Route Leaking from a static vpn to a BGP VPN connected to the same Anypoint VPN

SYMPTOM

A VPC has two Anypoint VPNs, one static and one dynamic (BGP). CGW is Customer GateWay

(192.168.0.0/16) CH VPC---VGW------> static VPN----> CGW1-----> 10.100.0.0/16
                                                      \_____> BGP VPN----->CGW2-----> 172.16.0.0/16

The routes of the static VPN are advertised to the BGP VPN, which causes routing problems. In the above case, the BGP VPN (CGW2) receives the route 10.100.0.0/16 which is from the static VPN (CGW1). In a real scenario, the CGW1 can be your on-premise VPN gateway, the CGW2 can be GCP (Google Cloud Platform) VPN.  

If CGW1 and CGW2 are also connected directly, this may cause an asymmetric routing problem. The CGW1 sends packets directly to CGW2 but the return traffic may go via the CH VPC.

CAUSE

This behavior of VPN (i.e. receiving a route from one VPN and advertised to another) is expected. This is true for both BGP learned and static routes. All static and BGP learned routes will be re-advertised back out any BGP routed VPNs.

SOLUTION

This can be solved by using 2x VGWs, however there is a CloudHub limitation of one VGW per VPC. It's not possible to attach 2x VGWs to the same VPC. Possible workarounds

1. Avoid asymmetric routing. Since return traffic from CGW2 is routed via Anypoint VPN, you can configure CGW1 such that traffic to CGW2 is forwarded via the Anypoint VPN.
2. Prefix filter on CGW2. Apply prefix filter in CGW2 if possible. You can create a filter such that only the CH VPC CIDR route is accepted over BGP.
3. Use static routed VPNs instead of BGP VPNs. This will prevent any unwanted advertisements from MuleSoft CloudHub. However, this will come with the known disadvantages of static vs BGP routed VPNs (i.e. static routed VPNs and asymmetric routing with active-active tunnels).