OCI Architect Professional: Networking

Networking

This domain tests VCN design: subnet tiers, gateways, route tables, security rules, and peering/transit. Most questions ask which path a packet takes and which control must allow it.

Core rules

• A VCN is regional; subnets are regional and can be public or private. Route tables attach to subnets and use longest-prefix match. Targets include Internet Gateway (IGW), NAT Gateway, Service Gateway, DRG, and Local Peering Gateway (LPG).
• IGW supports inbound and outbound internet for public subnets; a VNIC also needs a public IP for direct internet. NAT supports outbound-only traffic from private subnets and hides it behind the NAT public IP.
• Service Gateway gives private access to Oracle Services Network using the service CIDR; it is not a route to the internet.
• Security lists are subnet-level and stateful. NSGs are VNIC-level and stateful. Both can reference CIDRs and services; NSGs can also reference other NSGs. Rules are additive: traffic is allowed if any applicable rule allows it.
• VCN peering uses LPGs in one region or RPCs over DRGs across regions. Peering is non-transitive; CIDRs must not overlap; both VCNs need routes and security rules.

Worked example

Private subnet 10.0.1.0/24 must reach Object Storage and the internet for OS updates, with no inbound internet. The subnet route table has 0.0.0.0/0 -> NAT Gateway and the OSN service CIDR -> Service Gateway. The security list allows outbound TCP 443 to 0.0.0.0/0 and to the OSN CIDR; return traffic is allowed because the rules are stateful. No public IP is assigned. Adding an IGW route alone would fail because the VNIC has no public IP.

Traps

• Assuming a hub VCN makes peering transitive; use DRG transit routing.
• Omitting the return route in the remote VCN.
• Pointing 0.0.0.0/0 at a Service Gateway; the target is the OSN service CIDR.
• Using NAT Gateway for inbound connections.
• Believing security lists and NSGs must both allow traffic; they are additive.