{"text_format":"1","workbook":"xlsx","n_sheets":7,"sheets":["Overview","FAQ","IPSec","VPC Peering","OpenVPN Network to Network","OpenVPN Host to Network","Data"],"not_rendered":{"charts":0,"images":1,"macros":1,"external_links":0,"defined_names":11,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Overview","index":0,"n_rows":11,"n_cols":2,"rows_kept":11,"cut":false,"hidden":false,"merged":[[2,0,2,1],[0,0,0,1],[6,0,6,1],[4,0,4,1]]}
["VPC Configuration Questionnaire"]
[]
["Please review the four different types of VPC configurations below, and choose it in the drop-down menu below. Then, go to the respective sheet and complete all the required information. \nIf you need multiple VPCs, please provide a separate questionnaire for each VPC network you need to create (e.g. one for your production enviornment and one for QA) and send the answers back to MuleSoft. You can have one Production VPC and two Pre-Production VPCs for every 2 Production vCores purchased.\nCurrently, VPC workers cannot be configured with the customer's internal DNS resolvers. Therefore IP addresses must be used to access any resources in the internal network"]
[]
["Full reference documentation is available here: http://www.mulesoft.org/documentation/display/current/Virtual+Private+Cloud"]
[]
["VPCs can be connected to on-premises systems in one of 4 modes.\n\n1) IPSec tunnel - connect a network to a CloudHub VPC with IPsec.\n\n2) VPC Peering - connects an Amazon VPC directly to a CloudHub VPC.\n\n3) OpenVPN tunnel with host to network configuration - connect multiple hosts to a CloudHub VPC.\n\n4) OpenVPN tunnel with network to network configuration - connect a network to a CloudHub VPC with an SSL tunnel.\n\nIPsec is, in general, the recommended solution for VPC to on-premise connectivity. It provides a standardized, secure way to connect, which integrates well with existing IT infrastructure such as routers/appliances.\n\nOpenVPN can also be used to connect networks/hosts to a CloudHub VPC. It's recommended when you need to connect through a SOCKS/HTTP proxy, do not have a IPsec gateway or you need to perform multiple host to network configurations.\n\nIf the services you are connecting to are hosted on Amazon, then the easiest way to connect is to use VPC peering.\n"]
[]
["Select which type of VPC connection you would like to configure, and then click on the appropriate worksheet to complete the pertinent information"," -- Please Answer --"]
[]
["Is the purpose of this VPC connection request to modify an existing VPC configuration \n(e.g. are you adding VPC peering connection, an IPSec tunnel or modifying the encryption domain of an existing IPSec tunnel?)"," -- Please Answer --"]

{"sheet":"FAQ","index":1,"n_rows":27,"n_cols":1,"rows_kept":27,"cut":false,"hidden":false,"merged":[]}
["Frequently Asked Questions"]
["Q. Can I access internal systems from the VPC workers via their internal DNS names (e.g myDevDB.internal.acme.com)"]
["A. No. Currently we don't have the ability to relay DNS queries to internal DNS servers. You would need to either use IP addresses or public DNS entries. Beware of connecting to systems which may redirect to a Virtual IP endpoint by using an internal DNS entry."]
[]
["Q. Can I assign static private IPs to my VPC workers?"]
["A. No. When a worker is configured with a static IP that only refers to the public IP."]
[]
["Q. Why is the minimum size of the VPC subnet a /26 (64 IP addresses, read more about CIDR blocks at http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing)"]
["A. For better fault tolerance the VPC subnet may be divided in up to 4 Availibility Zones. Depending on the number of applications/workers you plan to deploy you may need to use a larger subnet for the VPC workers. The safe rule of thumb in deciding the size of the VPC subnet is => \"10 X max number of expected apps to be deployed in the VPC\". For example, if the expected number of apps is 10, the size of the subnet would be /25 which is 128 addresses."]
[]
["Q. How many locations can I connect to a VPC?"]
["A. We can terminate multiple IPSec tunnels to the same VPC. This way you can connect the VPC to multiple sites."]
[]
["Q. Does MuleSoft restrict outbound traffic from its workers?"]
["A. MuleSoft does not restrict any outbound traffic by default. Please check with your network/firewall team if traffic to a specific port is not reaching its destination."]
