8 Create a Virtual Cloud Network in Oracle Cloud Infrastructure
Complete the Prerequisites
Before you create the Oracle Cloud Infrastructure VCN, you should do the following.
- Review the Oracle Cloud Infrastructure Compute Classic Architecture
- Understand the Oracle Cloud Infrastructure Network Resources
- You should be familiar with the fundamentals of networking in Oracle Cloud Infrastructure. For information about setting up a cloud network in Oracle Cloud Infrastructure, see:
- Oracle Cloud Infrastructure Classic Discovery and Translation Tool can help you to identify and filter information about the networking resources in your Oracle Cloud Infrastructure Compute Classic environment. If you use this tool to identify resources in your Oracle Cloud Infrastructure Compute Classic account, then you can use the reports generated by this tool to help design and set up the networking objects in your Oracle Cloud Infrastructure tenancy. You should be familiar with this tool and its commands and options. For information about using this tool, see Identify and Translate Resources in Your Source Environment.
- The Terraform configurations generated by Oracle Cloud Infrastructure Classic Discovery and Translation Tool can be used to automate the set up of resources in your Oracle Cloud Infrastructure tenancy. To use Terraform to apply those configurations in the target environment, you should be familiar with Terraform.
- Before you apply the Terraform configuration, you'll need to create a compartment in your Oracle Cloud Infrastructure tenancy. It's strongly recommended that you create a new compartment dedicated to the migration process. Don't use the root compartment for migration.
Considerations for Migrating Your Network
You must carefully consider several aspects of your network design when you migrate your network from Oracle Cloud Infrastructure Compute Classic to Oracle Cloud Infrastructure.
Public IP Addresses
When you migrate your network, some network configuration might change. For example, the public IP addresses associated with your instances on Oracle Cloud Infrastructure Compute Classic can't be reused on Oracle Cloud Infrastructure. This is because the range of public IP addresses available in both services is different. Evaluate the impact of this change on your applications and architecture before you start your migration.
Security Rules
You'll see some changes is in the way security rules are designed and applied in Oracle Cloud Infrastructure compared to Oracle Cloud Infrastructure Compute Classic.
- In Oracle Cloud Infrastructure Compute Classic, if you use IP networks, then security rules are applied to groups of vNICs called vNICsets. If you use the shared network, security rules are applied to a set of instance interfaces that are members of a security list.
- In Oracle Cloud Infrastructure, using network security groups (NSGs) allows you to specify a set of vNICs in a VCN and apply a set of security rules to these vNICs.
- NSGs, however, are only scoped to affect vNICs within the same VCN. NSGs don't affect vNICs in peered VCNs and NSG security rules can't reference NSGs from peered VCNs. If your IP networks are migrated as separate but connected VCNs, the Terraform configuration generated by Oracle Cloud Infrastructure Classic Discovery and Translation Tool sets up VCN peering along with the required security lists and security rules to provide that connectivity. For more information about NSGs and NSG security rules, see Network Security Groups in the Oracle Cloud Infrastructure documentation.
- When you use the Terraform configuration generated by Oracle Cloud Infrastructure Classic Discovery and Translation Tool to migrate your network, your network is migrated as follows:
- If you have multiple IP networks connected with an IP network exchange:
- If the address ranges of all the IP networks can be expressed as a single CIDR address range no larger than /16, then your network is migrated as a single VCN in Oracle Cloud Infrastructure, with the appropriate NSGs and NSG security rules to permit and restrict traffic between sets of vNICs in the VCN.
- If the address ranges of all IP networks can't be expressed as a single /16 CIDR address range, then:
- The IP networks are migrated to separate VCNs.
- In this case, NSG security rules can't be used to permit and restrict traffic between sets of vNICs in different VCNs. Security lists and security rules are created to permit or restrict traffic between instances in a VCN.
- Connectivity across the VCNs is implemented using LPGs.
- If you have multiple IP networks that aren't connected with an IP network exchange, then each IP network is migrated as a separate VCN, with the appropriate NSGs and NSG security rules to permit and restrict traffic between sets of vNICs within each VCN.
- If you have multiple IP networks connected with an IP network exchange:
Multiple vNICs
If instances in your Oracle Cloud Infrastructure Compute Classic account have multiple vNICs:- You might need to use a different instance shape in Oracle Cloud Infrastructure to support multiple vNICs. Smaller shapes support a smaller number of vNIC attachments. Depending on the number vNICs required, the instances shape (OCPU count) may need to be increased. See Map Oracle Cloud Infrastructure Compute Classic Instance Shapes to Oracle Cloud Infrastructure Shapes.
- Launch the instance with the primary vNIC on the appropriate primary subnet. If you use the Terraform configuration generated by Oracle Cloud Infrastructure Classic Discovery and Translation Tool to launch your instances, this is done automatically.
- Additional vNICs must be attached as secondary vNICs after the instance is launched. See https://docs.cloud.oracle.com/iaas/Content/Network/Tasks/managingVNICs.htm. If you use the Terraform configuration generated by Oracle Cloud Infrastructure Classic Discovery and Translation Tool to launch your instances, the additional vNICs are attached automatically.
Migrate the Shared Network
If your source environment uses the shared network, then your network is migrated to Oracle Cloud Infrastructure with a single VCN that has a single subnet.
--shared-network-prefix
option to specify the IP address range for private IP addresses. Primary private IP addresses are persistent in Oracle Cloud
Infrastructure.
To migrate your shared network to the target environment use Oracle Cloud Infrastructure Classic Discovery and Translation Tool. This tool simplifies the process of setting up your network in Oracle Cloud Infrastructure. You can use this tool to discover all the security rules applied to each security list in your source environment. You can then generate a Terraform module to create a VCN, subnet, network security groups (NSGs) and NSG security rules for your shared network.
opcmigrate discover
command before you run the following commands.
Migrate IP Networks
If your source environment uses IP networks, then, to recreate your network in the target environment using network security groups (NSGs), you can use Oracle Cloud Infrastructure Classic Discovery and Translation Tool.
opcmigrate discover
command before you run the following commands.
Connect VCNs Using Local Peering Gateways
VCN peering can be required when you migrate multiple IP networks connected to an IP network exchange. If you use the Terraform configuration generated by Oracle Cloud Infrastructure Classic Discovery and Translation Tool to migrate your network, VCN peering is set up automatically when required.
VCN peering involves the following steps:
- Create local peering gateways (LPGs) in each VCN.
- Establish the connection.
- Update route tables to enable traffic between the peered VCNs as desired.
- Update security lists to enable traffic between the peered VCNs as desired.
For example, if you belong to the NetworkAdmin
group or the Administrators
group, you might have either of the following policies already in place:
Allow group NetworkAdmin to manage virtual-network-family in tenancy
Or:
Allow group Administrators to manage all-resources in tenancy
If you need to set up IAM policies required for this task, or for more information about VCN peering concepts and procedures, see Local VCN Peering in the Oracle Cloud Infrastructure documentation.
To set up VCN peering using the Console: