Set Up a Hub-and-Spoke Network Topology Using a Dynamic Routing Gateway
A hub-and-spoke network, also called a star network, has a central component that's connected to multiple networks around it. Setting up this topology in the traditional on-premises data center can be expensive. But in the cloud, there’s no extra cost.
The dynamic routing gateway (DRG) is a virtual router that provides a path for private network traffic between a virtual cloud network (VCN) and a network outside the region, such as a VCN in another Oracle Cloud Infrastructure (OCI) region, an on-premises network, or a network from another cloud provider.
The DRG can connect to multiple VCNs, adding flexibility to how you design your cloud network.
- Isolate the workloads of different customers, such as the subscribers of an independent software vendor (ISV).
- Provide shared services such as log server, domain name system (DNS), and file sharing from a central network.
- Extend Oracle Cloud Infrastructure connectivity to multicloud environments using OCI FastConnect partners.
- Set up separate development and production environments.
- Segregate environments to meet compliance requirements, such as payment card industry (PCI) and Health Insurance Portability and Accountability Act (HIPAA) requirements.
Architecture
A dynamic routing gateway (DRG) allows you to connect up to 300 virtual cloud networks (VCNs) and helps to simplify the overall architecture, security list and route table configuration, and to simplify security policy management by advertising Oracle cloud indentifiers (OCIDs) through the DRG.
In this architecture, a dynamic routing gateway is connected to multiple VCNs. There are sample subnets and virtual machines (VMs) in each VCN. The DRG has a route table that specifies rules to direct traffic to targets outside the VCN. The DRG enables private connectivity with an on-premises network, which you can implement by using Oracle Cloud Infrastructure FastConnect, Oracle Cloud Infrastructure Site-to-Site VPN, or both. The DRG also enables you to connect to multiple cloud environments using a OCI FastConnect partner.
You can use either Oracle Cloud Infrastructure Bastion or a Bastion host to provide secure access to your resources. This architecture uses OCI Bastion.
The following diagram illustrates this reference architecture.
Description of the illustration hub-and-spoke-drg.png
The architecture has the following components:
- On-premises network
This is a local network used by your organization.
- OCI region
An OCI region is a localized geographic area that contains one or more data centers, hosting availability domains. Regions are independent of other regions, and vast distances can separate them (across countries or even continents).
- OCI virtual cloud
network and subnet
A virtual cloud network (VCN) is a customizable, software-defined network that you set up in an OCI region. Like traditional data center networks, VCNs give you control over your network environment. A VCN can have multiple non-overlapping classless inter-domain routing (CIDR) blocks that you can change after you create the VCN. You can segment a VCN into subnets, which can be scoped to a region or to an availability domain. Each subnet consists of a contiguous range of addresses that don't overlap with the other subnets in the VCN. You can change the size of a subnet after creation. A subnet can be public or private.
- Security list
For each subnet, you can create security rules that specify the source, destination, and type of traffic that is allowed in and out of the subnet.
- Network security group
(NSG)
NSGs act as virtual firewalls for your cloud resources. With the zero-trust security model of OCI you control the network traffic inside a VCN. An NSG consists of a set of ingress and egress security rules that apply to only a specified set of virtual network interface cards (VNICs) in a single VCN.
- Route table
Virtual route tables contain rules to route traffic from subnets to destinations outside a VCN, typically through gateways.
- Dynamic routing gateway
(DRG)
The DRG is a virtual router that provides a path for private network traffic between VCNs in the same region, between a VCN and a network outside the region, such as a VCN in another OCI region, an on-premises network, or a network in another cloud provider.
- OCI Site-to-Site VPN
OCI Site-to-Site VPN provides IPSec VPN connectivity between your on-premises network and VCNs on OCI. The IPSec protocol suite encrypts IP traffic before the packets are transferred from the source to the destination and decrypts the traffic when it arrives.
- OCI FastConnect
Oracle Cloud Infrastructure FastConnect creates a dedicated, private connection between your data center and OCI. FastConnect provides higher-bandwidth options and a more reliable networking experience when compared with internet-based connections.
- OCI Bastion
Oracle Cloud Infrastructure Bastion provides restricted and time-limited secure access to resources that don't have public endpoints and that require strict resource access controls, such as bare metal and virtual machines, Oracle MySQL Database Service, Autonomous Transaction Processing (ATP), Oracle Cloud Infrastructure Kubernetes Engine (OKE), and any other resource that allows Secure Shell Protocol (SSH) access. With OCI Bastion service, you can enable access to private hosts without deploying and maintaining a jump host. In addition, you gain improved security posture with identity-based permissions and a centralized, audited, and time-bound SSH session. OCI Bastion removes the need for a public IP for bastion access, eliminating the hassle and potential attack surface when providing remote access.
- Bastion host
The bastion host is a compute instance that serves as a secure, controlled entry point to the topology from outside the cloud. The bastion host is provisioned typically in a demilitarized zone (DMZ). It enables you to protect sensitive resources by placing them in private networks that can't be accessed directly from outside the cloud. The topology has a single, known entry point that you can monitor and audit regularly. So, you can avoid exposing the more sensitive components of the topology without compromising access to them.
