Routing, Gateways, and Connectivity
What this domain tests
Questions focus on route selection, gateway choice, and hybrid connectivity: which target serves which traffic, how DRG route tables exchange routes, and when to use VPN versus FastConnect.
Core rules
- Each route table rule pairs a destination CIDR with a target. OCI uses longest-prefix match; a /24 rule beats a /16 rule regardless of order.
- Internet gateway (IGW): bidirectional internet for public subnets. NAT gateway: outbound-only internet for private subnets; it cannot accept inbound connections. Service gateway: private access to Oracle Services Network without internet. DRG: hub for VPN, FastConnect, and remote peering. LPG: same-region VCN peering.
- Site-to-site VPN uses a CPE object and two IPSec tunnels; prefer BGP for dynamic failover. FastConnect provides private or public peering over a dedicated circuit.
- DRG attachments and DRG route tables control import and export; a missing route in either direction breaks connectivity.
Worked example
A private subnet needs patching, on-premises database access, and Object Storage. Route table: 0.0.0.0/0 -> NAT gateway; 10.100.0.0/16 -> DRG; All Services in Oracle Services Network -> service gateway. If on-premises advertises 10.0.0.0/8 over the VPN, the /16 still wins for 10.100.x.x because of longest-prefix match. The DRG route table must import the on-premises route and export the VCN route, and the CPE must have a matching route back.
Traps
- Putting 0.0.0.0/0 -> IGW on a private subnet exposes it; use NAT.
- Assuming NAT gateway supports inbound or port forwarding.
- Forgetting the return route on the CPE or in the DRG route table.
- Confusing FastConnect public peering (OCI public services) with private peering (VCN via DRG).
- A VPN tunnel status of Up does not prove BGP routes were learned.