When data security is critical, setting up a secure channel to access the data in your company’s data centre is best practice.
For Anypoint Platform users, setting up a CloudHub VPC and VPN gateway is a straightforward process using the self-service features provided on Anypoint Platform Runtime Manager.
This blog discusses the key points to consider in order to achieve secure connectivity between CloudHub VPC and your data centre.
What is VPC?
A Virtual Private Cloud (VPC), is a set of computing resources (storage, network, compute) that are isolated and made available only to the CloudHub users.
MuleSoft’s CloudHub is a multi-tenant integration platform in the Cloud. CloudHub Virtual Private Cloud (VPC) allows you to create a virtual, private, and isolated network segment on AWS cloud to host your CloudHub workers.
CloudHub VPC is part of CloudHub managed services which allows us to deploy, run and manage our applications in a dedicated and secure environment.
Why VPN?
A Virtual Private Network (VPN) is a network tunnel between Cloudhub VPC and the company’s corporate network.
What are the VPC Connectivity options?
The various VPC Connectivity methods are:
What is IPSec ?
Internet Protocol Security (IPSec) is a protocol suite for securing communications between two networks. Typically used to connect Cloudhub to customers on premise network.
IPSec – VPN Connectivity
The diagram below shows the network setup to implement a VPN connection from your Data Centre to the Anypoint VPC in the CloudHub.
On the MuleSoft side, high availability is built into the Anypoint VPN as shown in the above diagram with Router 1 and Router 2 each with its own public facing IPs and with respective tunnel 1 and tunnel 2. If you also intends to build high availability into their VPN setup they would need to implement the VPN across at least two different customer gateways.
The VPN set up process changed in MULE 4.0 version over time with various updates rolled out on the Anypoint Platform. A self-service feature was released to enable the users to create the VPN configuration and eliminate the dependency on the MuleSoft support team, which used to be the case earlier.
Set-Up Process:
The general process is available in the documentation at Create an Anypoint VPN.
Configuration Settings – To Consider :
Even though the self-service feature is made available, it does not support all the types of VPN devices.
For example the image below shows the list of VPN device vendors. The VPN config details can be downloaded for these vendors. We need to go with ‘generic’ option in case the VPN device vendor is not listed.
Before configuring the VPN device on the customer side with the generic configuration details it is always better to take a confirmation from the MuleSoft support team and validate if the VPN device vendor and the version is supported by the platform.
If you are trying to connect to internal systems using internal DNS names which are registered in your DNS server and not available publicly, the DNS server and the domain names have to be registered on the VPC as shown below.
Connectivity Test:
Once all the above taken care of, provide the reference to the networking team to generate some interesting traffic to test from their end. (How to Generate Interesting Traffic for Anypoint VPN)
Use the nettools application to test the connectivity. (How To Use Network Tools Application)
To test the connectivity from the customer data centre to CloudHub, spin up a sample API and deploy it on CloudHub ensuring it is in the same VPC. Trigger some requests from any machine or VM to check that the connectivity works as expected. You should be able to connect to the APIs using the internal worker DNS names of the API deployed in CloudHub. (CloudHub Internal DNS Records)
If you would like to find out more about connecting CloudHub with your data centre, we can help. Give us a call on +44 (0)203 475 7980 or email us at Salesforce@coforge.com
Other useful links:
How to apply pagination in Mule Scheduled Jobs
API Recipes with MuleSoft Anypoint Platform