---
schema_version: "1"
id: 1e46286e21fb241d46eec6937a88b1de3bc26ed6c5270bfbd5fac9cfe16e163d
title: Anypoint VPN High Availability
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/cloudhub/vpn-high-availability.md
canonical_url: https://docs.mulesoft.com/cloudhub/vpn-high-availability
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 339d2d1f991f6432ca2530e24d9176c066cfb7b809796dea32071c9e801fbb6e
description: MuleSoft Documentation Site
latest: true
---
---
product: CloudHub
---

# Anypoint VPN High Availability

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Your VPN connection consists of two VPN tunnels that terminate in different Availability Zones to
provide increased availability to your VPC. During a mandatory upgrade, AWS might briefly disable
one of the two tunnels of your VPN connection.

When you configure your customer gateway, configure both tunnels for redundancy. When one tunnel
becomes unavailable (for example, it is down for maintenance), AWS automatically routes network
traffic to the other available tunnel for that specific VPN connection. When AWS performs updates on
one VPN tunnel, it sets a lower outbound multi-exit discriminator (MED) value on the other tunnel to
ensure failover.

The AWS Site-to-Site VPN [SLA](https://aws.amazon.com/vpn/site-to-site-vpn-sla/) requires two VPN
endpoints for each connection. Having redundant Anypoint VPN tunnels configured helps to prevent
MuleSoft service downtime during the AWS auto-patching window.

To ensure that your applications and related operations can handle Anypoint VPN updates, issues, and
individual customer gateway failures, implement High Availability with redundant Anypoint VPN
connections. Each Anypoint VPN connection consists of two endpoints, providing High Availability
(HA) on the MuleSoft side by default.

## Prerequisites

- Sufficient entitlement for each VPN connection

- Two VPN endpoints using different public IP addresses

- Two VPN connections in Runtime Manager

## Configure High Availability with Anypoint VPN

The following example shows a High Availability VPN topology that uses a single Anypoint VPC and two
VPN connections.

A MuleSoft Virtual Private Gateway (VGW) supports one Anypoint VPC association and up to 10 VPN
connections. You can locate your VPN Gateways in the same data center or in different physical
locations.

To eliminate all single points of failure, the two customer gateways should be in different data
centers, and preferably in different cities. Ideally, use your Disaster Recovery location for the
second gateway.

![VPN High Availability Topology](/mulesoft/current/en-us/cloudhub/_images/vpn-ha-topology.png)

Use BGP routing to advertise the same routes via VPN-1 and VPN-2. For instructions on how to control
path selection via the routing protocol, see
[Anypoint VPN Path Selection using BGP Routing](https://help.salesforce.com/s/articleView?id=001116889&type=1).

In this scenario, the VPN Gateways are configured to prefer VPN-1 Tunnel-1, then VPN-1 Tunnel-2,
then VPN-2 Tunnel-1, and finally VPN-2 Tunnel-2. This configuration produces an automatic failover
to another tunnel and another VPN in the event of a VPN connectivity issue. This makes the Anypoint
VPN solution more resilient and robust.

High Availability VPN connections also support static routing, in which you establish a VPN-2 to
work as a redundant, standby connection in the event of a failure with VPN-1.

## See Also

- [Create an Anypoint VPN Connection](https://docs.mulesoft.com/cloudhub/vpn-create-arm)

- [Anypoint VPN Downtime Risk](https://docs.mulesoft.com/cloudhub/vpn-downtime-risk)

- [Using Redundant Site-to-Site VPN Connections to Provide Failover](https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-redundant-connection.html)

- [Continue to Have Redundant Pair of VPNs as Well](https://docs.aws.amazon.com/vpn/latest/s2svpn/disaster-recovery-resiliency.html)

- [How to Calculate VPC and VPN License Requirements](https://help.salesforce.com/s/articleView?id=001114580&type=1)