73 lines
2.2 KiB
YAML
73 lines
2.2 KiB
YAML
---
|
|
last_verified: 2026-03-14
|
|
pattern: Hub-and-Spoke Networking
|
|
category: networking
|
|
---
|
|
|
|
description: |
|
|
Hub-and-spoke VCN topology for enterprise OCI deployments.
|
|
Centralizes shared services (firewalls, DNS, connectivity) in a hub VCN
|
|
with spoke VCNs for workloads.
|
|
|
|
architecture:
|
|
hub_vcn:
|
|
purpose: "Shared services, connectivity, security inspection"
|
|
components:
|
|
- "DRG (Dynamic Routing Gateway)"
|
|
- "Network Firewall (optional)"
|
|
- "DNS resolver"
|
|
- "FastConnect / VPN termination"
|
|
- "Bastion service"
|
|
- "Management subnet"
|
|
cidr_example: "10.0.0.0/16"
|
|
|
|
spoke_vcns:
|
|
purpose: "Workload isolation"
|
|
examples:
|
|
- name: "Production"
|
|
cidr: "10.1.0.0/16"
|
|
subnets:
|
|
- "Public subnet (LB): 10.1.0.0/24"
|
|
- "Private subnet (App): 10.1.1.0/24"
|
|
- "Private subnet (DB): 10.1.2.0/24"
|
|
- name: "Non-Production"
|
|
cidr: "10.2.0.0/16"
|
|
- name: "DMZ"
|
|
cidr: "10.3.0.0/16"
|
|
|
|
connectivity:
|
|
hub_to_spoke: "VCN attachments via DRG"
|
|
spoke_to_spoke: "Transit routing through DRG (no direct peering needed)"
|
|
on_prem: "FastConnect or VPN to DRG in hub"
|
|
|
|
when_to_use:
|
|
- "Multiple environments (prod, non-prod, DMZ)"
|
|
- "Centralized connectivity to on-prem"
|
|
- "Security inspection required between workloads"
|
|
- "Shared services (DNS, NTP, monitoring) across workloads"
|
|
|
|
when_NOT_to_use:
|
|
- "Single-VCN deployments"
|
|
- "Simple architectures with 1-2 workloads"
|
|
|
|
ip_planning:
|
|
recommendation: |
|
|
Plan CIDR ranges before deployment. Overlapping CIDRs prevent peering.
|
|
Use /16 for VCNs, /24 for subnets. Reserve ranges for future growth.
|
|
example_scheme:
|
|
hub: "10.0.0.0/16"
|
|
production: "10.1.0.0/16"
|
|
non_production: "10.2.0.0/16"
|
|
dmz: "10.3.0.0/16"
|
|
dr_region: "10.128.0.0/9"
|
|
|
|
gotchas:
|
|
- id: HUB-001
|
|
issue: "DRG route table limits"
|
|
impact: "Max 200 route rules per DRG route table"
|
|
recommendation: "Aggregate routes where possible, plan for scale"
|
|
- id: HUB-002
|
|
issue: "Network Firewall throughput"
|
|
impact: "Inspect all traffic adds latency and cost"
|
|
recommendation: "Only inspect north-south and selected east-west traffic"
|