In this blog, we will demonstrate the steps to peer two VCNs in different regions through a DRG in the same tenancy. This is called a remote VCN peering.
The peering allows the VCNs' resources to communicate using private IP addresses without routing the traffic over the internet or through your on-premises network.
A remote peering connection (RPC) is a component you create on the DRG attached to your VCN. The RPC's job is to act as a connection point for a remotely peered VCN. A given DRG must have a separate RPC for each remote peering it establishes for the VCN.
At a high level, the networking service components required for this scenario include:
- Two VCNs with non-overlapping CIDRs, in different regions but same tenancy.
- Two dynamic routing gateways (DRG) attached to each peer VCN in the peering relationship.
- A remote peering connection (RPC) on each DRG in the peering relationship. And a connection between those two RPCs.
- Supporting route rules to enable traffic to flow over the connection between private subnets in the respective VCNs.
- Supporting security rules to control the types of traffic allowed to and from the instances in the private subnets.
|
|
VCN1 |
VCN2 |
|
Region |
Toronto (ca-toronto-1 |
Ashburn (us-ashburn-1) |
|
VCN Name |
TOR-VCN |
ASH-VCN |
|
Private
Subnet CIDR |
10.0.1.0/24 |
172.0.1.0/24 |
|
DRG |
TOR-DRG |
ASH-DRG |
|
RPC |
TOR-RPC |
ASH-RPC |
|
Compute
Instance |
TOR-VM (10.0.1.129) |
ASH-VM (172.0.1.132) |
- Prerequisites:
- An Oracle cloud fee trial or paid account.
- A VCN in Toronto region with private subnet, security list, and route table.
- A VCN in Ashburn region with private subnet, security list, and route table.
- Two dynamic routing gateways (DRG) attached to each peer VCN in the peering relationship.
- One OCI compute instance located in the first VCN’s private subnet with API RSA private key.
- One OCI compute instance located in the second VCN’s private subnet with API RSA private key.
Step #1: Attach DRG to VCNs
1. Attach TOR-DRG to TOR-VCN.
- Go to TOR-DRG detail page and click on "VCN attachments" tab.
- Click "Create virtual cloud network attachment" button.
Step #2: Create Remote Peering Connection (RPC)
1. Create Toronto region RPC (TOR-RPC).
- Click "Create remote peering connection" button.
- In "Create remote peering connection" page, enter connection name and select compartment.
Step #3: Establish RPC connection
Step #4: Configure route table in VCNs to send traffic destined to DRG attachment
- Go to TOR-VCN detail page and click on "Route Tables" tab.
- Under the list of route tables, click on "route table for private subnet-TOR-VCN".
- In route table page, click "Add Route Rules" button and enter below route rule information.
Target Type | Destination Type | Destination CIDR Block |
Dynamic Routing Gateway | CDIR Block | 172.0.1.64/24 (VCN2-private subnet CIDR) |
Target Type | Destination Type | Destination CIDR Block |
Dynamic Routing Gateway | CDIR Block | 10.0.1.0/24 (VCN1-private subnet CIDR) |
Step #5: Add security Ingress rule to allow traffic between VCNs' private subnets through DRG
- Go to TOR-VCN detail page and click on "security list" tab, then click on "security list for private subnet-TOR-VCN".
Source Type | Source CIDR | IP PROTOCOL |
CIDR | 172.0.1.0/24 (VCN2-private subnet CIDR) | All Protocols |
2. Add Ingress rule to "security list for private subnet-ASH-VCN" of the second VCN (ASH-VCN) to allow traffic coming from VCN1-private subnet to VCN2-private subnet.
- Repeat the same steps done above to add Ingress rule for VCN1, but use below Ingress rule.
Source Type | Source CIDR | IP PROTOCOL |
CIDR | 10.0.1.64/24 (VCN1-private subnet CIDR) | All Protocols |
Step #6: Test SSH connection between VMs
- ssh to opc@TOR-VM using OCI cloud shell tool. Use RSA private key which was generated while creating TOR-VM.
