OCI Networking Professional cheat sheet

A VCN is a regional, private, software-defined network; subnets inside it are either regional (span all ADs) or AD-specific, and each subnet has one contiguous CIDR block.

CIDR sizing rule: /16 to /30 per VCN; each subnet may be /16 to /30. A /24 subnet yields 256 addresses, but OCI reserves the first two (network, gateway) and the last (broadcast), leaving 253 usable.

Subnets are created as public (traffic can reach the internet via an Internet Gateway) or private (no direct inbound internet path); the designation is a property of the route table, not a firewall.

Security lists are VCN-wide, apply to all VNICs in associated subnets, and are stateful; NSGs are VNIC-level, apply only to VNICs explicitly added, and are also stateful. A packet must be allowed by both the security list and the NSG to pass.

VNIC types: primary VNIC is created with the instance and cannot be detached; secondary VNICs can be added, moved between instances, or used for multi-homing. Each VNIC gets a private IP from the subnet and may have multiple private IPs.

A VCN supports exactly one IPv4 CIDR at creation and up to five additional IPv4 CIDRs can be added later; IPv6 can be enabled per VCN and per subnet with a /56 ULA or GUA prefix.

Local VCN peering uses a Local Peering Gateway (LPG) and connects VCNs in the same region and tenancy; Remote Peering uses a Dynamic Routing Gateway (DRG) and connects VCNs across regions or tenancies.

CIDR overlap is forbidden for peering, and for DRG-attached networks: plan non-overlapping address space before creating VCNs, because overlapping ranges cannot be peered or routed.

A VCN's default route table, default security list, and default DHCP options are created automatically and can be replaced; deleting a VCN removes its subnets, gateways, and route tables.

Internet Gateway (IGW): provides inbound/outbound internet for public subnets; requires a route rule 0.0.0.0/0 -> IGW and a public IP on the VNIC. NAT Gateway: outbound-only internet for private subnets, no inbound; route 0.0.0.0/0 -> NAT GW.

Service Gateway: private access to Oracle Services Network (Object Storage, etc.) without traversing the internet; route rule targets the service's CIDR or all-services via the Service Gateway, and it is regional.

Dynamic Routing Gateway (DRG): virtual router for IPSec VPN, FastConnect, and remote peering. A DRG attaches to a VCN via a DRG attachment; one DRG can attach to multiple VCNs.

Route table rules are evaluated by longest-prefix match; the most specific CIDR wins regardless of order. A rule with target type Dynamic Routing Gateway or Private IP can route to a specific next hop.

FastConnect: private dedicated or partner-hosted connection to OCI. Virtual circuits have a BGP session to the DRG; private peering reaches VCNs, public peering reaches Object Storage and public services.

Site-to-Site VPN: IPSec tunnels (two per connection for redundancy) terminate on the DRG; BGP or static routing is configured on the CPE. Tunnel status must be Up on both ends for traffic to flow.

Transit routing: a DRG can route between attached VCNs, VPNs, and FastConnect when the DRG route tables and VCN route tables are configured with the right rules; hub-and-spoke topologies use a hub VCN or DRG as the transit point.

Route rule target types: Internet Gateway, NAT Gateway, Service Gateway, Dynamic Routing Gateway, Local Peering Gateway, Private IP, and (for transit) DRG attachment. A route rule without a matching gateway target is invalid.

Private endpoints (Private Endpoint / Private Service Access) let a VCN reach a service or another VCN privately without public IPs; the route uses a private IP target rather than a gateway.

Load balancer types: public (internet-facing) or private (internal), and shape fixed (Flexible Shape with min/max bandwidth) or dynamic. A public LB needs a public subnet; a private LB uses a private subnet.

Listener: protocol (HTTP, HTTPS, TCP, UDP), port, and SSL certificate. Backend set: policy (Round Robin, Least Connections, IP Hash, Weighted Round Robin) plus health check (protocol, port, interval, timeout, retries).

Health check failure removes a backend from rotation; a backend must pass the health check on the check port/protocol, not necessarily the listener port.

Session persistence options: LB cookie (HTTP/HTTPS) or source IP (TCP/UDP); enable when backends keep state. Without persistence, requests may land on any healthy backend.

SSL termination at the LB offloads TLS; end-to-end TLS re-encrypts to the backend. Certificate management uses OCI Certificates or uploaded certs.

DNS: a zone holds records (A, AAAA, CNAME, MX, TXT, SRV, NS). OCI DNS supports public zones and private zones (resolved only inside VCNs via the resolver).

Traffic Management (GSLB) steering policies: failover, load balancer, geolocation, ASN, IP prefix, and weighted; health checks drive failover between endpoints.

Private DNS resolver: a VCN resolver answers private zone queries and forwards to on-premises DNS via a resolver endpoint (inbound/outbound) over VPN or FastConnect.

