To provide secure and reliable network connectivity for different application and management functions, Exadata Database Service on Cloud@Customer uses different networks.

The following list outlines the minimum network requirements to install an Exadata Database Service on Cloud@Customer system:

• Exadata Cloud@Customer Service Network: These network will be set up to Oracle specifications and should not be modified by customer without Oracle agreement.
  • Control Plane Network

    This virtual private network (VPN) connects the two control plane servers that are located in the Exadata Database Service on Cloud@Customer rack to Oracle Cloud Infrastructure. The VPN facilitates secure customer-initiated operations using the Oracle Cloud Infrastructure Console and APIs. It also facilitates secure monitoring and administration of the Oracle-managed infrastructure components in Exadata Database Service on Cloud@Customer.

    • Control Plane Connectivity Considerations

      In order for the control plane to function, the control plane server must be able to connect to certain Oracle Cloud Infrastructure (OCI) addresses. You must enable TCP port 443 outbound access to the endpoints in a specific OCI region as follows:

      Table 3-2 Ports to Open for Control Plane Connectivity

      Description / Purpose	Open Port	Location
      Outgoing Tunnel Service for Cloud Automation delivery	443 outbound	Use this URL format, replacing oci_region with your region: https://wss.exacc.oci_region.oci.oraclecloud.com
      Secure Tunnel Service for remote Oracle operator access	443 outbound	Use these URL formats, replacing oci_region with your region: https://mgmthe1.exacc.oci_region.oci.oraclecloud.com https://mgmthe2.exacc.oci_region.oci.oraclecloud.com
      Object Storage Service to retrieve system updates, infrastructure monitoring, and log collection	443 outbound	Use this URL format, replacing oci_region with your region: https://objectstorage.oci_region.oraclecloud.com https://swiftobjectstorage.oci_region.oraclecloud.com https://*.objectstorage.oci_region.oci.customer-oci.com
      Monitoring Service to record and process Infrastructure Monitoring Metrics (IMM)	443 outbound	Use this URL format, replacing oci_region with your region: https://telemetry-ingestion.oci_region.oraclecloud.com
      Identity Service for Authorization and Authentication	443 outbound	Use this URL format, replacing oci_region with your region: https://identity.oci_region.oraclecloud.com https://auth.oci_region.oraclecloud.com
      Outgoing Tunnel Service for Cloud Automation delivery	443 outbound	Use this URL format, replacing oci_region with your region: https://wsshe.adbd-exacc.oci_region.oci.oraclecloud.com
      Logging Service	443 outbound	Use this URL format replacing oci_region with your region: https://frontend.logging.ad1.oci_region.oracleiaas.com https://frontend.logging.ad2.oci_region.oracleiaas.com https://frontend.logging.ad3.oci_region.oracleiaas.com https://controlplane.logging.ad1.oci_region.oracleiaas.com https://controlplane.logging.ad2.oci_region.oracleiaas.com https://controlplane.logging.ad3.oci_region.oracleiaas.com
      Resource Principal based authentication and Autonomous Database service delivery	443 outbound	Use this URL format, replacing oci_region with your region: https://database.oci_region.oraclecloud.com
      VM console	443 outbound	Use this URL format, replacing oci_region with your region: https://console1.exacc.oci_region.oci.oraclecloud.com https://console2.exacc.oci_region.oci.oraclecloud.com

      Note that the Control Plane Server must be able to establish TCP Port 443 outbound access only. While outbound connections on Port 443 must be allowed, TCP Port 443 inbound access is not required, and it may be desirable from a security standpoint to block inbound connections. (Functionally, bi-directional traffic is still possible over the connection once the secure outbound connection is established.)

      The Control Plane Server requires customer DNS and NTP services to be functional. Minimum bandwidth requirements for the Control Plane Server internet connection to OCI are 50/10 mbs download/upload.

      Some customers have security policies requiring the use of proxies for all internet connections to IT infrastructure. Customer HTTP proxy, for example, passive/corporate proxy supported for the Control Plane Server connection to OCI. Customer HTTPS, challenge proxy, and traffic inspection are not supported.

      If you are using IP address filtering based firewall rules, due to the dynamic nature of cloud interfaces, you must allow traffic with all the relevant IP CIDR ranges associated with your OCI region as identified by https://docs.oracle.com/en-us/iaas/tools/public_ip_ranges.json.
  • Administration Network

    This network connects Exadata Database Service on Cloud@Customer servers and switches to the two control plane servers that are located in the Exadata Database Service on Cloud@Customer rack. It facilitates customer-initiated operations using the Oracle Cloud Infrastructure Console and APIs. It also facilitates monitoring and administration of the Oracle-managed infrastructure components in Exadata Database Service on Cloud@Customer.

    This network is fully contained within the Exadata Database Service on Cloud@Customer rack, and does not connect to your corporate network. However, the Exadata infrastructure is indirectly connected to your corporate network through the control plane servers. This connection is required to provide Domain Name System (DNS) and Network Time Protocol (NTP) services to the Exadata infrastructure. Therefore, the IP addresses that are allocated to the administration network must not exist elsewhere in your corporate network.

