This image shows an Oracle Cloud Infrastructure region containing a hub VCN connected to two spoke VCNs through a pair of local peering gateways (LPGs).

The hub VCN has two subnets: a management subnet to which a bastion host is attached, and a services subnet with a service VM. Each spoke VCN has a workloads subnet containing a sample workload VM.

Each subnet has a security list and a route table. The hub VCN has two gateways: an internet gateway for connectivity to the public internet, and a dynamic routing gateway (DRG) for private connectivity with the on-premises network using Oracle Cloud Infrastructure FastConnect or IPSec VPN.