[]
["Q. How can I access the CloudHub/VPC workers?"]
["A. Please visit http://www.mulesoft.org/documentation/display/current/CloudHub+Networking+Guide for detailed network information."]
[]
["Q. Can MuleSoft use Network Address Translation (NAT) to access it's workers?"]
["A. No. MuleSoft does not use NAT."]
[]
["Q. Does MuleSoft use BGP routing (or any routing) to manage failover scenarios"]
["A. No, MuleSoft does not use any routing protocols."]
[]
["Q. Does MuleSoft provide a failover solution for VPC access?"]
["A. Currently MuleSoft does not provide a failover solution out of the box for VPC access"]

{"sheet":"IPSec","index":2,"n_rows":38,"n_cols":4,"rows_kept":38,"cut":false,"hidden":true,"merged":[[0,0,0,3],[1,0,1,3]]}
["IPSec Network to Network tunnel configuration"]
["Please ensure ALL fields are filled out carefully. Empty fields will cause the form to be rejected and consequently a delay in completing the VPC setup.\nOnce all the information is correctly filled out, it may take up to 5 business days to complete the VPC setup."]
[]
["Question","Answer","Description","Example"]
["IT Network Specialist ",null,"The networking specialist in the customers IT network team.This person must understand the current IP network layout of the customer as well as be a member of the team managing network routing and security for the customer"]
["Name"," -- Please Answer --","Name of IT Network Specialist"]
["Email"," -- Please Answer --","Email of IT Network Specialist"]
["Business Hours Timezone"," -- Please Answer --","Please select the closest timezone to the working hours of the Network Specialist"]
["Mobile Phone"," -- Please Answer --","Contact Mobile Phone. This is requested as Mulesoft utilise SMS to transfer secret keys as part of the initialization process for the VPC."]
[]
["MuleSoft CloudHub Configuration"]
["Anypoint Platform username"," -- Please Answer --","Please provide the username used to login to the Anypoint Platform. Failure to provide the correct username will cause the VPC request process to halt","joe.anypoint.user"]
["Should this VPC be accessible from the Public Internet"," -- Please Answer --","If your architecture requires that CH workers in the VPC are accessible from the public internet (e.g. mobile apps need to make api calls) you should answer YES. If you need to access the CH workers ONLY from the remote end of this IPSec tunnel your answer should be NO"]
["CloudHub Region (Code - Name)"," -- Please Answer --","Select from the dropdown to the left the region where you want your VPC created - e.g. US East, US West, EU, Australia, Singapore, etc. You can obtain this information in CloudHub General settings page. If Global Deployment is enabled in your Organization, please specify the region where you want this VPC to be configured. CH workers region MUST match the VPC region","US East"]
["CloudHub Workers IP Address Space\n(minimum accepted is /26 CIDR)"," -- Please Answer --","The Cloudhub Worker Address Space is a CIDR range of IP addresses that can be used for Cloudhub applications participating in the VPC. CH dynamically allocates an IP from this range to any application/worker deployed within the VPC. This IP range needs to be specified so that IP assignments do not conflict with any existing IP’s assigned to internal corporate machines (e.g. if the answer to #11 is 10.100.24.0/22, the answer here must not be 10.100.25.0/24). The smallest network allowed is /26. You can use http://www.ipaddressguide.com/cidr to calculate possible overlap.","10.100.20.0/24"]
[]
["Customer VPN Gateway Configuration"]
["Customer VPN Gateway Public IP"," -- Please Answer --","Public IP address of the gateway connecting to the CloudHub VPC. This is the device that will be terminating the IPSec tunnel.","217.18.136.66"]
["VPN Gateway Device Vendor / Model / SW Version"," -- Please Answer --",null,"Cisco 3900 IOS 15.0.x"]
["Customer Internal IP Address Space\n(aka encryption domain, minimum accepted is /24 CIDR)"," -- Please Answer --","The internal network address space (private IP address or addresses that can't be reached otherwise from the public internet) for the customers network that CloudHub workers in this VPC will be accessing. Please ensure these address spaces include all the possible systems that the applications deployed in the VPC workers require access to.","192.168.177.0/24 10.100.24.0/22"]
["Test Endpoint"," -- Please Answer --","A TCP endpoint (host:port) internal to the customer's network that can be used to test communication from the CloudHub VPC to the customer's network.","10.100.25.235:3066"]
[]
["Phase1 parameters",null,"The values in the Examples column are only examples and may be different then your network requirements. Please, provide ALL the necessary correct values in the Answers column. If the dropdown does not contain the value please type it in"]
