The image shows an Oracle Cloud Infrastructure region with a series of virtual cloud networks (VCNs) in a hub and spoke arrangement. Internet users and third-party clouds connect to the hub VCN by using an internet gateway. On-premises users connect to VCNs in the region by using Oracle Cloud Infrastructure FastConnect or an IPSec tunnel and a dynamic routing gateway (DRG). In this diagram, north-south traffic includes all external, incoming traffic and east-west traffic includes all traffic between VCNs.

The region provides the following services:

Oracle Cloud Infrastructure Audit
Oracle Cloud Infrastructure Identity and Access Management
Oracle Cloud Infrastructure Logging
Oracle Cloud Infrastructure Object Storage
VCN Flow Logs

The hub VCN spans 3 availability domains (ADs). It includes an internet gateway to provide communications between public subnets and internet hosts and a service gateway to provide VCNs with services such as object storage over the Oracle network fabric without traversing the internet.

The hub VCN provides 5 subnets and 2 FortiGate instances to handle public traffic between public and private subnets.

Load balancer public subnet: Includes a load balancer in AD 1 to distribute traffic from the internet gateway to the FortiGate instances.
Untrusted private subnet: The FortiGate instances span this subnet and the trusted private subnet.
Trusted private subnet: The FortiGate instances span this subnet and the untrusted private subnet. This subnet also provides a load balancer in AD 1 to distribute traffic to the web servers in AD 1 and AD 2.
Web server private subnet: Includes web servers in AD 1 and AD 2.
Database private subnet: Includes Autonomous Database in AD 1, Oracle Database in AD 2, and Oracle Exadata Database Service in AD 3.

Three spoke VCNs are shown, each housing an application. They are connected to each other and to the hub VCN by using the DRG.