multiple physical data centers. - **Two AWS Direct Connect locations** To provide path redundancy, Direct Connect connections must enter the AWS Global Network at two AWS facilities. See [AWS Direct Connect Locations](https://aws.amazon.com/directconnect/locations/). - **AWS Transit Gateway** The Transit Gateway in your AWS account acts as a centralized cloud router. Attach both Direct Connect connections to a Direct Connect Gateway, and associate that Direct Connect Gateway with the Transit Gateway. - **Anypoint VPC** Attach Anypoint VPC to your Transit Gateway to route traffic privately to your on-premises resources. ### Prerequisites Before you configure Direct Connect high availability: - Provision the Transit Gateway and Anypoint VPC in the same AWS region. - Use BGP for dynamic routing. Static routing isn’t supported. - Plan Direct Connect connections at two AWS Direct Connect locations. - Stay within the 95 route table entries allowed per Anypoint VPC. Consolidate networks with summary routes so you don’t exceed the limit. ### Configure Direct Connect High Availability 1. In your AWS account, create a Transit Gateway in the same region as your Anypoint VPC. 2. Work with AWS or your AWS Direct Connect Partner to provision dedicated or hosted connections at two physical locations: 1. Establish connection A between your on-premises network and AWS Direct Connect Location 1. 2. Establish connection B between your on-premises network and AWS Direct Connect Location 2. 3. Create the virtual interfaces (VIFs) required to attach both Direct Connect connections to your Transit Gateway through a Direct Connect Gateway. 3. Enable BGP over both Direct Connect connections. To manage traffic as active/passive or active/active, configure your on-premises edge routers. For an active/standby setup, use AS path prepending on the secondary connection so it’s a less preferred route during normal operations. See [Routing policies for Direct Connect](https://docs.aws.amazon.com/directconnect/latest/UserGuide/routing-and-bgp.html#private-routing-policies) in the AWS documentation. 4. Verify that routes propagate from the Direct Connect Gateway into the Transit Gateway route table associated with Anypoint VPC. 5. Attach Anypoint VPC to the Transit Gateway. See [Attach to Transit Gateways](https://docs.mulesoft.com/cloudhub/tgw-attach-arm). 6. In your Transit Gateway route tables, route traffic destined for your on-premises network over the Direct Connect links, and route traffic destined for Anypoint VPC to the VPC attachment. ### Failover Behavior Because this architecture uses BGP for dynamic routing across redundant paths, failover is automatic: - If the primary network link, on-premises router, or AWS Direct Connect location fails, BGP withdraws the primary routes. - If the Transit Gateway moves active traffic to the secondary Direct Connect connection. - When the primary connection is restored, BGP re-advertises the preferred routes and traffic returns to its normal path. You don’t need to update routing manually in CloudHub or AWS. > [!IMPORTANT] Before deleting a VPC that uses Direct Connect, contact MuleSoft Support to remove > the Direct Connect connection. > > MuleSoft Support manually provisions and removes Direct Connect connections. If you delete a VPC > before removing Direct Connect, the deletion can fail and leave resources (VPCs, virtual gateway > attachments, and hosted connections) in AWS. ## See Also - [Request VPC Connectivity to Your Network](https://docs.mulesoft.com/cloudhub/to-request-vpc-connectivity) - [Attach to Transit Gateways](https://docs.mulesoft.com/cloudhub/tgw-attach-arm) - [Anypoint VPN](https://docs.mulesoft.com/cloudhub/vpn-about) - [Transit Gateway Attachments](https://docs.mulesoft.com/cloudhub/tgw-about)