OCI Networking Professional key terms

A private, software-defined network in OCI that you define with a CIDR block and subdivide into subnets. It scopes your routing tables, gateways, security lists, and DNS settings within a single region.

A contiguous range of IP addresses carved from a VCN's CIDR block, bound to one availability domain or marked regional. It can be public or private and carries its own security lists and route table association.

Classless Inter-Domain Routing notation that expresses an IP range as an address plus a prefix length, such as 10.0.0.0/16. It defines the size of a VCN or subnet and how many usable host addresses it contains.

An isolated data center group within an OCI region with independent power and network. Placing resources across availability domains improves resilience, and non-regional subnets are tied to a single one.

A grouping of hardware inside a single availability domain, designed so that failures in one do not affect others. Distributing instances across fault domains reduces correlated hardware failure risk.

A geographic area containing one or more availability domains where OCI resources are deployed. VCNs are regional constructs, so subnets can span availability domains within the same region.

A highly available, horizontally scaled gateway that lets resources with public IP addresses send and receive traffic to and from the internet. It is referenced as a target in route rules.

A gateway that lets instances in a private subnet initiate outbound internet connections while blocking unsolicited inbound traffic. It requires a route rule targeting the gateway and a private subnet placement.

A gateway that provides private access to supported OCI services, such as Object Storage, without traffic traversing the internet. Routes target a service CIDR label rather than a public endpoint.

A virtual router that connects a VCN to remote networks, including on-premises environments over FastConnect or Site-to-Site VPN and other VCNs through peering attachments. It holds route tables and attachments.

A component that connects two VCNs in the same region through a peering relationship. Peering requires non-overlapping CIDR blocks and explicit route rules on both sides.

A DRG attachment that peers VCNs across regions, allowing private traffic between them. Both VCNs need matching RPCs, non-overlapping address space, and route rules pointing to the DRG.

A set of rules that determines where traffic from a subnet or gateway is forwarded, based on destination CIDR and a target such as a gateway or private IP. Each subnet uses exactly one route table.

A single entry in a route table pairing a destination CIDR block with a target gateway or private IP address. Traffic matching the destination is forwarded to that target.

A dedicated private physical connection between an on-premises network and OCI, offering predictable bandwidth and lower latency than internet-based options. It terminates at a DRG through a virtual circuit.

An IPsec tunnel connection between an on-premises customer-premises equipment device and a DRG, carried over the internet. It supports multiple tunnels for redundancy and uses BGP for dynamic route exchange.

A routing protocol used to exchange reachability information between autonomous systems. In OCI it dynamically advertises routes over FastConnect virtual circuits and Site-to-Site VPN tunnels.

A managed service that distributes incoming traffic across backend servers using a listener, backend set, and health check. It offers public or private shapes and flexible bandwidth options.

A named group of backend servers behind a load balancer, together with a load balancing policy and a health check. Traffic from a listener is forwarded to the backend set's healthy members.

A load balancer component that defines the protocol and port on which it accepts incoming traffic, plus the backend set that should receive it. It may also terminate SSL/TLS.

A periodic probe that determines whether a backend server is available to receive traffic. Unhealthy backends are removed from rotation until they pass again, which improves availability.

A layer 4 load balancer that forwards TCP or UDP traffic with very low latency and preserves the client source IP. It is suited to high-throughput and non-HTTP workloads.

The process where a load balancer decrypts incoming TLS traffic and forwards plain traffic to backends, or re-encrypts it. Certificates are managed on the listener in this configuration.

A managed domain name service for publishing zones and records and resolving names for your workloads. It supports public zones and private views tied to a VCN.

A DNS scope associated with a VCN or on-premises resolver, used to resolve internal names that are not visible on the public internet. It supports split-horizon naming for internal services.

A DNS record that maps an alias hostname to another canonical hostname. It is commonly used to point a friendly name at a load balancer or service endpoint.

A set of stateful ingress and egress rules applied at the subnet level to all resources in that subnet. Rules specify source or destination, protocol, and port ranges.

A virtual firewall applied to selected VNICs rather than an entire subnet, giving granular control over which instances share a rule set. Rules are stateful like security lists.

A firewall rule where return traffic for an allowed connection is automatically permitted without a matching reverse rule. OCI security lists and NSGs are stateful by default.

A virtual network interface attached to an instance that carries its private IP addresses and MAC address. NSGs and security lists ultimately govern traffic to and from VNICs.

An address assigned to a VNIC that is reachable only inside the VCN and connected networks. A VNIC may hold multiple private IPs, and one can be designated primary.

An internet-routable address that can be assigned to a VNIC or a load balancer. Instances need one, plus an internet gateway route, to be directly reachable from the internet.

Captured records of traffic accepted or rejected by security rules for a VCN, subnet, or VNIC. They support security auditing and troubleshooting of unexpected connectivity behavior.

Diagnostic logs that record metadata about network flows through VCN components, delivered to Object Storage or Logging. Analysts use them to investigate denied traffic and verify rule changes.

A troubleshooting tool that shows the path between a source and destination, including gateways, route tables, and security rules that affect the connection. It helps identify misconfiguration quickly.

A private IP address in a subnet that provides access to a supported service without using the internet. It is commonly used with Object Storage and other managed services.

A numeric label assigned to a network interface for identification and routing. OCI VCNs use IPv4 by default and support IPv6 in some configurations.