I85PREP
⌘ K
OCI Migration Architect study materials
OCI Migration Architect study resources

OCI Migration Architect: OCI Infrastructure and Networking Design for Migrations

OCI Migration Architect · Work through your exam, one topic at a time.

All guide sections

OCI Infrastructure and Networking Design for Migrations

This domain tests the network and compute foundation that makes a migration possible: VCN design, connectivity to on-premises, security, and landing-zone topology. Mistakes here are expensive because CIDR and routing choices are hard to change after workloads arrive.

Core rules

  • Design a non-overlapping address plan across on-premises, OCI VCNs, and any other cloud. Overlapping CIDRs block FastConnect, VPN, and peering.
  • Use a hub-and-spoke topology with a DRG as the on-premises transit point. VCN peering via LPG is non-transitive; do not assume spoke-to-spoke traffic flows through a hub without routing.
  • Separate public and private subnets. Put workloads in private subnets; use NAT gateway for outbound, service gateway for Object Storage, and internet gateway only for public ingress.
  • Use route tables, security lists, and NSGs together. Security lists apply at subnet level and are stateful; NSGs apply to VNIs and simplify tiered rules.
  • Size FastConnect or Site-to-Site VPN for migration throughput and steady-state replication. Test latency and jitter for chatty applications.
  • Place compute in the right AD and fault domain; use multiple ADs for HA where the region supports it.

Worked example

A company has on-premises 192.168.0.0/16 and wants two OCI VCNs, prod and non-prod, plus FastConnect. A proposal uses 192.168.1.0/24 for prod and 192.168.2.0/24 for non-prod; both overlap the on-premises range. The correct plan uses 10.0.0.0/16 for prod and 10.1.0.0/16 for non-prod, with /24 subnets, a DRG hub, and route tables that send on-premises traffic through the FastConnect virtual circuit. A service gateway keeps Object Storage traffic off the internet. The reasoning is that route selection and overlap checks must happen before any workload is created.

Traps

  • Overlapping CIDRs discovered after FastConnect is ordered.
  • Assuming VCN peering is transitive.
  • Forgetting the service gateway and paying for NAT or internet egress to Object Storage.
  • Opening security lists broadly instead of using NSGs per tier.