Networking Management

OCI Networking

NEVER Do This

❌ NEVER route Oracle service traffic via Internet Gateway — Service Gateway is FREE

Without Service Gateway (via Internet Gateway):
- 20 TB/month database backups to Object Storage
- Egress: 20,000 GB × $0.0085/GB = $170/month

With Service Gateway:
- Same traffic = $0/month
- Annual savings: $2,040

Service Gateway covers: Object Storage (all tiers), ADB private endpoints, Oracle Services Network

# Add to private subnet route table
# Destination: <oci-services-cidr>  (query: oci network service list --all)
# Target: Service Gateway OCID

❌ NEVER create a VCN with /24 CIDR — it cannot be resized

# WRONG - 256 IPs, exhausted quickly, immutable
oci network vcn create --cidr-block "10.0.0.0/24"

# RIGHT - /16 gives 65,536 IPs, room for 256 /24 subnets
oci network vcn create --cidr-block "10.0.0.0/16"
# Migration requires: new VCN + resource migration + DNS + security rules = hours of downtime

❌ NEVER use /27 or smaller for Load Balancer subnets

# WRONG - only 32 IPs (27 usable after OCI reserves 5)
oci network subnet create --cidr-block "10.0.1.0/27"
# LB creation FAILS: "Insufficient IP space"

# RIGHT - /24 minimum (hard requirement)
oci network subnet create --cidr-block "10.0.1.0/24"
# LB needs 2 subnets in different ADs for HA, each /24 minimum
# OCI reserves IPs for future LB scaling even when not yet used

❌ NEVER assume VCN peering supports transitive routing

VCN-A ↔ VCN-B ↔ VCN-C peered

# WRONG: A can reach C via B
VCN-A instance → VCN-C instance = FAILS

# OCI peering is NON-TRANSITIVE
VCN-A can reach: VCN-B only
VCN-C can reach: VCN-B only

# Fix option 1: Explicit peer (VCN-A ↔ VCN-C direct)
# Fix option 2: Hub-and-spoke with DRG (preferred for 3+ VCNs)

❌ NEVER add redundant egress rules for stateful Security Lists (AWS NACL habit)

OCI Security Lists are STATEFUL (like AWS Security Groups, unlike AWS Network ACLs)

# WRONG - unnecessary egress rule
Security List ingress: Allow TCP 443 from 0.0.0.0/0
Security List egress:  Allow TCP 1024-65535 to 0.0.0.0/0  # Not needed!

# RIGHT - ingress only
Security List ingress: Allow TCP 443 from 0.0.0.0/0
# Response traffic auto-allowed

❌ NEVER try to add a 6th Security List to a subnet (hard limit: 5)

# OCI hard limit: max 5 security lists per subnet
# Complex apps with many tiers will hit this

# WRONG - fails at 6th
oci network subnet update --security-list-ids '["<sl1>","<sl2>","<sl3>","<sl4>","<sl5>","<sl6>"]'
# Error: "Maximum security lists (5) exceeded"

# RIGHT - use NSGs for application-specific rules
# NSGs: 5 per resource, 120 rules per NSG, unlimited NSGs per VCN

Security List vs NSG Decision Matrix

Recommended pattern:

• 1 Security List per subnet: allow egress, ICMP, DNS, NTP
• NSGs per tier: Web (80/443 from internet), App (from Web NSG), DB (from App NSG)
• Assign instances to their tier NSG; subnet Security List applies to all automatically

Transitive Routing: VCN Peering vs DRG

Local peering (same region, FREE):

• Create Local Peering Gateway (LPG) in each VCN
• Connect LPGs; add explicit routes in both route tables
• Limitation: no transitivity — A↔B and B↔C does NOT give A↔C

Remote peering (cross-region, $0.01/hr per DRG connection = $7.30/month):

• DRG in each region, Remote Peering Connection on each DRG

Hub-and-spoke with DRG (supports transitivity for on-premises):

VCN-A → DRG ← On-Premises
VCN-B → DRG ← On-Premises

# DRG routes between all attached VCNs AND on-premises
# This is the ONLY pattern where transitive routing works in OCI

3-region mesh (A↔B, B↔C, A↔C): 3 remote DRG connections = $21.90/month.

FastConnect vs VPN Selection

VPN Site-to-Site:
- Tunnel cost: $0.05/hr = $36.50/month
- Data: FREE (no per-GB charge for VPN processing)
- Egress: 500 GB × $0.0085 = $4.25/month
Total: ~$41/month

FastConnect (1 Gbps):
- Port: $1,100/month flat
- Data transfer: FREE
Total: $1,100/month

Decision:
- <500 GB/month or dev/test → VPN
- Production with latency SLA (5-20ms vs VPN's 30-50ms) → FastConnect
- >500 GB/month predictable → FastConnect for economics

Subnet Sizing Guide

OCI reserves 5 IPs per subnet (first 3 + broadcast + reserved). Factor this in.

VCN Design Anti-Patterns

Single subnet for all tiers — breaks blast radius containment, fails compliance:

# RIGHT - one subnet per tier
10.0.1.0/24 (web tier, public subnet)
10.0.2.0/24 (app tier, private subnet)
10.0.3.0/24 (DB tier, private subnet)

NSG web:  Allow 80/443 from internet
NSG app:  Allow 8080 from web NSG only
NSG db:   Allow 1521 from app NSG only

Gotcha: The default VCN route table cannot be deleted (while VCN exists) — only modified. Create custom route tables and associate subnets to them; leave default unused.

Reference Files

Load `references/oci-networking-reference.md` when you need:

• DRG, FastConnect, or VPN detailed configuration
• Complex routing troubleshooting
• Network Firewall setup
• Comprehensive VCN and subnet CLI reference