Terza puntata del MuleSoft Meetup di Milano - 20 Maggio 2021

1. All contents © MuleSoft, LLC
All You Need to Know Before
Creating Your VPC
MuleSoft Meetup - Milano
Gonzalo Marcos – Senior Technical Architect
May 2021

2. All contents © MuleSoft, LLC
Agenda
1. Introductions
2. What is a Mule VPC?
3. Do I need a VPC?
4. How Many VPCs do I need?
5. How to choose your CIDR block
6. Summary
2

3. All contents © MuleSoft, LLC
Creating a VPC is simple…
3
REGION
CIDR BLOCK
ENVIRONMENTS
BUSINESS GROUPS

4. All contents © MuleSoft, LLC
What is a Mule VPC?

5. All contents © MuleSoft, LLC
Mulesoft Shared Worker Cloud
5

6. All contents © MuleSoft, LLC
What is a VPC?
6
A Virtual Private Cloud (VPC) dedicated space in CloudHub specifically for an organization to
deploy their applications
Allows you to have a dedicated range of IP addresses specifically to your Mulesoft Organization
within an AWS Region

7. All contents © MuleSoft, LLC
Anatomy of a VPC
7

8. All contents © MuleSoft, LLC
What is a VPC?
8

9. All contents © MuleSoft, LLC
Do I need a VPC?

10. All contents © MuleSoft, LLC
When do we need a VPC?
11
• Connectivity to your Data Center
• Isolation
• Custom Domain for your Apps
• Custom Certificates
• Mutual TLS

11. All contents © MuleSoft, LLC
Connectivity to your Data Center
12
You can connect your AnyPoint VPC to
your private network using the following
methods:
• VPN - IPsec Tunnel
• VPC Peering
• CloudHub Direct Connect

12. All contents © MuleSoft, LLC
Isolation
16
Traffic Segregation
Security

13. All contents © MuleSoft, LLC
Isolation – Firewall Rules
18

14. All contents © MuleSoft, LLC
Isolation – Traffic Segmentation
19
- It’s a good practice to isolate all the traffic between
production and non production environments
- Differentiating traffic between business units in the same
organization.

15. All contents © MuleSoft, LLC
Need for a Dedicated Load Balancer
20
• Use of Custom Domain names
(Vanity Domains)
• Use of Custom Certificates
• Mutual TLS
• Traffic Segregation 🡪 Limit internal
and External traffic

16. All contents © MuleSoft, LLC
How many VPCs do I need?

17. All contents © MuleSoft, LLC
Where is your backend?
22
• Your VPC should be as close as possible to your backend systems
• A Mule VPC is created in an AWS region → is your backend located
in only one region or is it geographically distributed?
• Two options for distributed backend systems:
– One VPC + connections (VPN/VPC Peering/AWS DX) to your multiple data
centers
– One VPC per region + connections
• Pay attention to your Control Plane location!! (EU/US)

18. All contents © MuleSoft, LLC
Isolation – Business Groups
23
• Business Groups are a great
solution to separate and
control access to AnyPoint
resources.
• A VPC is a resource that
can be created at the
master org and also at a
Business Group level
• A VPC is only shared
vertically down, not up or
across.

19. All contents © MuleSoft, LLC
Isolation – Business Groups
24
• If you don't have any requirement of isolation between the BGs of
your org the recommendation is to create your VPC at the master
Org

20. All contents © MuleSoft, LLC
Isolation - Environments
25
• Environments get associated to a VPC.
• We can have multiple environments in the same VPC but each
environment can be associated to only one VPC.
• One environment cannot be part of two VPCs.
• Every app gets deployed to an environment and that environment
is associated to a VPC.

21. All contents © MuleSoft, LLC
Isolation - Environments
26
• This provides us with a
mechanism of isolation for
our apps.
• The recommendation is to
have a minimum of two
VPCs. One for production
environments and one for
non production
environments (Dev, QA,
Staging, Test).
• In some other cases a VPC
per environment is required.

22. All contents © MuleSoft, LLC
How to Choose Your CIDR
Block

23. All contents © MuleSoft, LLC
The basics – What’s an IP address?
• It’s a numerical representation of a location within a network
• That number is a binary number and it’s 32 bits long
• For better readability we divide those 32 bits in 4 blocks and use a decimal value for each
block
• Each decimal number ranges from 0-255
Smallest IP Address: 0.0.0.0
Binary: 0000 0000 - 0000 0000 - 0000 0000 - 0000 0000
Largest IP Address: 255.255.255.255
Binary: 1111 1111 - 1111 1111 - 1111 1111 - 1111 1111

24. All contents © MuleSoft, LLC
What is CIDR?
30
• Classless Inter-Domain Routing notation
• The notation identifies the network and the host in that network
• IP addresses are described as consisting of two groups of bits in the address: the most
significant bits are the network prefix, which identifies a whole network or subnet, and
the least significant set forms the host identifier, which specifies a particular interface of a
host on that network.
192.168.0.0/24 example
192.168.0.0 = 1100 0000 - 1010 1000 - 0000 0000 - 0000 0000
…
192.168.0.255 = 1100 0000 - 1010 1000 - 0000 0000 - 1111 1111

25. All contents © MuleSoft, LLC
Choosing your CIDR block
33
CIDR Block Size
Number of Bits We
Care About
Number of Bits We
DON’T Care About
Exponential Notation Number of Addresses
/24 24 8 28 256
/23 23 9 29 512
/22 22 10 210 1,024
/21 21 11 211 2,048
/20 20 12 212 4,096
/19 19 13 213 8,192
/18 18 14 214 16,384
/17 17 15 215 32,768
/16 16 16 216 65,536
Note: MuleSoft only allows between /16 and /24 CIDR block sizes

26. All contents © MuleSoft, LLC
Why does the CIDR block size matter?
34
• The size is very important because having a short block might cause your deployment to run
out of IPs in a short-medium term and then not able to deploy apps in the VPC.
• The moment we connect this VPC to our Data Center, using a VPN or a VPC peering, that
CIDR block will become part of our internal network and it will consume private IP addresses
from your internal addressing space → it's important not to oversize your VPC, as it will take
out more IPs than necessary from your internal network.

27. All contents © MuleSoft, LLC
How do we estimate the number of IPs we need?
35
Remember: The number of IP addresses in your CIDR block isn’t the same as the number of
applications you can deploy
You need to consider:
• Number of Workers
• Horizontal Scaling and High Availability
• Fault Tolerance (Region of the VPC)
• Zero Down-Time
• Number of Environments

28. All contents © MuleSoft, LLC
CIDR Block - Examples
36
EXAMPLE 1: 172.16.1.0/24 → 256 IP addresses
• IPs 172.16.1.0 and 172.16.1.255 are reserved --> 254 IPs
• FT required → Region of deployment: Frankfurt, 3 AZs --> 254/3 = 84
• 1 Environments: Production → 84
• Zero Downtime 84/2 = 42
• Total: 42 apps

29. All contents © MuleSoft, LLC
CIDR Block - Examples
37
EXAMPLE 2: What size do we need for the non production (Dev, QA and Test) VPC for the
previous example?
- 42 apps to deploy
- HA required (x2)
- 3 environments
- Zero Downtime (x2)
- Total: 42 x 2 x 3 x2 = 504 IPs needed 🡪 /23

30. All contents © MuleSoft, LLC
Summary

31. All contents © MuleSoft, LLC
Summary
40
REGION
CIDR BLOCK
ENVIRONMENTS
BUSINESS GROUPS

32. All contents © MuleSoft, LLC
Questions?

33. All contents © MuleSoft, LLC
Thank you!