Local VCN Peering using Local Peering Gateways

Each administrator creates an LPG for their own VCN. "You" in the following procedure means an administrator (either the acceptor or requestor).

Allow group LPGAdmins to manage local-peering-gateways in tenancy
Allow group LPGAdmins to manage vcns in tenancy

1. In the Console, confirm you're viewing the compartment that contains the VCN that you want to add the LPG to. For information about compartments and access control, see Access Control.
2. Open the navigation menu, click Networking, and then click Virtual Cloud Networks.
3. Click the VCN you're interested in.
4. Under Resources, click Local Peering Gateways.
5. Click Create Local Peering Gateway.

6. Enter the following:

   • Name: A friendly name for the LPG. It doesn't have to be unique, and it cannot be changed later in the Console (but you can change it with the API). Avoid entering confidential information.
   • Create in compartment: The compartment where you want to create the LPG, if different from the compartment you're currently working in.
   • Associate with Route Table (optional): Only if you're setting up the advanced routing scenario called transit routing. Select the compartment that contains the route table you want to associate with the LPG, and the route table itself. You can skip this part and associate the LPG with a route table later if you like.
   • Tags: If you have permissions to create a resource, then you also have permissions to apply free-form tags to that resource. To apply a defined tag, you must have permissions to use the tag namespace. For more information about tagging, see Resource Tags. If you are not sure whether to apply tags, skip this option (you can apply tags later) or ask your administrator.

7. Click Create Local Peering Gateway.

   The LPG is then created and displayed on the Local Peering Gateways page in the compartment you chose.

If you're the requestor, give this information to the acceptor (for example, by email or other out-of-band method):

• If the VCNs are in the same tenancy: Name of the IAM group that should be granted permission to create a connection in the acceptor's compartment. In the example in the next task, the group is RequestorGrp.
• If the VCNs are in different tenancies: OCID for your tenancy, and OCID for the IAM group that should be granted permission to create a connection in the acceptor's compartment. In the example in the next task, it's the OCID for the RequestorGrp.
• Optional: Your VCN's CIDR, or specific subnets for peering with the other VCN.

If you're the acceptor, give this information to the requestor:

• If the VCNs are in the same tenancy: OCID for your LPG. Optionally, also the names of your VCN, LPG, and the compartment each is in.
• If the VCNs are in different tenancies: OCID for your LPG, and OCID for your tenancy.
• Optional: Your VCN's CIDR, or specific subnets for peering with the other VCN.

In this version of task C, both VCNs are in the same tenancy. If they're in different tenancies, instead see Task C: Set up the IAM policies (VCNs in different tenancies).

Both the requestor and acceptor must ensure that the right policies are in place:

• Policy R (implemented by the requestor):

  Allow group <requestor-group-name> to manage local-peering-from in compartment RequestorComp

  The requestor is in an IAM group called <requestor-group-name>. This policy lets anyone in the group initiate a connection from any LPG in the requestor's compartment (<requestor-compartment>). Policy R can be attached to either the tenancy (root compartment) or to <requestor-compartment>. For information about why you would attach it to one versus the other, see Policy Basics.

• Policy A (implemented by the acceptor):

  Allow group <requestor-group-name> to manage local-peering-to in compartment <acceptor-compartment>
  
  Allow group <requestor-group-name> to inspect vcns in compartment <acceptor-compartment>
  
  Allow group <requestor-group-name> to inspect local-peering-gateways in compartment <acceptor-compartment>
  

  The first statement in the policy lets the requestor connect to any LPG in the acceptor's compartment (<acceptor-compartment>). This statement reflects the required agreement from the acceptor for the peering to be established. Policy A can be attached to either the tenancy (root compartment) or to <acceptor-compartment>.

  Tip
  
  The second and third statements in Policy A let the requestor list the VCNs and LPGs in <acceptor-compartment>. The statements are required for the requestor to use the Console UI to select from a list of VCNs and LPGs in <acceptor-compartment> and establish the connection. The following diagram focuses only on the first statement, which is the critical one that permits the connection.

Both Policy R and Policy A give RequestorGrp access. However, Policy R has a resource-type called local-peering-from, and Policy A has a resource-type called local-peering-to. Together, these policies let someone in RequestorGrp establish the connection from an LPG in the requestor's compartment to an LPG in the acceptor's compartment. The API call to create the connection specifies which two LPGs.

 Allow group NetworkAdmin to manage virtual-network-family in compartment RequestorComp

In this version of task C, the VCNs are in different tenancies (in other words, it's a cross-tenancy peering). If the VCNs are in the same tenancy, instead see Task C: Set up the IAM policies (VCNs in same tenancy).

