---
schema_version: "1"
id: 8ae063e5a720aaa6cdf6e69cd24c91f67042f19be2226b73f6ac29ef2916f4b4
title: Modify an Anypoint VPN Connection
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/cloudhub/vpn-update-arm.md
canonical_url: https://docs.mulesoft.com/cloudhub/vpn-update-arm
source_site: docs.mulesoft.com
content_type: documentation
content_hash: be92c91ac8e0cf2ced2797473eb615ade712d03787037a80bd7280060486b46b
description: MuleSoft Documentation Site
latest: true
---
---
product: CloudHub
---

# Modify an Anypoint VPN Connection

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

You can update some Anypoint VPN connection settings using Runtime Manager.

## IP Addresses

After you create the Anypoint VPN connection, you cannot modify the **Remote IP Address** or
**Tunnel Configuration** settings. To change these settings, you must recreate the Anypoint VPN and
update your VPN endpoint with the new values.

Local external IP addresses are dynamically assigned during VPN creation. You cannot reserve or
reuse external IP addresses. When you recreate the VPN, new local external IP addresses are
assigned.

Point-to-point IP addresses and Pre-Shared Keys (PSK) are defined during VPN creation. You can use
**Automatic Tunnel Configuration** to generate values for these settings or use the **Custom Tunnel
Configuration** to define your values for these settings.

See [Create an Anypoint VPN](https://docs.mulesoft.com/cloudhub/vpn-create-arm#create-an-anypoint-vpn) for more information.

## Routing

After you create the Anypoint VPN connection, you cannot modify the routing type or Autonomous
System Numbers (ASNs). To change these settings, you must recreate the Anypoint VPN and update your
VPN endpoint with the new values.

## Networks

The local network is inherited from Anypoint VPC. MuleSoft does not allow you to subnet the Anypoint
VPC CIDR block.

You can modify the remote networks for an Anypoint VPN after creation. The steps differ depending on
the configured routing type (static or dynamic).

> [!NOTE] A maximum of 95 route table entries is allowed per Anypoint VPC, regardless of the number
> of VPN connections. To avoid exceeding this limit, consolidate networks to the fewest number
> possible.

### Static Routes

To modify the remote networks for an Anypoint VPN that uses static routing:

1.  Sign into Anypoint Platform and select **Runtime Manager**.

2.  From the menu on the left, click **VPNs**, and then click the name of the VPN to update.

3.  Under **Static Routes**, click **Add New Rule**.

4.  In the **CIDR** field, enter a subnet to make accessible through the VPN, for example,
    `10.0.0.0/8`.

5.  If you want to add additional subnets, click **Add New Rule** and repeat step 4.

6.  Click **Apply Changes** to add the new rules.

7.  Review the firewall rules for the corresponding Anypoint VPC.

    See [Add or Edit Firewall Rules](https://docs.mulesoft.com/cloudhub/vpc-firewall-rules-concept#add-or-edit-firewall-rules).

    By default, all traffic to your Anypoint VPC is blocked unless a firewall rule explicitly allows
    it.

8.  Update the configuration on your VPN endpoint.

    See the documentation for your device.

    When the tunnel is active, the route table updates automatically.

### Dynamic Routes

To modify the remote networks for an Anypoint VPN that uses dynamic routing:

1.  Review the firewall rules for the corresponding Anypoint VPC.

    See [Add or Edit Firewall Rules](https://docs.mulesoft.com/cloudhub/vpc-firewall-rules-concept#add-or-edit-firewall-rules).

    By default, all traffic to your Anypoint VPC is blocked unless a firewall rule explicitly allows
    it.

2.  Update the Border Gateway Protocol (BGP) configuration on your VPN endpoint.

    See the documentation for your device.

    When BGP propagates the changes, the route table updates automatically.

## IPsec

You can set the **Initiator Mode** for Anypoint VPN. When enabled, your Anypoint VPN initiates IKE
negotiation to enable tunnels. If you use this feature:

- Configure your gateway to accept an IKEv2 connection, as IKEv1 is not supported.

- Used route-based VPN, as policy-based VPN is not supported.

All IPsec settings are defined on your endpoint.

You can modify the VPN configuration of your endpoint to take advantage of any supported IPsec
settings. See [IPsec Settings](https://docs.mulesoft.com/cloudhub/vpn-about#ipsec-settings).

You don’t need to change any VPN settings in Runtime Manager.

### See Also

- [Anypoint VPN](https://docs.mulesoft.com/cloudhub/vpn-about)

- [Anypoint Virtual Private Cloud](https://docs.mulesoft.com/cloudhub/virtual-private-cloud)

- [Anypoint VPN Knowledge Articles](https://help.salesforce.com/s/articleView?id=001117281&type=1)