Hub-and-spoke VCN with an acquired overlapping CIDR and FastConnect

No. OCI VCN peering, whether through an LPG, an RPC, or DRG attachments, requires non-overlapping CIDRs. Longest-prefix routing cannot distinguish two different 10.0.0.0/16 networks, and a DRG route table cannot hold two active routes to the same prefix pointing at different attachments. The overlap is not just between Fabrikam and Contoso production; it also affects the return path from on-premises, which would need to know which 10.0.0.0/16 is which. The robust options are to re-IP Fabrikam, which is the long-term answer, or to insert a third-party firewall/NAT appliance in a transit VCN that translates Fabrikam addresses to a unique range before advertising them to the hub and on-premises. OCI's NAT gateway is for outbound internet access, not for address translation between VCNs. If you use NAT, the hub and on-premises route only the translated range, and security policy is enforced on the appliance. Until that is built, do not attach both overlapping VCNs to the same DRG and expect isolation; the route ambiguity will cause intermittent reachability and hard-to-debug failures.

An LPG is a point-to-point link; it is not transitive. Fabrikam can reach the hub because the LPG and route table exist, but the hub must then route 192.168.0.0/16 to the DRG, and the DRG route table must route that prefix to the FastConnect attachment. The on-premises firewall must also have a return route for Fabrikam's range. Check all four places: Fabrikam's VCN route table needs 192.168.0.0/16 to the LPG; the hub's route table needs 192.168.0.0/16 to the DRG and the Fabrikam range to the LPG; the DRG route table needs the hub attachment and the on-premises attachment; and security lists or NSGs must allow the specific ports in both directions. If the overlap is resolved by NAT, replace those prefixes with the translated range. Also verify that no more-specific route is sending traffic to an Internet Gateway or NAT gateway. LPG peering alone never provides transit to a DRG, so the missing hub route is the most likely cause.

For DNS, a private zone is not automatically visible to every VCN. If corp.internal is a private zone associated only with the Contoso VCN, attach it to the Fabrikam VCN as well, or use a DNS resolver endpoint and forwarding rules so Fabrikam queries the hub resolver. Verify the VCN's DHCP options and resolver configuration, and test from a Fabrikam instance with dig against the VCN resolver. For Object Storage, do not send service traffic to NAT. Create a service gateway in the Fabrikam VCN, add a route rule for the regional Oracle Services Network CIDR, such as all-fra-services-in-oracle-services-network, pointing to the service gateway, and allow egress to that service CIDR in the security list or NSG. NAT gateway is only for internet destinations; OCI services use the service gateway. Verify with a curl or SDK call from a private subnet and confirm in VCN flow logs that the destination is the service CIDR, not the public Object Storage endpoint.