forked from diegoecab/oci-deal-accelerator
92 lines
3.4 KiB
YAML
92 lines
3.4 KiB
YAML
---
|
|
last_verified: 2026-03-14
|
|
service: OCI Networking
|
|
category: networking
|
|
oci_color: "#4F7B6E"
|
|
---
|
|
|
|
what: Software-defined networking layer in OCI. Includes VCN, subnets, gateways,
|
|
load balancers, DNS, and connectivity options.
|
|
|
|
components:
|
|
vcn:
|
|
what: "Virtual Cloud Network — isolated network in OCI"
|
|
cidr: "Supports multiple CIDR blocks, /16 to /30"
|
|
max_per_region: 50
|
|
subnet:
|
|
what: "Subdivision of VCN, can be regional (spans all ADs)"
|
|
types: ["public", "private"]
|
|
recommendation: "Always use private subnets for databases and app servers"
|
|
security_list:
|
|
what: "Stateful firewall rules at subnet level"
|
|
recommendation: "Prefer NSGs (Network Security Groups) for granular control"
|
|
nsg:
|
|
what: "Network Security Group — firewall rules at VNIC level"
|
|
recommendation: "Preferred over security lists for micro-segmentation"
|
|
internet_gateway:
|
|
what: "Enables internet access for public subnets"
|
|
nat_gateway:
|
|
what: "Enables outbound internet for private subnets"
|
|
service_gateway:
|
|
what: "Private access to OCI services (Object Storage, ADB, etc.)"
|
|
recommendation: "Always use for database and storage access — no internet traversal"
|
|
drg:
|
|
what: "Dynamic Routing Gateway — hub for VCN peering and on-prem connectivity"
|
|
supports: ["VCN peering", "FastConnect", "IPSec VPN", "Remote peering"]
|
|
load_balancer:
|
|
types:
|
|
- name: "Flexible Load Balancer"
|
|
what: "Layer 7 (HTTP/HTTPS) load balancer"
|
|
bandwidth: "10 Mbps to 8 Gbps (flexible)"
|
|
- name: "Network Load Balancer"
|
|
what: "Layer 4 (TCP/UDP) load balancer"
|
|
bandwidth: "Up to line rate"
|
|
|
|
connectivity:
|
|
fastconnect:
|
|
what: "Dedicated private connection to OCI (like AWS Direct Connect)"
|
|
speeds: ["1 Gbps", "2 Gbps", "5 Gbps", "10 Gbps", "100 Gbps"]
|
|
redundancy: "Always deploy 2 circuits for HA"
|
|
notes: "Partner or co-location model, typical setup takes 2-4 weeks"
|
|
ipsec_vpn:
|
|
what: "Encrypted tunnel over internet"
|
|
bandwidth: "Up to 250 Mbps per tunnel, aggregate with multiple tunnels"
|
|
notes: "Good for dev/test or backup connectivity, not production data transfer"
|
|
vcn_peering:
|
|
local: "Within same region, no bandwidth limits"
|
|
remote: "Cross-region via DRG, standard inter-region latency"
|
|
|
|
pricing:
|
|
vcn: "Free"
|
|
subnet: "Free"
|
|
nat_gateway_per_hour: 0.0084
|
|
service_gateway: "Free"
|
|
drg_per_hour: 0.016
|
|
fastconnect:
|
|
port_per_month:
|
|
1gbps: 180
|
|
10gbps: 680
|
|
data_ingress: "Free"
|
|
data_egress: "Free over FastConnect"
|
|
load_balancer:
|
|
flexible_base: 0.014 # per hour
|
|
per_mbps: 0.0013
|
|
notes:
|
|
- "Inter-region data transfer: $0.0085/GB"
|
|
- "Internet egress: first 10 TB/month free, then $0.0085/GB"
|
|
- "OCI egress pricing is significantly cheaper than AWS/Azure/GCP"
|
|
|
|
gotchas:
|
|
- id: NET-001
|
|
issue: "VCN CIDR blocks cannot overlap for peering"
|
|
impact: "Plan CIDR ranges carefully for multi-VCN architectures"
|
|
recommendation: "Use a documented IP addressing scheme before deployment"
|
|
- id: NET-002
|
|
issue: "FastConnect provisioning takes 2-4 weeks with partners"
|
|
impact: "Can delay migration timelines"
|
|
recommendation: "Start FastConnect procurement early, use VPN as interim"
|
|
- id: NET-003
|
|
issue: "Security lists apply to entire subnet, NSGs to specific VNICs"
|
|
impact: "Security lists can be too broad for micro-segmentation"
|
|
recommendation: "Use NSGs as primary, security lists as fallback"
|