Networking and Connectivity for Migration
What this domain tests
How on-premises networks connect to OCI during and after migration: VCN constructs, Site-to-Site VPN versus FastConnect, DRG transit, IP address overlap, and DNS cutover mechanics.
Core rules and concepts
- VCN building blocks: subnets, route tables, security lists, NSGs, Internet Gateway for public ingress, NAT Gateway for egress, Service Gateway for OCI services without internet traversal.
- Site-to-Site VPN is IPsec over the internet with two tunnels for redundancy, using BGP or static routes. FastConnect is dedicated private connectivity at 1, 10, or 100 Gbps with private peering to VCNs through a DRG.
- The DRG provides transit between on-premises networks and multiple VCNs, and supports transit routing for hub topologies. Local Peering joins VCNs in one region; Remote Peering joins VCNs across regions.
- Overlapping CIDR blocks break VPN, FastConnect, and peering. Options are re-IP the smaller estate or introduce a third-party NVA for NAT - re-IP is usually cleaner and should be found during assessment, not cutover.
- Seed replication traffic belongs on private connectivity, not the public internet.
- Lower DNS TTLs well before cutover and use private DNS views for internal name resolution.
Worked example
On-premises uses 10.0.0.0/16 and the target VCN uses 10.1.0.0/16, so no overlap exists. Provision a FastConnect private virtual circuit to a DRG, attach the VCN, and add a route on the on-premises subnet pointing to the DRG. Replication agents reach OCI endpoints over private IPs. Because a VPN also exists for legacy traffic, add explicit more-specific routes to prevent asymmetric return paths.
Traps that cost marks
- One VPN tunnel with no redundancy for a production cutover.
- Discovering overlapping CIDRs during cutover instead of during assessment.
- Asymmetric routing when VPN and FastConnect coexist.
- Ignoring IPsec MTU and fragmentation for large database transfers.