# CloudHub Connectivity to Customer Networks

*MuleSoft Platform Architect Study Guide · Deploying API implementations to CloudHub · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/mulesoft-platform-architect/deploying-api-implementations-to-cloudhub/cloudhub-connectivity-to-customer-networks*

Compare classic CloudHub private connectivity methods and validate routing, endpoint capabilities, shared route budgets and VPN limitations.

- Certification: Salesforce MuleSoft Platform Architect
- Exam section: Deploying API implementations to CloudHub
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-platform-architect

**Official exam objective:**

> Compare and contrast the options for CloudHub networking in the presence of customer-owned Amazon VPCs and on-premises data centers.

## What the exam expects

- Compare private connectivity to a customer-owned Amazon VPC and an on-premises network.
- Match static or dynamic VPN routing to endpoint capabilities.
- Budget route entries and shared virtual-gateway capacity across connections.
- Reject unsupported combinations rather than assume more tunnels remove product constraints.

An **Anypoint VPC** is the CloudHub virtual network; **VPC peering** directly connects VPCs; **IPsec** secures a network tunnel; **BGP** advertises dynamic routes; a **VPN endpoint** terminates the customer side; the **VGW** is the MuleSoft-side virtual private gateway ([Connectivity](https://docs.mulesoft.com/cloudhub/vpc-connectivity-methods-concept), [Anypoint VPN](https://docs.mulesoft.com/cloudhub/vpn-about)). The scope is classic CloudHub networking, rather than CloudHub 2 private spaces.

## Key facts

| Fact | Detail | Source |
| --- | --- | --- |
| On-premises connection | IPsec supports a secure network-to-network tunnel. | [Connectivity](https://docs.mulesoft.com/cloudhub/vpc-connectivity-methods-concept) |
| VPC peering | Customer Amazon and Anypoint VPCs must be in the same region. | [Connectivity](https://docs.mulesoft.com/cloudhub/vpc-connectivity-methods-concept) |
| Dynamic VPN | Requires BGP peering and route-based tunnel interfaces. | [VPN](https://docs.mulesoft.com/cloudhub/vpn-about) |
| Direct Connect | Requires BGP; static routing is unsupported. | [Connectivity](https://docs.mulesoft.com/cloudhub/vpc-connectivity-methods-concept) |
| Default route | Unsupported with either BGP or static VPN routing. | [VPN](https://docs.mulesoft.com/cloudhub/vpn-about) |
| Route budget | 95 entries per VPC across connections. | [Connectivity](https://docs.mulesoft.com/cloudhub/vpc-connectivity-methods-concept) |
| Gateway capacity | Connections share a VGW maximum of 1.25 Gbps. | [VPN](https://docs.mulesoft.com/cloudhub/vpn-about) |
| Unsupported VPN design | NAT, IPv6 and VPN plus Direct Connect in one VPC. | [VPN](https://docs.mulesoft.com/cloudhub/vpn-about) |

## Check yourself

- Why does absence from the tested-device list not by itself rule out a VPN endpoint?
- When no device-specific file is available in Get VPN Config, which reference should be used?
- When packets are too large to transmit, at which stage must the endpoint be able to fragment them?

## Sources

- [Anypoint VPN](https://docs.mulesoft.com/cloudhub/vpn-about)
- [Anypoint VPC Connectivity Methods](https://docs.mulesoft.com/cloudhub/vpc-connectivity-methods-concept)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 6 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Platform Architect pack (USD $19): https://www.certifyforce.com/practice-exams