This image shows the east-west traffic flow from the web/application to the database in a regional hub and spoke topology that uses Check Point CloudGuard Network Security. It includes 3 virtual cloud networks (VCNs):

• Hub VCN (10.0.0.0/24): The Hub VCN houses the Check Point Security Gateway. The backend subnet uses vNIC2 for internal traffic to or from the Check Point Security Gateway. The hub VCN communicates with spoke VCNs through a local peering gateway (LPG).

• Web/Application tier spoke VCN (192.168.0.0/24): The VCN contains a single subnet. A load balancer manages traffic to the web/application VMs. The application tier VCN is connected to the hub VCN over a local peering gateway.

• Database tier spoke VCN (192.168.1.0/24): The VCN contains a single subnet that contains the primary database system. The database tier VCN is connected to the hub VCN over a local peering gateway.

East-west traffic flow from the web/application to the database:

1. Traffic that moves from the web/application tier to the database tier (192.168.1.10) is routed through the web/application subnet route table (destination 0.0.0.0/0).
2. Traffic moves from the web/application subnet route table to the LPG for the web/application tier spoke VCN.
3. Traffic moves from the web/application LPG to the LPG for the hub VCN (destination 0.0.0.0/0).
4. Traffic moves from the hub LPG to the Check Point Security Gateway in the backend subnet over vNIC2.
5. Traffic from the Check Point Security Gateway is routed through the backend subnet route table (destination 192.168.0.0/16).
6. Traffic moves from the backend subnet route table to the LPG for the hub VCN (destination 0.0.0.0/0).
7. Traffic moves from the hub LPG to the LPG for the database tier spoke VCN.
8. Traffic moves from the database LPG to the database system.