["IKE Version"," -- Please Answer --","Please ensure this is the correct Protocol version. Failure to do so will result in significant delays for the successful completion of this request","IKEv1 or IKEv2"]
["IKE Authentication Method"," -- Please Answer --",null,"PKI or Preshared Key"]
["IKE Encryption Algorithm"," -- Please Answer --"," If the dropdown does not contain the value please type it in","AES256"]
["IKE Authentication Algorithm"," -- Please Answer --"," If the dropdown does not contain the value please type it in","hmac_sha1"]
["IKE Diffie-Hellman Group"," -- Please Answer --"," If the dropdown does not contain the value please type it in","Group2"]
["IKE Phase1 Lifetime"," -- Please Answer --",null,"86400 seconds"]
["IKE NAT Traversal"," -- Please Answer --",null,"Yes or No"]
["IKE Exchange Mode"," -- Please Answer --",null,"Aggressive or Main"]
[]
["Phase 2 parameters",null,"The values in the Examples column are only examples and may be different then your network requirements. Please, provide ALL the necessary correct values in the Answers column"]
["Encryption algorithm"," -- Please Answer --"," If the dropdown does not contain the value please type it in","AES256"]
["Authentication algorithm"," -- Please Answer --"," If the dropdown does not contain the value please type it in","hmac_sha1"]
["Use Perfect Forward Secrecy"," -- Please Answer --",null,"Yes or No"]
["Diffie-Hellman group"," -- Please Answer --",null,"Group2"]
["Phase2 lifetime"," -- Please Answer --",null,"3600 seconds"]

{"sheet":"VPC Peering","index":3,"n_rows":16,"n_cols":4,"rows_kept":16,"cut":false,"hidden":true,"merged":[[0,0,0,3],[1,0,1,3]]}
["VPC Peering configuration"]
["Please ensure ALL fields are filled out carefully. Empty fields will cause the form to be rejected and consequently a delay in completing the VPC setup.\nOnce all the information is correctly filled out, it may take up to 5 business days to complete the VPC setup."]
[]
["Question","Answer","Description","Example"]
["IT Network Specialist ",null,"The networking specialist in the customers IT network team.This person must understand the current IP network layout of the customer as well as be a member of the team managing network routing and security for the customer"]
["Name"," -- Please Answer --","Name of IT Network Specialist"]
["Email"," -- Please Answer --","Email of IT Network Specialist"]
["Business Hours Timezone"," -- Please Answer --","Please select the closest timezone to the working hours of the Network Specialist"]
[]
["Network Configuration"]
["Should this VPC be accessible from the Public Internet"," -- Please Answer --","If your architecture requires that CH workers in the VPC are accessible from the public internet (e.g. mobile apps need to make api calls) you should answer YES. If you need to access the CH workers ONLY from the remote end of this IPSec tunnel your answer should be NO"]
["Amazon EC2 Region (Code - Name)"," -- Please Answer --","Select from the dropdown to the left the region where you want your VPC created - e.g. US East, US West, EU, Australia, Singapore, etc. You can obtain this information in CloudHub General settings page. If Global Deployment is enabled in your Organization, please specify the region where you want this VPC to be configured. CH workers region MUST match the VPC region","US East"]
["CloudHub workers address space"," -- Please Answer --","The Cloudhub Worker Address Space is a CIDR range of IP addresses that can be used for Cloudhub applications participating in the VPC. CH dynamically allocates an IP from this range to any application/worker deployed within the VPC. This IP range needs to be specified so that IP assignments do not conflict with any existing IP’s assigned to internal corporate machines (e.g. if the answer to #11 is 10.100.24.0/22, the answer here must not be 10.100.25.0/24). The smallest network allowed is /26. You can use http://www.ipaddressguide.com/cidr to calculate possible overlap.","10.0.0.0/24"]
["Your VPC ID"," -- Please Answer --",null,"vpc-12345678"]
["Your Amazon Account ID"," -- Please Answer --",null,12345678990]
["Test Endpoint"," -- Please Answer --","A TCP endpoint (host:port) internal to the customer's network that can be used to test communication from the CloudHub VPC to the customer's network.","10.100.25.235:3066"]

{"sheet":"OpenVPN Network to Network","index":4,"n_rows":17,"n_cols":4,"rows_kept":17,"cut":false,"hidden":true,"merged":[[0,0,0,3],[1,0,1,3]]}
["OpenVPN Network to Network tunnel configuration"]
["Please ensure ALL fields are filled out carefully. Empty fields will cause the form to be rejected and consequently a delay in completing the VPC setup.\nOnce all the information is correctly filled out, it may take up to 5 business days to complete the VPC setup."]