Both the requestor and acceptor must ensure that the right policies are in place:

• Policy R (implemented by the requestor):

  Define tenancy Acceptor as <acceptor_tenancy_OCID>
  
  Allow group <requestor-group-name> to manage local-peering-from in compartment <requestor-compartment>
  Endorse group <requestor-group-name> to manage local-peering-to in tenancy Acceptor
  
  Endorse group <requestor-group-name> to associate local-peering-gateways in compartment <requestor-compartment>
     with local-peering-gateways in tenancy Acceptor

  The requestor is in an IAM group called <requestor-group-name>. This policy lets anyone in that group initiate a connection from any LPG in the requestor's compartment (<requestor-compartment>).

  The first statement is a "define" statement that assigns a friendly label to the acceptor's tenancy OCID. The statement happens to use "Acceptor" as the label, but it could be a value of the requestor's choice. All "define" statements in a policy must be the first ones (at the top).

  The second statement lets the <requestor-group-name> establish a connection from an LPG in the requestor's compartment.

  The third and fourth statements are special ones required because the LPGs are in different tenancies. They let the <requestor-group-name> connect an LPG in the requestor's tenancy to an LPG in the acceptor's tenancy.

  If the intent is to give the <requestor-group-name> permission to connect to an LPG in any tenancy, the policy would instead look like this:

  
  Allow group <requestor-group-name> to manage local-peering-from in compartment <requestor-compartment>
  
  Endorse group <requestor-group-name> to manage local-peering-to in 
  
  any-tenancy
  
  
  
  Endorse group <requestor-group-name> to associate local-peering-gateways in compartment <requestor-compartment> 
  with local-peering-gateways in 
  any-tenancy
  
  

  Regardless, Policy R must be attached to the requestor's tenancy (root compartment), and not the requestor's compartment. Policies that enable cross-tenancy access must be attached to the tenancy. For more information about attachment of policies, see Policy Basics.

• Policy A (implemented by the acceptor):

  Define tenancy Requestor as <requestor_tenancy_OCID>
  
  Define group <requestor-group-name> as <RequestorGrp_OCID>
  
  Admit group <requestor-group-name> of tenancy Requestor to manage local-peering-to in compartment <acceptor-compartment>
  
  Admit group <requestor-group-name> of tenancy Requestor to associate local-peering-gateways in tenancy Requestor
      with local-peering-gateways in compartment <acceptor-compartment>
  

  Similar to the requestor's policy, this policy first uses "define" statements to assign friendly labels to the requestor's tenancy OCID and the <requestor-group-name> OCID. As mentioned earlier, the acceptor could use other values for those labels if wanted.

  The third and fourth statements let the <requestor-group-name> connect to an LPG in the acceptor's compartment (<acceptor-compartment>). These statements reflect the critical agreement required for the peering to be established. The word Admit indicates that the access applies to a group outside the tenancy where the policy resides.

  Policy A must be attached to the acceptor's tenancy (root compartment), and not the acceptor's compartment.

The requestor must perform this task.

Prerequisite: The requestor must have the OCID of the acceptor's LPG.

1. In the Console, view the details for the requestor LPG that you want to connect to the acceptor LPG.
2. For the requestor LPG, click the Actions menu, and then click Establish Peering Connection.

3. Specify which LPG you want to peer with:

   • If the VCNs are in different tenancies: Select Enter Local Peering Gateway OCID, and enter the acceptor LPG's OCID.

   • If the VCNs are in the same tenancy: Do one of the following:

     • Select Enter Local Peering Gateway OCID, and enter the acceptor LPG's OCID.
     • Select Browse Below, and then select the acceptor's VCN and LPG from the lists provided. Remember that the VCN and LPG each might be in a different compartment than the one you're currently working in.

4. Click Establish Peering Connection.

The connection is established and the LPG's state changes to PEERED.

At this point, the details of each LPG update to show the Peer VCN CIDR Block for the other VCN. This is the CIDR of the other VCN across the peering from the LPG. Each administrator can use this information to update the route tables and security rules for their own VCN.

As mentioned earlier, each administrator can do this task before or after the connection is established.

Prerequisite: Each administrator must have the CIDR block or specific subnets for the other VCN. If the connection is already established, look at the Peer VCN CIDR Block for your LPG in the Console. Otherwise, get the information from the other administrator by email or other method.

For your own VCN:

1. Determine which subnets in your VCN need to communicate with the other VCN.

2. Update the route table for each of those subnets to include a new rule that directs traffic destined for the other VCN's CIDR to your LPG:

   1. Open the navigation menu, click Networking, and then click Virtual Cloud Networks.
   2. Click the VCN you're interested in.
   3. Under Resources, click Route Tables.
   4. Click the route table you're interested in.