TTL controls caching; lower TTL speeds failover but increases query volume. CNAME cannot coexist with other records at the same name; apex records use A/AAAA or ALIAS-style flattening.

Defense layers: security lists (subnet), NSGs (VNIC), and host firewalls (iptables/firewalld inside the instance). All three must permit traffic; a common failure is a correct NSG but a blocking host firewall.

Security lists and NSGs are stateful: return traffic for an allowed connection is automatically permitted, so you do not need a reverse rule for established sessions.

VCN Flow Logs capture accepted/rejected traffic per VNIC or subnet; use them to confirm whether a packet reached the VNIC and whether it was allowed.

Monitoring: metrics via OCI Monitoring (e.g., LB byte counts, healthy/unhealthy backend counts, VPN tunnel up/down), alarms on metric thresholds, and Notifications for alert delivery.

Audit logs record control-plane API calls (who created/changed a route rule or security list); use Audit for change tracking and Flow Logs for data-plane traffic.

Troubleshooting order: DNS resolution -> route table (longest prefix, correct gateway) -> security list/NSG -> host firewall -> backend health check. Check the route table first when a public subnet cannot reach the internet.

A private subnet with no NAT Gateway route cannot reach the internet even if an IGW exists; the route table must point 0.0.0.0/0 to the NAT Gateway and the NAT Gateway must be in a public subnet.

Instance cannot be reached from the internet: verify public IP, IGW route, security list ingress rule for the port, NSG rule, and OS firewall, in that order.

VPN or FastConnect down: check BGP session state, tunnel status, CPE configuration, and DRG route table rules; asymmetric routing often appears when only one direction's route table is updated.

A VCN is regional; subnets are either regional (span all ADs) or AD-specific, and each subnet has exactly one contiguous CIDR block.

OCI reserves the first two and last address in each subnet: a /24 has 253 usable addresses.

Public vs private subnet is determined by the route table: a public subnet routes 0.0.0.0/0 to an Internet Gateway.

Security lists apply at the subnet level and are stateful; NSGs apply at the VNIC level and are also stateful. Both must allow traffic.

A VCN starts with one IPv4 CIDR and can add up to five more; IPv6 uses a /56 prefix per VCN.

Local Peering Gateway peers VCNs in the same region and tenancy; DRG remote peering spans regions or tenancies.

Peering requires non-overlapping CIDRs; overlapping ranges cannot be peered or routed.

Primary VNIC is created with the instance and cannot be detached; secondary VNICs can be moved between instances.

Internet Gateway enables inbound and outbound internet for public subnets; NAT Gateway enables outbound-only internet for private subnets.

Service Gateway provides private access to Oracle Services Network without internet traversal and is regional.

DRG is the virtual router for IPSec VPN, FastConnect, and remote peering; it attaches to VCNs via DRG attachments.

Route rules use longest-prefix match: the most specific CIDR wins regardless of rule order.

Site-to-Site VPN uses two IPSec tunnels per connection for redundancy; BGP or static routing is configured on the CPE.

FastConnect virtual circuits use BGP to the DRG; private peering reaches VCNs, public peering reaches public services.

Transit routing across VCNs, VPNs, and FastConnect requires matching rules in both DRG route tables and VCN route tables.

Valid route target types include Internet Gateway, NAT Gateway, Service Gateway, DRG, Local Peering Gateway, and Private IP.

Public load balancers need a public subnet; private load balancers use a private subnet and are reachable only inside the VCN or via connected networks.

Listener = protocol + port + SSL certificate; backend set = policy + health check + backends.

Health check failure removes a backend from rotation; the check runs on its own protocol and port, which may differ from the listener.

Session persistence options are LB cookie (HTTP/HTTPS) or source IP (TCP/UDP); enable it when backends hold state.

SSL can terminate at the LB or be re-encrypted end-to-end to the backend.

OCI DNS supports public and private zones; private zones resolve only inside VCNs through the resolver.

Traffic Management steering policies include failover, load balancer, geolocation, ASN, IP prefix, and weighted.

Private DNS resolver endpoints (inbound/outbound) forward queries to on-premises DNS over VPN or FastConnect.

Traffic must pass security lists, NSGs, and the host firewall; a correct NSG with a blocking host firewall still fails.

Security lists and NSGs are stateful, so established connections do not need a reverse rule.

VCN Flow Logs show accepted and rejected traffic per VNIC or subnet; use them to confirm whether a packet reached the VNIC.

OCI Monitoring collects metrics and alarms; Notifications delivers alerts. Audit logs record control-plane API changes.

Troubleshooting order: DNS -> route table -> security list/NSG -> host firewall -> backend health check.

A private subnet needs a NAT Gateway route for outbound internet even when an Internet Gateway exists.

Unreachable instance checklist: public IP, IGW route, security list ingress, NSG rule, OS firewall.

VPN or FastConnect down: check BGP state, tunnel status, CPE config, and DRG route tables; asymmetric routing follows one-sided route updates.