- OCI Compute
With Oracle Cloud Infrastructure Compute, you can provision and manage compute hosts in the cloud. You can launch compute instances with shapes that meet your resource requirements for CPU, memory, network bandwidth, and storage. After creating a compute instance, you can access it securely, restart it, attach and detach volumes, and terminate it when you no longer need it.
Recommendations
- VCN
When you create a VCN, determine the number of CIDR blocks required and the size of each block based on the number of resources that you plan to attach to subnets in the VCN. Use CIDR blocks that are within the standard private IP address space.
Select CIDR blocks that don't overlap with any other network (in Oracle Cloud Infrastructure, your on-premises data center, or another cloud provider) to which you intend to set up private connections.
After you create a VCN, you can change, add, and remove its CIDR blocks.
When you design the subnets, consider your traffic flow and security requirements. Attach all the resources within a specific tier or role to the same subnet, which can serve as a security boundary.
- Security lists
Use security lists to define ingress and egress rules that apply to the entire subnet.
- Security
Use Oracle Cloud Guard to monitor and maintain the security of your resources in Oracle Cloud Infrastructure proactively. Cloud Guard uses detector recipes that you can define to examine your resources for security weaknesses and to monitor operators and users for risky activities. When any misconfiguration or insecure activity is detected, Cloud Guard recommends corrective actions and assists with taking those actions, based on responder recipes that you can define.
For resources that require maximum security, Oracle recommends that you use security zones. A security zone is a compartment associated with an Oracle-defined recipe of security policies that are based on best practices. For example, the resources in a security zone must not be accessible from the public internet and they must be encrypted using customer-managed keys. When you create and update resources in a security zone, Oracle Cloud Infrastructure validates the operations against the policies in the security-zone recipe and denies operations that violate any of the policies.
Considerations
Consider the following points when deploying this reference architecture.
- Performance
Within a region, performance isn’t affected by the number of VCNs. When you peer VCNs in different regions, consider latency. When you use spokes connected through Oracle Cloud Infrastructure Site-to-Site VPN or Oracle Cloud Infrastructure FastConnect, the throughput of the connection is an additional factor. If high performance is required, use local peering gateways (LPGs) instead of the DRG.
- SecurityUse appropriate security mechanisms to protect the topology. The topology that you deploy by using the provided Terraform code incorporates the following security characteristics:
- The default security list of the hub VCN allows SSH traffic from 0.0.0.0/0. Adjust the security list to allow only the hosts and networks that should have SSH access (or whatever other services ports are required) to your infrastructure.
- This deployment places all components in the same compartment.
- Spoke VCNs are not accessible from the internet.
- Availability and redundancy
Except for the instances, the remaining components have no redundancy requirements.The OCI Site-to-Site VPN and OCI FastConnect components are redundant. For further redundancy, use multiple connections, preferably from different providers.
- Cost
The only components of this architecture that have a cost are the compute instances and OCI FastConnect (port hours and provider charges). If a VCN in a different region is connected, traffic between regions is charged. The other components have no associated cost.
- Management
Route management is simplified as most routes will be at the DRG. Using the DRG as the hub, it is possible to have 300 attachments (using LPGs, the hub VCN can only connect to 10 VCNs).
Deploy
The Terraform code for this reference architecture is available in GitHub. You can pull the code into Oracle Cloud Infrastructure Resource Manager with a single click, create the stack, and deploy it. Alternatively, you can download the code from GitHub to your computer, customize the code, and deploy the architecture by using the Terraform CLI.
Note:
The Terraform code includes most of the components shown in the architecture diagram including a VM for bastion host. The service VM, workload VM, OCI Site-to-Site VPN, OCI FastConnect, and OCI Bastion are not included in the code, although they are shown in the diagram.- Deploy by using Oracle Cloud Infrastructure Resource
Manager:
- Click
If you aren't already signed in, enter the tenancy and user credentials.
- Review and accept the terms and conditions.
- Select the region where you want to deploy the stack.
- Follow the on-screen prompts and instructions to create the stack.
- After creating the stack, click Terraform Actions, and select Plan.
- Wait for the job to be completed, and review the plan.
To make any changes, return to the Stack Details page, click Edit Stack, and make the required changes. Then, run the Plan action again.
- If no further changes are necessary, return to the Stack Details page, click Terraform Actions, and select Apply.
- Click
- Deploy by using the Terraform CLI:
- Go to GitHub.
- Clone or download the repository to your local computer.
- Follow the instructions in the
READMEdocument.
Explore More
Learn about this architecture and about related architectures:
- Set up a hub-and-spoke network topology by using local peering gateways
- Well-architected framework for Oracle Cloud Infrastructure
- VCNs and Subnet Management
- Local VCN Peering using Local Peering Gateways
- Transit Routing inside a hub VCN
- Oracle Cloud Infrastructure Documentation
- Oracle Cloud Cost Estimator