[]
["Question","Answer","Description","Example"]
["IT Network Specialist ",null,"The networking specialist in the customers IT network team.This person must understand the current IP network layout of the customer as well as be a member of the team managing network routing and security for the customer"]
["Name"," -- Please Answer --","Name of IT Network Specialist"]
["Email"," -- Please Answer --","Email of IT Network Specialist"]
[]
["Network Configuration"]
["Your external gateway IP"," -- Please Answer --","Public IP address of the gateway connecting to the CloudHub VPC. This is the device that will be terminating the OpenVPN tunnel","217.18.136.66"]
["Your internal network address space"," -- Please Answer --","The internal network address space (private IP address or addresses that can't be reached otherwise from the public internet) for the customers network that CloudHub workers in this VPC will be accessing. Please ensure these address spaces include all the possible systems that the applications deployed in the VPC workers require access to.","192.168.177.0/24 10.100.24.0/22"]
["CloudHub workers address space"," -- Please Answer --","The Cloudhub Worker Address Space is a CIDR range of IP addresses that can be used for Cloudhub applications participating in the VPC. CH dynamically allocates an IP from this range to any application/worker deployed within the VPC. This IP range needs to be specified so that IP assignments do not conflict with any existing IP’s assigned to internal corporate machines (e.g. if the answer to #11 is 10.100.24.0/22, the answer here must not be 10.100.25.0/24). The smallest network allowed is /26. You can use http://www.ipaddressguide.com/cidr to calculate possible overlap.","10.100.20.0/24"]
["Your internal tunnel IP"," -- Please Answer --","The internal IP addresses of the two internal gateway endpoints. These should not overlap with any of your networks or the CloudHub VPC network.","172.12.10.1"]
["CloudHub-side internal tunnel IP"," -- Please Answer --","The internal IP addresses of the gateway endpoint in CloudHub. This address should not overlap with any of your networks or the CloudHub worker network space.","172.12.10.2"]
["HTTP proxy"," -- Please Answer --","Whether or not your gateway will be connecting over an HTTP proxy? If yes, please provide the settings. These are only needed if MuleSoft is generating an OpenVPN configuration for you.","Yes, mysockproxy.foo.com"]
["Amazon EC2 Region (Code - Name)"," -- Please Answer --","Select from the dropdown to the left the region where you want your VPC created - e.g. US East, US West, EU, Australia, Singapore, etc.","US East"]
["Test Endpoint"," -- Please Answer --","A TCP endpoint (host:port) internal to the customer's network that can be used to test communication from the CloudHub VPC to the customer's network.","10.100.25.235:3066"]

{"sheet":"OpenVPN Host to Network","index":5,"n_rows":19,"n_cols":4,"rows_kept":19,"cut":false,"hidden":true,"merged":[[0,0,0,3],[2,1,2,2],[1,0,1,3]]}
["OpenVPN Host to Network tunnel configuration"]
["Please ensure ALL fields are filled out carefully. Empty fields will cause the form to be rejected and consequently a delay in completing the VPC setup.\nOnce all the information is correctly filled out, it may take up to 5 business days to complete the VPC setup."]
