Provision Private Connectivity from Oracle Integration to Oracle AI Database@Google Cloud

Oracle Integration can connect privately to an Oracle database delivered through a multicloud offering, such as Oracle AI Database@Google Cloud, by using an Oracle Integration Private Endpoint and Oracle Cloud Infrastructure (OCI) VCN peering.

No traffic traverses the public internet, a customer VPN, or a customer-managed cross-cloud interconnect. The entire path remains within the privately managed networks of Oracle and Google Cloud.

Although the database runs on Oracle-operated Exadata infrastructure in a Google Cloud data center (an OCI child site), it appears in your OCI tenancy as a native OCI resource. An Oracle-managed VCN in the paired OCI region (the parent site) provides access to the resource. Connecting Oracle Integration to the database uses a standard OCI networking pattern with an Oracle Integration Private Endpoint and VCN peering.

Architecture

This reference architecture covers two deployment topologies:
  • Same-region: Oracle Integration and the database are in the same OCI region and use local peering gateways (LPGs).
  • Cross-region: Oracle Integration is in a different OCI region from the database. Connectivity between the regions uses dynamic routing gateways (DRGs), a remote peering connection (RPC), and a hub VCN.

When you create an ODB network for Oracle AI Database@Google Cloud, you associate it with an existing Google Cloud VPC; creating the ODB client and backup subnets provisions the corresponding OCI VCN and subnet resources in the paired OCI region. The Exadata VM cluster uses the ODB network client subnet for private database connectivity, including SCAN listener addresses, while the backup subnet supports database backup traffic and related Oracle-managed services.

Oracle Integration is an Oracle-managed PaaS service that, by default, connects to targets over public endpoints. Enabling an Oracle Integration private endpoint establishes a private connection to a subnet in a VCN that you own. The connection to the database then requires OCI routing, security rules, and DNS.

The following diagrams show this reference architecture.

Same-region connectivity

This is the recommended topology. Deploy Oracle Integration in the same OCI region as the Oracle AI Database@Google Cloud deployment. A single LPG pairing provides private connectivity.


Description of same-region-connectivity-oi-od-gc.png follows
Description of the illustration same-region-connectivity-oi-od-gc.png

same-region-connectivity-oi-od-gc-oracle.zip#GUID-FD3CCC68-B705-46B7-939E-B7866C251E8D

  1. An integration invokes the Oracle AI Database adapter connection, which is configured to use the Oracle Integration Private Endpoint.
  2. Traffic exits through the Oracle Integration Private Endpoint, which has a private IP address in the PE subnet, for example, 10.0.1.0/24, of the customer VCN, for example, 10.0.0.0/16.
  3. The customer VCN LPG connects through the local peering configuration to the OCI VCN provisioned for the ODB network, for example, 10.50.0.0/16. The Oracle Integration-to-database path remains private over Oracle-managed multicloud networking and does not traverse the public internet.
  4. The connection reaches the SCAN listener in the client subnet, for example, 10.50.1.0/24, on port 1521 or port 1522 for TLS/TCPS.
  5. The SCAN listener directs the session to an Oracle RAC node on the Exadata VM cluster and provides instance-level and node-level failover during maintenance without downtime.

Cross-region connectivity

If your Oracle Integration instance is in a different OCI region from the Oracle AI Database@Google Cloud deployment, use a cross-region design. LPGs support peering only within one OCI region. Cross-region connectivity requires a customer-managed DRG in each region, an RPC between the DRGs, and a hub VCN in the database region.


Description of cross-region-connectivity-oi-od-gc.png follows
Description of the illustration cross-region-connectivity-oi-od-gc.png

cross-region-connectivity-oi-od-gc-oracle.zip#GUID-B8737CC1-438D-4546-89E4-80032B27C0A0

  1. Oracle Integration exits through its Private Endpoint in the customer VCN in Region A, the Oracle Integration region, as in the same-region design.
  2. The customer VCN is attached to DRG-A. Configure a route rule that directs traffic for the Oracle AI Database@Google Cloud ODB network client subnet CIDR to the DRG.
  3. DRG-A connects to DRG-B in Region B, the database home region, through an RPC. Traffic travels between regions entirely over a private network, without using the public internet.
  4. DRG-B routes traffic through the hub VCN, whose LPG connects through the service-supported local peering configuration to the OCI VCN provisioned for the Oracle AI Database@Google Cloud ODB network.
  5. Traffic reaches the SCAN listener on port 1521 or port 1522 and then the RAC cluster, as in the same-region flow.