   5. Click Add Route Rule and enter the following:

      • Target Type: Local Peering Gateway.
      • Destination CIDR Block: The other VCN's CIDR block. If you want, you can specify a subnet or particular subset of the peered VCN's CIDR.
      • Target Compartment: The compartment where the LPG is located, if not the current compartment.
      • Target: The LPG.
      • Description: An optional description of the rule.
   6. Click Add Route Rule.

Any subnet traffic with a destination that matches the rule is routed to your LPG. For more information about setting up route rules, see VCN Route Tables.

Later, if you no longer need the peering and want to delete your LPG, you must first delete all the route rules in your VCN that specify the LPG as the target.

As mentioned earlier, each administrator can do this task before or after the connection is established.

Prerequisite: Each administrator must have the CIDR block or specific subnets for the other VCN. In general, you should use the same CIDR block you used in the route table rule in Task E: Configure the route tables.

What rules should you add?

• Ingress rules for the types of traffic you want to allow from the other VCN, specifically from the VCN's CIDR or specific subnets.
• Egress rule to allow outgoing traffic from your VCN to the other VCN. If the subnet already has a broad egress rule for all types of protocols to all destinations (0.0.0.0/0), then you don't need to add a special one for the other VCN.

For your own VCN:

1. Determine which subnets in your VCN need to communicate with the other VCN.

2. Update the security list for each of those subnets to include rules to allow the intended egress or ingress traffic specifically with the CIDR block or subnet of the other VCN:

   1. In the Console, while viewing the VCN you're interested in, click Security Lists.
   2. Click the security list you're interested in.
   3. Under Resources, click either Ingress Rules or Egress Rules depending on the type of rule you want to work with.

   4. If you want to add a rule, click Add Ingress Rule (or Add Egress Rule).

      Example

      Let's say you want to add a stateful rule that enables ingress HTTPS (port 443) traffic from the other VCN's CIDR. Here are the basic steps you take when adding a rule:

      1. Leave the Stateless check box unselected.
      2. Source Type: Leave as CIDR.
      3. Source CIDR: Enter the same CIDR block that the route rules use (see Task E: Configure the route tables).
      4. IP Protocol: Leave as TCP.
      5. Source Port Range: Leave as All.
      6. Destination Port Range: Enter 443.
      7. Description: An optional description of the rule.
   5. If you want to delete an existing rule, click the Actions menu, and then click Remove.
   6. If you wanted to edit an existing rule, click the Actions menu, and then click Edit.

For more information about security rules, see Security Rules.

See the instructions in Task A: Create the LPGs.

This task is related to an advanced routing scenario called transit routing.

An LPG can exist without a route table associated with it. However, after you associate a route table with an LPG, there must always be a route table associated with it. But, you can associate a different route table. You can also edit the table's rules, or delete some or all of the rules.

Prerequisite: The route table must exist and belong to the VCN that the LPG belongs to.

1. Open the navigation menu, click Networking, and then click Virtual Cloud Networks.
2. Click the VCN you're interested in.
3. Under Resources, click Local Peering Gateways.

4. For the LPG you're interested in, click the Actions icon (), and then click either: 

   • Associate With Route Table: If the LPG has no route table associated with it yet.
   • Replace Route Table Association: If you're changing which route table is associated with the LPG.
5. Select the compartment where the route table resides, and select the route table itself.
6. Click Associate.

Prerequisite: First delete all the route rules in your VCN that specify the LPG as the target. Deleting those rules stops the routing in your VCN to the LPG. However, the LPG's state may still be PEERED if the other LPG still exists. Whenever an LPG is deleted, the LPG at the other side of the peering changes to the REVOKED state.

1. Open the navigation menu, click Networking, and then click Virtual Cloud Networks.
2. Click the VCN you're interested in.
3. Click Local Peering Gateways.
4. For the LPG you want to delete, click the Actions menu, and then click Terminate.
5. Confirm when prompted.

1. Open the navigation menu, click Networking, and then click Virtual Cloud Networks.
2. Click the VCN you're interested in.
3. Under Resources, click Local Peering Gateways.
4. Click the Actions menu for the local peering gateway, and then click View Tags. From there you can view the existing tags, edit them, and apply new ones.

For more information, see Resource Tags.

You can move a local peering gateway from one compartment to another. When you move a local peering gateway to a new compartment, inherent policies apply immediately.

1. Open the navigation menu, click Networking, and then click Virtual Cloud Networks.
2. Click the VCN you're interested in.
3. Under Resources, click Local Peering Gateways.
4. Click the Actions menu for the local peering gateway, and then click Move Resource.
5. Choose the destination compartment from the list.
6. Click Move Resource.

For more information about using compartments and policies to control access to your cloud network, see Access Control. For general information about compartments, see Managing Compartments.