--- schema_version: "1" id: c5106e4f34aabee9a4ab15c0e913cf2babed33395a4253fbd9e2e7237904f141 title: Anypoint VPN Maintenance collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/cloudhub/vpn-maintenance.md canonical_url: https://docs.mulesoft.com/cloudhub/vpn-maintenance source_site: docs.mulesoft.com content_type: documentation content_hash: b1184cfd5afb474074e2fbe36f3405a290079573d48ecab8894f3ae728505991 description: MuleSoft Documentation Site latest: true --- --- product: CloudHub --- # Anypoint VPN Maintenance > For the full documentation index, see: https://docs.mulesoft.com/llms.txt ## Anypoint VPN Update MuleSoft Anypoint VPN is a managed service that is underpinned by AWS Site-to-Site VPN connections. Using a VPN is important for any integrations or flows that require connectivity to your on-premises or external platforms. Updating an Anypoint VPN that is not set up with at least a pair of tunnels that use BGP routing will cause downtime. See [Anypoint VPN High Availability](https://docs.mulesoft.com/cloudhub/vpn-high-availability) for more information. After the October 2022 quarterly maintenance window, Anypoint VPN will no longer support quarterly customer self-upgrades. From this point forward, updates made to Anypoint VPN will adhere to AWS’s standard continuous upgrade process. Upgrades will be applied on-demand, with no published maintenance window schedule, no customer opt-in self-upgrade capabilities, with **potential (limited) downtime for customers that do not have a** [High Availability (HA) VPN implementation](https://docs.mulesoft.com/cloudhub/vpn-high-availability). Deploy a [high-availability VPN](https://docs.mulesoft.com/cloudhub/vpn-high-availability) solution to avoid any downtime associated with these AWS-delivered security updates. Review the following sections for recommendations and troubleshooting information. ## Avoiding or Reducing Downtime During an On-demand Maintenance Mule applications that use Anypoint VPN connectivity are impacted during an on-demand maintenance. The impact on the Anypoint VPN varies depending on the VPN configuration: - An Anypoint VPN with at least one pair of tunnels configured with BGP routing and DPD (Dead Peer Detection) to reset the tunnels when triggered incurs minimal downtime. The switchover takes a few seconds. - An Anypoint VPN tunnel pair configured with static routing incurs some downtime before reconnection. The reconnection takes longer if you do not have an automated failover mechanism to detect failed tunnels. - For an Anypoint VPN configured without BGP routing or a failover mechanism or with only one tunnel configured, the outage is up to 60 minutes long while the update occurs and the original tunnel comes back up. ## Troubleshoot Issues During an Anypoint VPN On-demand Maintenance These are some of the possible issues you may encounter during an on-demand maintenance: ### Tunnels Don’t Come Up If the tunnels are not back up within 10-15 minutes at any point in time, try restarting your end of the tunnels to bring them back up. If your VPN is configured with static routing, try generating "interesting traffic" (traffic that should be encrypted over the Anypoint VPN connection) towards the Anypoint VPN to bring up the VPN. See [How to Generate Interesting Traffic for Anypoint VPN](https://help.salesforce.com/s/articleView?id=001117182&type=1) for more information. ### Tunnel Goes Down Due to Inactivity If there is no traffic over the VPN tunnel, the VPN goes down due to inactivity. In this case, generate interesting traffic. We recommend that you move towards BGP. ### IKE Phase Lifetimes Mismatch #### If You Use IKEv2: To maintain a reliable tunnel operation after an on-demand maintenance, ensure that the IKEv2 Phase 1 and Phase 2 lifetimes are set as described in [IPsec Settings](https://docs.mulesoft.com/cloudhub/vpn-about#ipsec-settings): - IKE Phase 1 lifetime: 28000 seconds - IKE Phase 2 lifetime: 3000 second > [!NOTE] AWS documentation states 28800 seconds for the IKE Phase 1 lifetime, and 3600 seconds for > the IKE Phase 2 lifetime. MuleSoft recommends the 28000/3000 combination for your firewall device > to timeout first and control the rekey process. #### If You Use IKEv1: If you use IKEv1, use the default configuration: 28800 seconds for the Phase 1 lifetime, and 3600 seconds for the Phase 2 lifetime. ### Anypoint VPN Goes Down Periodically Due to PFS not Enabled for IPsec Phase 2 If you use Azure VPN, ensure that PFS is enabled and adjust the lifetimes for Phase 2. For more information, see [Anypoint VPN to Azure keeps going down every hour](https://help.salesforce.com/s/articleView?id=001116834&type=1). ### Anypoint VPN with BGP Routing Enters into Asymmetric Mode after an Update Anypoint VPN enters into asymmetric mode after an on-demand maintenance if the AS paths for the two tunnels of the same VPN are different. ### Seeing IPsec DPD Failures in VPN Logs Ensure that your DPD settings are correctly configured. ### Other issues For other issues with Anypoint VPN, see [Troubleshoot Anypoint VPN](https://docs.mulesoft.com/cloudhub/vpn-troubleshooting).