[]
["Question","Answer","Description","Example"]
["IT Network Specialist ",null,"The networking specialist in the customers IT network team.This person must understand the current IP network layout of the customer as well as be a member of the team managing network routing and security for the customer"]
["Name"," -- Please Answer --","Name of IT Network Specialist"]
["Email"," -- Please Answer --","Email of IT Network Specialist"]
[]
["Network Configuration"]
["Your external gateway IP"," -- Please Answer --","Public IP address of the gateway connecting to the CloudHub VPC. This the device that will be terminating the OpenVPN tunnel","54.1.2.40"]
["Your internal network address space"," -- Please Answer --","The internal IP addresses of the gateway endpoint in CloudHub. This address should not overlap with any of your networks or the CloudHub worker network space.","10.0.0.0/24"]
["CloudHub-side internal tunnel IP"," -- Please Answer --","The network address space for the CloudHub workers. The smallest network mask allowed is /26.","172.16.10.0/26"]
["HTTP proxy"," -- Please Answer --","Whether or not your gateway will be connecting over an HTTP proxy? If yes, please provide the settings. These are only needed if MuleSoft is generating an OpenVPN configuration for you.","mysockproxy.foo.com:8080"]
["Amazon EC2 Region (Code - Name)"," -- Please Answer --","Public IP address of the gateway(s) connecting to the CloudHub VPC. These are the devices that will be terminating the OpenVPN tunnel(s)","US East"]
["Test Endpoint"," -- Please Answer --","A TCP endpoint (host:port) internal to the customer's network that can be used to test communication from the CloudHub VPC to the customer's network.","10.100.25.235:3066"]
[]
["X509 certificate settings"]
["Key size (eg 2048, 4096)",null,"Key size for the x.509 certificate you would like to use"]
["Certificate parameters",null,"Optional.","Issuer: C=US, ST=California, L=San Francisco, O=Mulesoft, OU=DevOps, CN=Mulesoft-Demo/emailAddress=demo@mulesoft.com)"]

{"sheet":"Data","index":6,"n_rows":39,"n_cols":8,"rows_kept":39,"cut":false,"hidden":true,"merged":[]}
["Amazon EC2 Region (Code - Name)","IKE Version","IKE Authentication Method","IKE Encryption Algorithm","IKE Authentication Algorithm","IKE Diffie-Hellman Group","Yes_or_No","IKE Exchange Mode"]
[" -- Please Answer --"," -- Please Answer --"," -- Please Answer --"," -- Please Answer --"," -- Please Answer --"," -- Please Answer --"," -- Please Answer --"," -- Please Answer --"]
["Asia Pacific (Tokyo) - ap-northeast-1","IKEv1","PKI","AES256","HMAC_MD5","Group 1 - 768-bit","Yes","Main"]
["Asia Pacific (Singapore) - ap-southeast-1","IKEv2","Preshared Key",null,"HMAC_SHA1","Group 2 - 1024-bit","No","Aggressive"]
["Asia Pacific (Sydney) - ap-southeast-2",null,null,null,"HMAC_SHA256","Group 5 - 1536-bit"]
["EU (Frankfurt) - eu-central-1",null,null,null,null,"Group 14 - 2048-bit"]
["EU (Ireland) - eu-west-1"]
["South America (Sao Paulo) - sa-east-1"]
["US East (N. Virginia) - us-east-1"]
["US West (N. California) - us-west-1"]
["US West (Oregon) - us-west-2"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["VPC_Type","TimeZone"]
[" -- Please Answer --"," -- Please Answer --"]
["IPSec","Hawaii: UTC-10"]
["VPC Peering","USA Pacific: UTC-8"]
["OpenVPN Host to Network","USA Mountain: UTC-7"]
["OpenVPN Network to Network","USA Central: UTC-6"]
[null,"USA Eastern: UTC-5"]
[null,"Buenos Aires: UTC-3 "]
[null,"London (U.K.): UTC"]
[null,"Central European: UTC+1 "]
["Shortcuts","Eastern European: UTC+2 "]
["Data Validation: Alt + D (pause) + L","Moscow: UTC+3"]
["Name Manager: Ctrl + F3","India: UTC+5.30 "]
[null,"Jakarta: UTC+7 "]
[null,"Australia West: UTC+8 "]
[null,"Japan: UTC+9"]
[null,"Australia East: UTC+10"]