This architecture has the following components:

  • Availability domain

    Availability domains are standalone, independent data centers within a region. The physical resources in each availability domain are isolated from the resources in the other availability domains, which provides fault tolerance. Availability domains don’t share infrastructure such as power or cooling, or the internal availability domain network. So, a failure at one availability domain shouldn't affect the other availability domains in the region.

  • Oracle Database Autonomous Recovery Service

    Oracle Database Autonomous Recovery Service is a fully managed service designed to protect Oracle AI Databases from data loss and cyber threats. It offers faster backups with reduced database overhead, reliable recovery with validated backups, and real-time protection enabling recovery to within less than a second of an outage or ransomware attack. This service provides a centralized data protection dashboard and is recommended for backing up Oracle AI Databases with high resiliency.

  • Compartment

    Compartments are cross-regional logical partitions within an OCI tenancy. Use compartments to organize, control access, and set usage quotas for your Oracle Cloud resources. In a given compartment, you define policies that control access and set privileges for resources.

  • Dynamic routing gateway (DRG)

    The DRG is a virtual router that provides a path for private network traffic between VCNs in the same region, between a VCN and a network outside the region, such as a VCN in another OCI region, an on-premises network, or a network in another cloud provider.

  • Oracle Exadata Database Service

    enables you to leverage the power of Exadata in the cloud. Oracle Exadata Database Service delivers proven Oracle AI Database capabilities on purpose-built, optimized Oracle Exadata infrastructure in the public cloud. Built-in cloud automation, elastic resource scaling, security, and fast performance for all Oracle AI Database workloads helps you simplify management and reduce costs.

  • Fault domain

    A fault domain is a grouping of hardware and infrastructure within an availability domain. Each availability domain has three fault domains with independent power and hardware. When you distribute resources across multiple fault domains, your applications can tolerate physical server failure, system maintenance, and power failures inside a fault domain.

  • Local peering

    Local peering allows two VCNs within the same OCI region to communicate directly using private IP addresses. This communication does not traverse the internet or your on-premises network. Local peering is enabled by a Local Peering Gateway (LPG), which serves as the connection point between VCNs. Configure an LPG in each VCN and establish a peering relationship to allow instances, load balancers, and other resources in one VCN to securely access resources in another VCN within the same region.

  • Network security group (NSG)

    NSGs act as virtual firewalls for your cloud resources. With the zero-trust security model of OCI you control the network traffic inside a VCN. An NSG consists of a set of ingress and egress security rules that apply to only a specified set of virtual network interface cards (VNICs) in a single VCN.

  • OCI DNS

    Oracle Cloud Infrastructure Domain Name System (DNS) service is a highly scalable, global anycast domain name system (DNS) network that offers enhanced DNS performance, resiliency, and scalability, so that end users connect to internet applications quickly, from anywhere.

  • OCI region

    An OCI region is a localized geographic area that contains one or more data centers, hosting availability domains. Regions are independent of other regions, and vast distances can separate them (across countries or even continents).

  • OCI virtual cloud network and subnet

    A virtual cloud network (VCN) is a customizable, software-defined network that you set up in an OCI region. Like traditional data center networks, VCNs give you control over your network environment. A VCN can have multiple non-overlapping classless inter-domain routing (CIDR) blocks that you can change after you create the VCN. You can segment a VCN into subnets, which can be scoped to a region or to an availability domain. Each subnet consists of a contiguous range of addresses that don't overlap with the other subnets in the VCN. You can change the size of a subnet after creation. A subnet can be public or private.

  • Oracle Integration

    Oracle Integration is a fully-managed, preconfigured environment that allows you to integrate cloud and on-premises applications, automate business processes, and develop visual applications. It uses an SFTP-compliant file server to store and retrieve files and allows you to exchange documents with business-to-business trading partners by using a portfolio of hundreds of adapters and recipes to connect with Oracle and third-party applications.

  • Oracle Services Network

    The Oracle Services Network (OSN) is a conceptual network on OCI that is reserved for Oracle services. These services have public IP addresses that you can reach over the internet. Hosts outside Oracle Cloud can access the OSN privately by using Oracle Cloud Infrastructure FastConnect or VPN Connect. Hosts in your VCNs can access the OSN privately through a service gateway.

