forked from diegoecab/oci-deal-accelerator
87 lines
3.0 KiB
YAML
87 lines
3.0 KiB
YAML
# Pattern: Hub-Spoke Network Topology via DRG
|
|
# Composable architecture block for enterprise networking
|
|
|
|
pattern:
|
|
name: "Hub-Spoke Network via DRG"
|
|
id: hub_spoke_drg
|
|
category: networking
|
|
|
|
description: |
|
|
Hub-spoke topology using OCI Dynamic Routing Gateway (DRG) v2 as the central
|
|
routing hub. Spoke VCNs attach to the DRG for inter-VCN routing, on-premises
|
|
connectivity (FastConnect/VPN), and centralized security inspection.
|
|
|
|
topology:
|
|
hub:
|
|
components:
|
|
- "DRG (Dynamic Routing Gateway) — central router"
|
|
- "Hub VCN (optional) — for shared services, Network Firewall, Bastion"
|
|
- "Service Gateway — OCI service access without internet"
|
|
- "NAT Gateway — outbound internet for private subnets"
|
|
- "Network Firewall (optional) — deep packet inspection, IDS/IPS"
|
|
spokes:
|
|
components:
|
|
- "Spoke VCN per workload/environment"
|
|
- "VCN attachment to DRG"
|
|
- "Route table on DRG attachment for traffic steering"
|
|
|
|
use_when:
|
|
- "Multiple workloads or environments needing isolation"
|
|
- "On-premises connectivity via FastConnect or VPN"
|
|
- "Centralized security inspection required"
|
|
- "Shared services (Bastion, DNS, NTP) across workloads"
|
|
- "Enterprise landing zone deployment"
|
|
|
|
when_not_to_use:
|
|
- "Single VCN deployment (no need for hub-spoke complexity)"
|
|
- "< 3 VCNs and no on-prem connectivity"
|
|
- "POC or dev-only environment"
|
|
|
|
preconditions:
|
|
- "DRG v2 (default in all regions)"
|
|
- "Non-overlapping CIDR ranges across VCNs"
|
|
- "Sufficient IP address planning"
|
|
|
|
implied_services:
|
|
- service: drg
|
|
reason: "Central routing hub"
|
|
- service: vcn
|
|
reason: "Hub and spoke VCNs"
|
|
- service: service_gateway
|
|
reason: "OCI service access"
|
|
- service: nat_gateway
|
|
reason: "Outbound internet for private subnets"
|
|
- service: route_tables
|
|
reason: "Traffic steering via DRG attachments"
|
|
|
|
optional_services:
|
|
- service: network_firewall
|
|
when: "Deep packet inspection, IDS/IPS required"
|
|
placement: "Hub VCN, inline between DRG and spokes"
|
|
- service: fastconnect
|
|
when: "On-premises connectivity"
|
|
- service: vpn
|
|
when: "Backup connectivity or lower-cost option"
|
|
|
|
conflicts:
|
|
- pattern: "local_peering"
|
|
reason: "DRG replaces local peering for inter-VCN routing. Don't mix both."
|
|
|
|
cidr_guidance:
|
|
- "Use /16 per VCN for growth headroom"
|
|
- "Use /24 per subnet (251 usable IPs)"
|
|
- "Reserve /8 or /12 supernet for all OCI CIDRs"
|
|
- "Avoid overlapping with on-prem ranges"
|
|
- "Example: 10.0.0.0/16 (hub), 10.1.0.0/16 (spoke 1), 10.2.0.0/16 (spoke 2)"
|
|
|
|
cost_impact:
|
|
- "DRG: free (no charge for the gateway itself)"
|
|
- "VCN peering via DRG: no data transfer charges within same region"
|
|
- "Cross-region via DRG: data transfer charges apply"
|
|
- "Network Firewall: per-hour + per-GB processing"
|
|
- "FastConnect: port fee + data transfer (inbound free)"
|
|
|
|
references:
|
|
- "https://docs.oracle.com/en-us/iaas/Content/Network/Tasks/managingDRGs.htm"
|
|
- "https://docs.oracle.com/en/solutions/hub-spoke-network-drg/"
|