Setting Up Site-to-Site VPN

Here's an example diagram for task 1 that uses BGP dynamic routing:

Here's an example diagram for task 1 that uses static routing:

Callout 1: Default subnet route table

Destination CIDR	Route target
10.0.0.0/16	DRG

Callout 2: security list

Destination CIDR	Permission
10.0.0.0/16	Allowed

Callouts 3 to 6

Callout	Function	IP
3	CPE public IP address	142.34.145.37
4	Static route for IPSec Connection	10.0.0.0/16
5	Tunnel 1 Oracle VPN IP Address:	129.213.240.50
6	Tunnel 2 Oracle VPN IP Address:	129.213.240.53

If you already have a VCN, skip to the next task.

See Creating a VCN for detailed steps on creating a VCN in the Console.

Ensure that the VCN is done provisioning before you continue. In this example, we're using 172.16.0.0/16 as the CIDR for the VCN, but what you select doesn't matter so long as it's consistent.

See Creating a DRG for detailed steps on creating a DRG.

The DRG is created and displayed on the page. Ensure that it's done being provisioned before continuing.

See Attaching a DRG to a VCN for detailed steps on attaching a DRG to a VCN.

The attachment is in the Attaching state for a short period before it's ready.

Although the VCN comes with a default route table (without any rules), in this task you create a custom VCN route table with a route rule for the DRG as target. In this example, the on-premises network is 10.0.0.0/16. You create a route rule that takes any traffic destined for 10.0.0.0/16 and routes it to the DRG. When you create a subnet in task 2f, you associate this custom route table with the subnet.

See Creating a VCN Route Table for detailed steps on creating VCN route tables in the Console. Use the following settings for the route rule:

• Target Type: Dynamic Routing Gateway. The VCN's attached DRG is automatically selected as the target, and you don't have to specify the target yourself.
• Destination CIDR Block: The CIDR for the on-premises network (10.0.0.0/16 in this example).

The route table is created and displayed on the page. However, the route table doesn't do anything unless you associate it with a subnet during subnet creation (see task 2f).

By default, incoming traffic to the instances in a VCN is set to DENY on all ports and all protocols. In this task, you set up two ingress rules and one egress rule to allow basic required network traffic. A VCN comes with a default security list with a set of default rules. However, in this task you create a separate security list with a more restrictive set of rules focused on traffic with an on-premises network. When you create a subnet in task 2f, you associate this security list with the subnet.

See Creating a Security List for detailed information on creating a security list in a VCN using the Console.

1. Add an ingress rule with the following values, which allows incoming SSH on TCP port 22 from an on-premises network:

   • Source Type: CIDR
   • Source CIDR: The CIDR for an on-premises network (10.0.0.0/16 in this example)
   • IP Protocol: TCP.
   • Source Port Range: Leave as is (the default All).
   • Destination Port Range: 22 (for SSH traffic).
   • Description: An optional description of the rule.

2. Add an egress rule with the following values, which allows outgoing TCP traffic on all ports to an on-premises network:

   • Destination Type: CIDR
   • Destination CIDR: The CIDR for an on-premises network (10.0.0.0/16 in this example).
   • IP Protocol: TCP.
   • Source Port Range: Leave as is (the default All).
   • Destination Port Range: Leave as is (the default All).
   • Description: An optional description of the rule.

When the security list is created it displays on the page. However, the security list doesn't do anything unless you associate it with a subnet during subnet creation (see task 2f).

In this task, you create a subnet in the VCN. Typically a subnet has a CIDR block smaller than the VCN's CIDR. Any instances that you create in this subnet have access to an on-premises network. We recommend using regional subnets. Here you create a regional private subnet.

See Creating a Subnet for detailed information on creating a subnet a VCN using the Console. Use the following values:

• Regional or AD-specific subnet: Select the radio button for Regional. We recommend using regional subnets.
• CIDR Block: A single, contiguous CIDR block for the subnet (for example, 172.16.0.0/24). It must be within the cloud network's CIDR block and can't overlap with any other subnets. You can't change this value later. See Allowed VCN Size and Address Ranges. For reference, use a CIDR calculator.
• Route Table: The route table that you created in task 2d.
• Private Subnet: Select this option. For more information, see Access to the Internet.
• Use DNS Hostnames in this Subnet: Leave as is (selected).
• DHCP Options: The set of DHCP options to associate with the subnet. Select the default set of DHCP options for the VCN.
• Security Lists: The security list that you created earlier.

The subnet is created and displayed on the page. The basic VCN in this example is now set up, and you're ready to create the remaining components for Site-to-Site VPN.

In this task you create the CPE object, which is a virtual representation of an actual CPE device. The CPE object exists in a compartment in a tenancy. When you configure Site-to-Site VPN you need to change the configuration of the actual edge device for the on-premises network to match the configuration of the CPE object.

See Creating a CPE for detailed steps on creating a CPE object. In this example the most important IP address to provide is 142.34.145.37, the public or private IP address of the physical CPE device.

In this task, you create the IPSec tunnels and configure the type of routing for them (BGP dynamic routing, static routing, or policy-based routing). See Creating an IPSec Connection for detailed steps.

Use the CPE Configuration Helper to generate configuration content that the network engineer can use to configure the CPE.

The content includes these items:

• For each IPSec tunnel, the Oracle VPN IP address and shared secret.
• The supported IPSec parameter values.
• Information about the VCN.
• CPE-specific configuration information.

For more information, see Using the CPE Configuration Helper.

Provide the network engineer with the following items:

• The content generated by the CPE Configuration Helper.
• The general IPSec parameters that Oracle supports.

After the network engineer configures the CPE device, you can confirm that the tunnel's IPSec status is Up and green. Next, you can create a Linux instance in the subnet in a VCN. Then use SSH to connect to the instance's private IP address from a host in the on-premises network. For more information, see Creating an Instance.