OCI Networking Professional flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

VCN scope

A Virtual Cloud Network is a regional construct in OCI. It contains subnets that are either regional, spanning all availability domains, or AD-specific, and it owns its own CIDR, route tables, gateways, and security lists.

Regional vs AD subnet

A regional subnet spans all availability domains in the region, while an AD-specific subnet exists in one availability domain. Both types must have a single contiguous CIDR block and belong to exactly one VCN.

Subnet usable addresses

OCI reserves the first two addresses and the last address of every subnet. A /24 subnet has 256 addresses and 253 usable ones; a /30 has four addresses and one usable.

Public subnet definition

A subnet is public when its associated route table has a rule sending 0.0.0.0/0 to an Internet Gateway. The label comes from routing, not from a subnet flag, and the VNIC also needs a public IP.

Security list vs NSG

Security lists apply to all VNICs in associated subnets and are VCN-wide. Network security groups apply only to VNICs explicitly added. Both are stateful, and traffic must be allowed by both.

Primary VNIC rule

The primary VNIC is created with the compute instance and cannot be detached or moved. Secondary VNICs can be added, detached, and attached to another instance in the same subnet for multi-homing.

VCN CIDR limits

A VCN is created with one IPv4 CIDR and can later add up to five more, for six total. IPv6 is enabled per VCN with a /56 prefix, and subnets receive /64 IPv6 prefixes from it.

Local vs remote peering

Local peering uses a Local Peering Gateway and connects VCNs in the same region and tenancy. Remote peering uses a Dynamic Routing Gateway and connects VCNs across regions or tenancies.

CIDR overlap rule

Peered VCNs and networks reached through a DRG must not have overlapping CIDR ranges. Overlapping address space cannot be peered or routed, so plan non-overlapping ranges before creating VCNs.

Internet Gateway function

An Internet Gateway provides inbound and outbound internet connectivity for public subnets. It requires a route rule to 0.0.0.0/0 and a public IP on the VNIC to be reachable from the internet.

NAT Gateway function

A NAT Gateway gives private subnets outbound-only internet access. It blocks unsolicited inbound connections, sits in a public subnet, and is used with a 0.0.0.0/0 route rule.

Service Gateway function

A Service Gateway provides private access from a VCN to Oracle Services Network, such as Object Storage, without traversing the internet. It is regional and used through a route rule targeting the service CIDR.

DRG role

A Dynamic Routing Gateway is a virtual router that connects a VCN to IPSec VPNs, FastConnect virtual circuits, and remote-peered VCNs. It attaches to VCNs through DRG attachments.

Longest prefix match

Route tables select the most specific matching CIDR, not the first rule in order. A /24 route wins over a /0 default route for a destination inside that /24, regardless of rule position.

FastConnect private peering

FastConnect private peering connects on-premises networks to VCN private IPs through a virtual circuit and BGP session to the DRG. Public peering reaches Oracle public services such as Object Storage.

Site-to-Site VPN tunnels

A Site-to-Site VPN connection uses two IPSec tunnels for redundancy between a CPE and the DRG. Each tunnel carries BGP or static routes, and both ends must be configured to match.

Route rule target types

Valid route rule targets include Internet Gateway, NAT Gateway, Service Gateway, Dynamic Routing Gateway, Local Peering Gateway, Private IP, and DRG attachment. A rule without a valid target is rejected.

Transit routing requirement

Routing between VCNs, VPNs, and FastConnect through a DRG requires matching rules in both the DRG route tables and each VCN route table. One-sided configuration causes dropped or asymmetric traffic.

Public vs private load balancer

A public load balancer uses a public subnet and is reachable from the internet. A private load balancer uses a private subnet and is reachable only from inside the VCN or connected networks.

Listener and backend set

A listener defines protocol, port, and SSL certificate for incoming traffic. A backend set defines the load balancing policy, health check, and the backend servers that receive traffic.

Health check behavior

The load balancer probes each backend on the health check protocol, port, interval, timeout, and retry count. A backend that fails the check is removed from rotation until it passes again.

Session persistence options

Session persistence keeps a client on the same backend. Options are an LB cookie for HTTP and HTTPS listeners or source IP affinity for TCP and UDP listeners. Enable it when backends store session state.

SSL termination vs re-encryption

SSL termination decrypts TLS at the load balancer and forwards plaintext to backends. End-to-end re-encryption keeps TLS from the client through the load balancer to the backend server.

Private DNS zone

A private DNS zone resolves only inside VCNs through the VCN resolver. It is not visible on the public internet and is used for internal service names and split-horizon naming.

Traffic Management policies

OCI Traffic Management steering policies include failover, load balancer, geolocation, ASN, IP prefix, and weighted. Health checks drive failover between answer endpoints in a policy.

Resolver endpoints

Private DNS resolver endpoints forward queries from a VCN to on-premises DNS over VPN or FastConnect, and accept inbound queries from on-premises. They enable hybrid name resolution without public DNS.

DNS record constraints

A CNAME record cannot coexist with other records at the same name. Apex records use A, AAAA, or flattened aliases. TTL controls caching time and therefore failover speed.

Stateful security rules

Security lists and NSGs are stateful: return traffic for an allowed connection is automatically permitted. You do not need a reverse ingress rule for responses to outbound or inbound established sessions.

VCN Flow Logs

VCN Flow Logs capture accepted and rejected traffic for a VNIC or subnet. They show whether a packet reached the VNIC and whether security rules allowed it, which isolates network from host issues.

Audit vs Monitoring

Audit logs record control-plane API calls such as route table or security list changes. OCI Monitoring collects metrics and evaluates alarms, and Notifications delivers the resulting alerts to subscribers.

Troubleshooting order

Check DNS resolution, then the route table for the correct gateway, then security list and NSG rules, then the host firewall, and finally backend health checks. This order isolates the failing layer quickly.

Private subnet internet access

A private subnet reaches the internet only when its route table sends 0.0.0.0/0 to a NAT Gateway located in a public subnet. An Internet Gateway route alone does not work without a public IP.