This document provides instructions for creating a load balancer and virtual private cloud (VPC) on MuleSoft's Anypoint Platform. It describes how to create a VPC with a specified name, region, and CIDR block. It then explains how to create a load balancer within that VPC, associating it with an SSL certificate and setting firewall rules. It also discusses how to add mapping rules and update an existing load balancer's configuration via the API.

1. Load Balancer in Mule
and VPC creation
This feature will eventually be built into the
Runtime Manager UI, however currently it’s
only available as a service that can be used via
the Anypoint Command Line Interface.

2. • Create a VPC
• To create a VPC, log in to your Anypoint
Platform and follow these steps:
• Select the VPCs tab from the navigation bar to
your left.
• Click the Create VPC option:

5. All VPCs need to be associated to a
CloudHub region.
• A VPC name.
For this tutorial, name your VPC vpc-tutorial.
• The region to which the VPC is bound.
In this case, the VPC is bound to US East
(Virginia).

6. • The size of your VPC in Classless Inter-Domain
Routing (CIDR) notation.
Set it to 10.111.0.0/24 which grants us 256 IP
addresses from 10.111.0.0 to 10.111.0.255.
The CIDR Blocks chosen for the VPC should
ideally come from a private IP space, and
should not overlap with any other VPC’s CIDR
Blocks or any CIDR Blocks in use in your
corporate network.

7. • Once the VPC is created, it is not possible to
resize it, nor to edit your selected CIDR block.
Understanding how to size your VPC is crucial
at this point. If you are not sure how to
configure this, make sure to follow our VPC
sizing guide.

8. • Each load balancer can be associated with one
or more SSL endpoints. Such endpoints are
identified by their certificate names.
• Certificates are an important component of
your dedicated load balancer. When creating a
load balancer, at least one SSL endpoint needs
to be configured, meaning that each load
balancer needs to have at least one certificate
associated to it.

9. • All inbound traffic is blocked by default. Firewall rules are required
to allow traffic to your worker.
The UI suggests you a list of most used firewall rules. For this
example, add a firewall rule with type 'http.private.port'
from Anywhere.
Note that the port range is automatically set to 8091.
• This means that only connections through the port 8091 are
whitelisted inside the VPC and that your worker will listen to all
interfaces coming through port 8091.
Setting this firewall rule allows a dedicated load balancer to
communicate to your workers using its default configurations.
• Additionally, to properly receive requests from the load balancer, all
applications that are deployed to the VPC must be listening on port
8091.

11. Create a Load Balancer
• A load balancer can be created using the load-
balancer create command.
• cloudhub load-balancer create vpc-tutorial
lb-tutorial
/Users/myuser/Documents/cert.pem
/Users/myuser/Documents/key.pem --http on
--verificationMode on

12. • Pass vpc-tutorial as the vpc name in which you
want to create the load balancer.
• In order to keep consistency among tutorials, we
are using components created in the VPC tutorial.
• Name the load balancer lb-tutorial.
• The load balancer’s name must be unique.
• Each load balancer has an internal domain name:
internal-<lb-name>.lb.anypointdns.net where
<lb-name> is the name you set here.

13. • Pass the path to a .pem file certificate and its key
We are using the self-signed certificate created earlier, along with
its private key: cert.pemand key.pem.
The certificate that you upload to the Load Balancer must be
contained in one pem encoded and unencrypted file.
Your private key file needs to be passphraseless.
• Set the option for the http method to on.
This sets the load balancer to accept all http requests and forwards
it to your default SSL endpoint. In this case, the only ssl endpoint
configured is lb-tutorial-cert
• Set the option for the verificationMode to on
This instructs the SSL endpoint to always verify the certificate
• When the operation succeeds, the CLI displays the details of the
newly created load balancer.

14. • > cloudhub load-balancer mappings add lb-
tutorial 0 /{app}/ {app} /
• Set lb-tutorial as the target for this new mapping rule
• Set the index priority for this mapping rule to 0
This rule now has the first priority.
• Set the input URL as /{app}/
This rule uses patterns so that every value passed as {app} in the
load balancer’s domain name: lb-
tutorial.lb.anypointdns.net/{app} gets mapped to the URL set as the
output URL.
• Set the output URL to {app}
So that the domain lb-tutorial.lb.anypointdns.net/{app} gets
mapped to {app}.cloudub.io/ using the pattern {app} to match your
application’s name.
• Set the appURI to / to redirect to the initial path of your application.

15. Update an Existing Load Balancer
• It is possible to edit the Whitelists, Mapping
Rules and SSL Endpoints from the Anypoint
Platform CLI.
• Remove the existing configuration using load-
balancer whitelist remove, load-balancer
mappings remove and load-balancer ssl-
endpoint remove respectively and add the
new configurations.

16. Update an Existing Load Balancer Using the CloudHub API
• Although it is not possible to update certain load
balancer values through the Anypoint Platform CLI, you
can use the Cloudhub API to programmatically manage
and update your load balancer:
• Log in to the CloudHub services passing your
credentials to
https://anypoint.mulesoft.com/accounts/login.
• Use the
organizations/{orgId}/vpcs/{vpcId}/loadbalancers/{lbId}
endpoint to update your load balancer.