Note:

Secure your Oracle Cloud VMware Solution workloads with Oracle Cloud Infrastructure Network Firewall

Introduction

This document covers how you can use Oracle Cloud Infrastructure (OCI) Network Firewall to secure your workloads running in an Oracle Cloud VMware Solution. Oracle Cloud VMware Solution allows you to create and manage VMware Software-Defined Data Center (SDDCs) in OCI.

OCI Network Firewall can be deployed as a Distributed model or a Transit model. In this tutorial, we will deploy Transit model, where the Network Firewall is in Hub VCN, Oracle Cloud VMware Solution SDDC in a spoke VCN. Using Intra-VCN and Ingress routing capabilities of OCI Networking, you can inspect the traffic via Network Firewall running in Hub VCN.

Note: Even though this tutorial showcases OCI Network Firewall, most of the concepts should apply to any other 3rd party appliances like Fortinet, Palo Alto Networks, Cisco, Check Point, and more. The customer needs to work with the specific vendor/partner to make sure it is supported by the vendor.

Use Cases

OCI Intra VCN routing capabilities give us the simplicity of configuring routing to support OCI workload traffic within VCNs and you can also use a Firewall to inspect/secure your traffic. We will be using Intra-VCN and ingress routing capabilities which include:

In this tutorial, we will validate different traffic scenarios and OCI Network Firewall supported key features:

Note: You cannot inspect the east-west traffic within NSX workload VMs using the Transit model. If you want to inspect that traffic, it is recommended to deploy 3rd Party Partner solution within the Oracle Cloud VMware Solution environment, which is not covered in this tutorial.

Objective

This tutorial describes OCI Intra-VCN Routing capability with OCI Network Firewall solution in an Oracle Cloud VMware solution environment. We have covered the Virtual Cloud Networking Routing use case which simplifies your Firewall deployment on OCI.

Prerequisites

Note: In a production environment, you must deploy Firewalls in high availability.

Architecture

You can refer to the following topology to support this use case.

Figure 1

Task 1: Configure OCI Network Firewall

The following sections showcase the minimum required configuration of OCI Network Firewall. For more advanced configurations, refer to the official documentation.

  1. VCN Subnets and VLANs: The first step is to make sure you have created required VCNs and subnets as described in the Prerequisites section to support your use case topology.

    • You can verify them using OCI Console by navigating to Virtual Cloud Networks, Virtual Cloud Network Details, Resources.

      • Firewall-Subnet-IAD subnet to support Network Firewall in Hub-VCN
      • Public-Bastion-Subnet-IAD, JumpHost-Subnet-IAD subnets in Hub-VCN to support VMs for traffic validations
      • DB-Subnet-IAD subnet in DB-Spoke-VCN-IAD VCN to support DB workloads
      • During the deployment of Oracle Cloud VMware Solution SDDC, appropriate Subnet and VLANs must have been created

    • The following image shows Hub-VCN (Firewall-VCN-IAD) and associated subnets.

      Figure 2

    • Next, you need to deploy OCI Network firewall deployed in firewall-subnet. For more information follow the official documentation.

  2. OCI Network Firewall Policy Rules: Ensure required firewall security rules are added to support use case traffic. For more information on how to configure rules, follow the official documentation.

    Figure 3

  3. OCI Network Firewall: In the Hub-VCN, deploy the Network firewall as per prerequisites. Once your Firewall VM is active, use that to secure your traffic.

    Figure 4

  4. Route tables for VCN, Subnets, VLANs and DRG Attachments: You would need to configure the route tables to reflect the correct route rules for the use-case topology. At a high level, you would need to modify the route tables in the VCNs as follows:

    • Firewall-VCN

      • Firewall Subnet Route Table: Create entries with each subnet CIDR as the destination and the target as an internet gateway, nat gateway, service gateway, or DRG.
      • Public Bastion Subnet Route Table: Create entries with each subnet CIDR as the destination and the target as the network firewall IP address.
      • Private JumpHost Subnet Route Table: Create entries with each subnet CIDR as the destination and the target as the network firewall IP address.
      • VCN Ingress Route Table: Create entries with each destination CIDRs and the target as firewall IP address to inspect the traffic from Spoke VCNs.

    • Oracle Cloud VMware Solution VCN

      • Subnet SDDC Route Table: Create entries with each subnet CIDR as the destination and the target as DRG.
      • vSphere VLAN Route Table: Create entries with each subnet CIDR as the destination and the target as DRG.
      • NSX Edge Uplink 1 VLAN Route Table: Create entries with each subnet CIDR as the destination and the target as DRG.
      • VCN Ingress Route Table: Create entries with each destination Overlays CIDRs and the target as NSX-EDGE-UPLINK IP address to ensure traffic returns to overlay hosts.

    • DB VCN

      • DB Subnet Route Table: Create entries with each subnet CIDR as the destination and the target as DRG to inspect traffic via OCI Network Firewall.

    • DRG VCNs Attachment

      • Firewall-VCN Attachment Route Table: Create entries with each NSX workload CIDRs as the destination and the next hop as Oracle Cloud VMware Solution VCN attachment. Import Route Distribution with Oracle Cloud VMware Solution and DB VCN matched criteria.
      • Oracle Cloud VMware Solution-VCN Attachment Route Table: Create entries with each subnet CIDR as the destination and the target as Firewall-VCN Attachment to inspect traffic via OCI Network Firewall.
      • DB Attachment Route Table: Create entries with each subnet CIDR as the destination and the next hop as Firewall-VCN Attachment to inspect traffic via OCI Network Firewall.

Note: Ensure that route symmetry is used so traffic is inspected properly in both directions.

Task 2: Validate and inspect traffic from the OCI Network Firewall

At this point, you can validate the traffic from the JumpHost Windows VM, Bastion VM, Oracle Cloud VMware Solution SDDC environment, NSX Overlay VMs, and DB Spoke VM and inspect the traffic from the OCI Network Firewall. The following image shows the required VMs running as per the use case topology.

Figure 5

Figure 6

North-South traffic inspection from JumpBox Windows VM to NSX Overlay VMs via Intra-VCN Routing (IVR)

North-South traffic inspection from NSX Overlay VM to the Internet via Network Gateway Ingress Routing

East-West traffic inspection from JumpBox Windows VM to vCenter via Intra-VCN Routing (IVR)

East-West traffic inspection from DB Spoke VM and ESXi Host and vice-versa

IPS/IDS, URL filtering, SSL forward proxy and SSL inbound Inspection Traffic from NSX Overlay VMs to the internet via Inter-VCN Routing

IPS/IDS

URL Filtering

SSL Forward Proxy & SSL Inbound Inspection

Acknowledgements

Authors:

More Learning Resources

Explore other labs on docs.oracle.com/learn or access more free learning content on the Oracle Learning YouTube channel. Additionally, visit education.oracle.com/learning-explorer to become an Oracle Learning Explorer.

For product documentation, visit Oracle Help Center.