  • Remote peering

    Remote peering enables private communication between resources in different VCNs, which can be located in the same or different OCI regions. Each VCN uses its own Dynamic Routing Gateway (DRG) for remote peering. The DRGs securely route traffic between the VCNs over OCI's private backbone, allowing resources to communicate using private IP addresses without routing traffic over the internet or through on-premises networks. Remote peering removes the need for internet gateways or public IP addresses for instances that need to connect across regions.

  • Route table

    Virtual route tables contain rules to route traffic from subnets to destinations outside a VCN, typically through gateways.

  • Security list

    For each subnet, you can create security rules that specify the source, destination, and type of traffic that is allowed in and out of the subnet.

Recommendations

Use private endpoints, private routing, and DNS resolution to connect Oracle Integration to Oracle AI Database@Google Cloud.
  • Customer-managed VCN and private endpoint subnet: Provision a VCN and a private subnet that you manage to host the Oracle Integration private endpoint. Use regional subnets and attach resources with the same role to the same subnet.
  • VCN peering: For same-region connectivity, attach an LPG to the customer VCN and pair it with the peer LPG on the ODB VCN. For cross-region connectivity, attach a DRG to the customer VCN, establish an RPC to a DRG in the database home region, and bridge to the ODB VCN through a hub VCN.
  • Route tables and security rules: Route the ODB VCN CIDR through the LPG or DRG and configure the return route to the private endpoint subnet. Prefer network security groups scoped to the private endpoint and database over broad security lists.
  • TCPS and DNS: Prefer TCPS on port 1522. Before deploying to production, confirm that the customer VCN DNS resolver resolves the database SCAN FQDN to its private IP addresses.
  • Nonoverlapping CIDR blocks: CIDR ranges must not overlap between the customer VCN, the hub VCN, and ODB VCN subnets.
  • High availability: Place Oracle Integration in the same OCI region as the OCI region to which the database is anchored to use same-region LPG peering. Otherwise, plan for DRG remote peering.

Considerations

Consider private endpoint constraints, security, scaling, monitoring, and backup behavior when deploying this reference architecture.
  • Private endpoint: You can create one Oracle Integration private endpoint for each instance. You cannot modify the private endpoint after you create it. To change its VCN or subnet, delete and re-create the private endpoint.
  • Adapter support: Private endpoints support only selected adapters. Confirm that your target supports private endpoints.
  • Security: Use TCPS and configure the connection with a database wallet or certificate. Use OCI Identity and Access Management policies and a least-privilege database schema or user.
  • LPG limits and scale: Pairwise peering does not scale. Use a hub VCN when Oracle Integration must reach many databases in multiple ODB VCNs.
  • Monitoring and backups: Set up monitoring and alerts for connectivity and throughput. Backup traffic uses the ODB VCN backup subnet and does not pass through the customer VCN.

    In Oracle AI Database@Google Cloud, the database runs in Oracle-managed infrastructure colocated in Google Cloud, but the Oracle-managed database backup service is an OCI service. The supported managed destinations are Oracle Database Autonomous Recovery Service (in Google Cloud or OCI), or OCI Object Storage.

Deploy

Configure private routing, a private endpoint, DNS, and an adapter connection between Oracle Integration and Oracle AI Database@Google Cloud.

Sign in to the OCI Console with your Oracle Cloud credentials.

  1. Confirm that the Oracle AI Database@Google Cloud database and its auto-created ODB VCN with client and backup subnets are visible in your OCI tenancy.
  2. Provision the customer-managed VCN and private endpoint subnet with the NSG, route table, and DNS resolver prerequisites.
  3. Establish the peering. For same-region connectivity, pair the customer VCN LPG with the ODB VCN peer LPG. For cross-region connectivity, connect DRGs with an RPC and bridge to the ODB VCN through the hub VCN.
  4. Configure route rules for the ODB network client subnet CIDR and corresponding return routes for the Oracle Integration private endpoint subnet.
  5. Create the private endpoint from the Oracle Integration instance, selecting the customer VCN and private endpoint subnet.
  6. Validate that the database SCAN FQDN resolves to its private IPs from the customer VCN resolver.
  7. Create an Oracle Integration connection using a private-endpoint-supported adapter. Provide the SCAN FQDN, service name, port 1522 for TLS, and credentials or wallet.
  8. Test the connection.

    Outbound calls flow privately from Oracle Integration to the database SCAN and RAC nodes.

Explore More

Use these resources to learn more about private connectivity from Oracle Integration to Oracle AI Database@Google Cloud.

Acknowledgments

  • Authors: Dilip Kumar Panchali, Achinthya Gopinath
  • Contributors: Sujit Nair, Robert Lies