Routing traffic through a central network virtual appliance

There are three primary transit routing scenarios:

  • Access between multiple networks through a single DRG with a firewall between networks: The scenario covered in this topic. This scenario uses the DRG as the hub, with routing configured to send packets through a firewall instance in a dedicated Virtual Cloud Network (VCN) before they can be sent to another network.
  • Access to multiple VCNs in the same region: This scenario enables communication between your on-premises network and multiple VCNs in the same region over a single FastConnect private virtual circuit or Site-to-Site VPN, with a VCN as the hub. See Transit Routing inside a hub VCN
  • Private access to Oracle services: This scenario uses a service gateway in an attached hub VCN to give your on-premises network private access to Oracle services, so on-premises hosts can use their private IP addresses and traffic doesn't go over the internet. See Private Access to Oracle Services.

Highlights

  • You can use FastConnect or Site-to-Site VPN to connect your on-premises network with multiple VCNs in the same region or in another region, in a hub-and-spoke topology.
  • When the Dynamic Routing Gateway (DRG)  acts as the hub, all VCNs can be in different regions or tenancies. For accurate routing, the CIDR blocks of the various subnets accessible to the on-premises network and other connected VCNs must not overlap.
  • A dynamic routing gateway can act as the hub to communicate between VCNs or with the on-premises network. This DRG has attachments for peering connections to VCNs (referred to as spoke VCNs in this topic).
  • To enable the intended traffic from a spoke VCN to other attached networks through the DRG and a hub VCN (with a network virtual appliance), create route rules for the spoke VCN's subnets, spoke VCN's DRG attachment, hub VCN's DRG attachment, and the hub VCN's subnets.
  • You can set up transit routing through a private IP in the hub VCN. For example, you might want to filter or inspect the traffic between the on-premises network and a spoke VCN. In that case, you route the traffic to a private IP on a network virtual appliance in the hub VCN for inspection, and the resulting traffic continues to its destination.
  • By configuring route tables, you can control whether a particular subnet in a peered spoke VCN is advertised to the on-premises network.
Tip

There's another scenario that lets you connect your on-premises network to multiple VCNs. Instead of using a single DRG and hub-and-spoke topology, you set up a separate DRG for each VCN and a separate private virtual circuit over a single FastConnect. However, the scenario can be used only with FastConnect through a third-party provider or through colocation with Oracle. The VCNs must be in the same region and same tenancy. For more information, see FastConnect with Multiple DRGs and VCNs.

Overview of Transit Routing through a Private IP

Transit routing is simply routing traffic to either a VCN or an on-premises network through a central hub VCN. Here's a basic example of why you might use transit routing: you have a large organization with different departments, each with their own VCN. Each VCN needs access to the other VCNs, but you want to ensure security by sending all traffic through a virtual network appliance running a firewall.

Note

A hub is a logical concept in a hub-and-spoke topology. If you want spokes to communicate directly to each other, the hub can be just a DRG. If you want all spoke-to-spoke traffic to pass through a network virtual appliance, the hub is the combination of the DRG and a hub VCN containing the network virtual appliance.

This networking scenario optionally involves connecting your on-premises network to a VCN with either Oracle Cloud Infrastructure FastConnect or Site-to-Site VPN. These two basic scenarios illustrate that topology: Scenario B: Private Subnet with a VPN and Scenario C: Public and Private Subnets with a VPN.

This scenario uses a hub-and-spoke topology, as illustrated in the following diagram. The term hub here means only that a VCN has a network virtual appliance that must be routed through when one spoke communicates with another spoke in this hub-and-spoke design. For details on how to enable North-South communication between your on-premises network and spoke VCNs through a network virtual appliance refer to the last section in the detailed steps that follow.

DRG transit routing with a firewall VCN

Use this scenario if you want to create a hub-and-spoke topology and route all traffic between spokes through a network virtual appliance in the hub. All VCNs are in the same region, and connect to a DRG in that region, but they could be in different regions or in different tenancies. The on-premises network shown is optional, and could be a VCN in another region or tenancy. In this scenario, traffic is sent from an on-premises network to the DRG and then to the network virtual appliance in VCN-Hub, then back to the DRG to be routed to VCN-B. Similarly, traffic sent from VCN-A is first routed by the DRG to VCN-Hub and then to VCN-C.

Summary of New Concepts for Experienced Networking Service Users

If you're already familiar with the Networking service and local peering, the most important new concepts to understand are:

  • For each spoke VCN subnet that needs to communicate with another network attached to the DRG, update the subnet's route table with a rule that sets the target for all traffic (the next hop) as the DRG.
  • Add a new DRG route table for spoke VCN attachments, associate this route table with each spoke VCN attachment (inside the DRG). Create a static default route with the target (next hop) of the hub VCN attachment. This will route all spoke VCN traffic to the hub VCN with the network virtual appliance.
  • Add a new DRG route table for the hub VCN attachment, associate it with the hub VCN attachment (inside the DRG). Associate an new import route distribution with this DRG route table and create policies to import attachments associated with all destinations which must be reachable from VCN-Hub.