    Each Oracle Database server and Exadata Storage Server has two network interfaces connected to the administration network. One provides management access to the server through one of the embedded Ethernet ports (NET0). The other provides access to the Integrated Lights-Out Management (ILOM) subsystem through a dedicated ILOM Ethernet port. Exadata Database Service on Cloud@Customer is delivered with the ILOM and NET0 ports connected to the Ethernet switch in the rack. Cabling or configuration changes to these interfaces are not permitted.

  • InfiniBand or RDMA Over Converged Ethernet (ROCE) Network

    This network connects the database servers, Exadata Storage Servers, and control plane servers using the InfiniBand or ROCE switches on the rack. Each server contains two InfiniBand network interfaces (IB0 and IB1) or ROCE interface (re0 and re1) that are connected to separate InfiniBand or ROCE switches in the rack. Primarily, Oracle Database uses this network for Oracle RAC cluster interconnect traffic, and for accessing data on Exadata Storage Servers.

    This non-routable network is fully contained within the Exadata Cloud@Customer rack, and does not connect to your corporate network. However, because the control plane servers are connected to the InfiniBand or ROCE network and to your corporate network, the IP addresses that are allocated to the InfiniBand or ROCE network must not exist elsewhere in your corporate network.

• Customer Network: Customer-owned and managed networks required for the Exadata Cloud@Customer data plane to access related systems.
  • Client Network

    This network connects the Exadata Cloud@Customer database servers to your existing client network and is used for client access to the virtual machines. Applications access databases on Exadata Database Service on Cloud@Customer through this network using Single Client Access Name (SCAN) and Oracle Real Application Clusters (Oracle RAC) Virtual IP (VIP) interfaces.

    The client access network uses a pair of network interfaces on each database server, which are connected to the customer network.

    Note
    
    When you enable Data Guard, replication of data happens over the client network by default.
  • Backup Network

    This network is similar to the client access network, as it connects the Exadata Database Service on Cloud@Customer Oracle Database servers to your existing network. It can be used for access to the virtual machines for various purposes, including backups and bulk data transfers.

    Like the client network, the backup network uses a pair of network interfaces on each database server, which are connected to the customer network. Physically connecting the backup network to a customer network is required.

    If the customer's on-premises storage (NFS or ZDLRA) is to be used exclusively as a backup destination for databases, then no external connectivity to OCI is required for the backup network.

    Exadata Cloud@Customer also offers an Oracle-managed cloud object storage backup destination. If Oracle's Object Storage Service is to be leveraged as a backup destination for database backups, then ensure that the backup network can reach the Object Storage Service through external connection. You must enable TCP port 443 outbound access for the backup network as follows:

    Table 3-3 Ports to Open for Backup Network

    Description / Purpose	Open Port	Location
    Object Storage Service for cloud-based database backups (Optional)	443 outbound	Use this URL format, replacing oci_region with your region: https://objectstorage.oci_region.oraclecloud.com https://swiftobjectstorage.oci_region.oraclecloud.com

  • Disaster Recovery Network (authorized customers only)
    Note
    
    Only certain authorized customers will have this additional network due to special circumstances, your system may not be so-equipped.

    This network is configured similarly to the client access network, however it transmits Data Guard traffic only. If your system is so equipped, rather than sending Data Guard traffic over the client network, this Data Guard traffic will instead go over this Disaster Recovery network using Single Client Access Name (SCAN) and Oracle Real Application Clusters (Oracle RAC) Virtual IP (VIP) interfaces.

    The Disaster Recovery network uses a pair of network interfaces on each database server, which are connected to the customer network.

Before you deploy Exadata Database Service on Cloud@Customer, ensure that your data center network meets requirements.

You must allocate a range of IP addresses to the administration network, and another range of IP addresses to the RoCE private network.

/23

/16

/22

/19

/28

/27

/27

/26

/29

/28

/28

/27

/28

/27

/27

/26

Ensure that your Exadata Database Service on Cloud@Customer system meets control plane server and database server uplink requirements.

You can choose to use the supplied network equipment, or you can build your own SFP network.

Consider the solution outlined below, which leverages OCI’s FastConnect service, if you want additional isolation for the connection between your CPS and OCI in addition to the default TLS tunnel approach.

For more information, see Oracle Cloud Infrastructure FastConnect.

Oracle Exadata Database Service on Cloud@Customer service supports the public or private peering connectivity model of FastConnect.

Figure 3-1 Oracle Exadata Database Service on Cloud@Customer FastConnect connectivity to OCI through public peering

As shown in the figure, the Oracle Exadata Database Service on Cloud@Customer Control Plane network egresses to FastConnect provider and to Oracle edge. Customers who may already have existing FastConnect connectivity can use it to connect Oracle Exadata Database Service on Cloud@Customer to the OCI region using public peering.

Figure 3-2 Oracle Exadata Database Service on Cloud@Customer FastConnect connectivity to OCI through private peering