  • Add another VCN route table to the hub VCN, VCN-Hub, associate it with the hub VCN's attachment to the DRG, and add a route rule with a target that depends on your situation:

  • Update the subnet route table in your hub VCN with rules that set the target (next hop) for all spoke VCNs and on-premises networks as the DRG.

Before you begin

Before you attempt to implement this scenario, ensure that:

  1. VCN-A, VCN-B, and VCN-C (the "spoke" VCNs) are all already created, none of which are attached to a DRG.
  2. VCN-Hub is already created and its subnet Subnet-H has a network virtual appliance with a private IPv4 address. This VCN is not yet attached to any DRG.
  3. All VCNs in the scenario have non-overlapping CIDRs.
  4. The on-premises network is connected to the DRG with FastConnect or Site-to-Site VPN.
  5. All necessary IAM policies are in already in place. See IAM Policies for Routing Between VCNs for details.

Process summary

Configuring transit routing involves these steps:

  1. Create a DRG named DRG-Hub.
  2. Attach spoke VCNs VCN-A, VCN-B, and VCN-C to DRG-Hub.
  3. Attach VCN-Hub to DRG-Hub.
  4. Create a route table named "RT-Spoke" in DRG-Hub with a single static rule sending all traffic to the VCN-Hub's attachment.
  5. Change the DRG route table used by the spoke VCN attachments to "RT-Spoke."
  6. Create an import DRG route distribution in DRG-Hub called "Import-Hub" with three statements, each importing routes from the VCN attachments used by VCN-A, VCN-B, and VCN-C. For more information on import route distrubtions, see Overview of Dynamic Routing Gateways
  7. Create a DRG route table named "RT-Hub" in DRG-Hub and specify its import route distribution to "Import-Hub".
  8. Update the DRG route table of VCN-Hub's attachment to use the "RT-Hub" route table.
  9. Configure VCN-Hub's default route table to send all incoming traffic to the network virtual appliance instance.
  10. Configure Subnet-H to send all traffic destined to addresses in the VCN CIDRs of VCN-A, VCN-B, and VCN-C to the DRG attachment.

Example: Transit routing with a DRG hub and a network virtual appliance in an attached VCN

The examples in this section show a DRG acting as a hub and an attached VCN with a firewall, you can configure as many spoke VCNs as necessary by repeating Task 2: Attach the spoke VCNs.

Diagram showing transit-routing enabled DRG and a hub VCN
Callout 1: DRG route table "RT-Spoke" (affecting traffic entering the DRG from all spoke attachments)
Destination CIDR Route Target Type
0.0.0.0/0 VCN-Hub Static
Callout 2: DRG route table "RT-Hub" (affecting traffic entering the DRG from the hub attachment)
Destination CIDR Route Target Type
172.16.0.0/16 Virtual circuit Dynamic
192.168.10.0/24 VCN-A Dynamic
192.168.20.0/24 VCN-B Dynamic
192.168.30.0/24 VCN-C Dynamic
Callout 3: Subnet-1 route table (affecting traffic leaving Subnet-1)
Destination CIDR Route Target
172.16.0.0/16 DRG
192.168.20.0/24 DRG
192.168.30.0/24 DRG
Callout 4: VCN-Hub route table "VCN-Hub-Ingress" (affecting traffic entering VCN-Hub)
Destination CIDR Route Target
172.16.0.0/16 10.0.0.10
192.168.10.0/24 10.0.0.10
192.168.20.0/24 10.0.0.10
192.168.30.0/24 10.0.0.10
Callout 5: Subnet-H route table (affecting traffic leaving Subnet-H)
Destination CIDR Route Target
172.16.0.0/16 DRG
192.168.10.0/24 DRG
192.168.20.0/24 DRG
192.168.30.0/24 DRG
Callout 6: Subnet-2 route table
Destination CIDR Route Target
172.16.0.0/16 DRG
192.168.10.0/24 DRG
192.168.30.0/24 DRG
Callout 7: Subnet-3 route table
Destination CIDR Route Target
172.16.0.0/16 DRG
192.168.10.0/24 DRG
192.168.20.0/24 DRG

Enabling north-south traffic through a network virtual appliance

You may choose to set up a configuration where any packets sent from one spoke VCN to your on-premises network are sent to the mutually attached DRG, redirected to a network virtual appliance in a hub VCN, and packets the network virtual appliance allows are then sent back to the DRG to be routed to their on-premises destination.

Repeat these steps for each spoke ((VCN-A, VCN-B, and VCN-C)) VCN's route table to route all traffic destined to on-premises to the attached DRG, DRG-Hub.

This completes configuration of north-south transit routing. At this point, any packets sent from one spoke VCN to your on-premises are sent to the mutually attached DRG, redirected to a network virtual appliance in a hub VCN, and packets the network virtual appliance allows are then sent back to the DRG to be routed to their on-premises destination.