Article 03 – VCN Connectivity: Peering, Hybrid Routing, and the DRG Hub

The Transit Routing Challenge

In Google Cloud, connecting multiple VPC networks or bridging cloud environments to on-premises datacenters requires orchestrating multiple distinct components. If you use VPC Network Peering, you face a strict constraint: peering is non-transitive. If VPC A is peered with VPC B, and VPC B is peered with VPC C, workloads in VPC A cannot communicate with VPC C.

To overcome this, GCP architects must implement complex designs using Cloud VPN tunnels, custom VM transit gateways, or configure Network Connectivity Center (NCC) alongside Cloud Routers to establish dynamic BGP routing across environments.

Oracle Cloud Infrastructure (OCI) simplifies this hub-and-spoke transit topology. Instead of chaining multiple distinct networking products, OCI consolidated all external and transit routing into a single, highly capable virtual router called the Dynamic Routing Gateway (DRG).

The DRG: A Centralized Routing Hub

A DRG is a virtual routing resource that you attach to your VCN. Once attached, it acts as a gateway for any traffic going outside the region or to on-premises networks.

However, a modern OCI DRG is more than a simple gateway; it is a full-featured transit router. A single DRG can support multiple Attachments simultaneously:
* VCN Attachments: Connects local VCNs within the same region to the DRG.
* IPSec VPN Attachments: Connects Site-to-Site VPN tunnels to on-premises networks.
* Virtual Circuit Attachments: Connects FastConnect private circuits.
* Remote Peering Connection (RPC) Attachments: Connects VCNs across different OCI regions.

Inside the DRG, traffic is routed through customizable DRG Route Tables associated with each attachment. It natively supports transit routing. For example, traffic from an on-premises network can enter the DRG via a FastConnect circuit, transit through the DRG, and enter a VCN. It can even transit from one VCN through the DRG and into another VCN in the same region, bypassing the non-transitive limitation of traditional cloud peering.

Here is how the DRG serves as the central hub for VCN peering and hybrid routing:

OCI Hybrid Connectivity and Peering Topology

Local and Remote Peering

When you need to connect two VCNs, OCI provides two options depending on whether the VCNs reside in the same region or different regions.

1. Local Peering (Same Region)

If you have two VCNs in the same region (e.g., VCN-Production and VCN-SharedServices) and want to connect them without routing traffic through a DRG, you can use a Local Peering Gateway (LPG).
* You establish an LPG on each VCN and create a peering connection between them.
* Because the VCNs are in the same region, traffic flows over OCI’s internal low-latency physical network.
* Alternatively, for more complex hub-and-spoke layouts, you can attach both VCNs to a single DRG, which automates route propagation between them.

2. Remote Peering (Cross-Region)

If you need to connect VCNs across different regions (e.g., US East to UK South), you must use a DRG on each side.
* You create a Remote Peering Connection (RPC) attachment on the DRG in each region.
* You then peer the two RPCs. Traffic travels securely across Oracle’s private global fiber backbone, never touching the public internet.

This maps directly to GCP VPC Peering, which natively supports both local and cross-region peering, but OCI’s RPC model gives you explicit control over the transit path via DRG route rules.

Hybrid Connectivity: VPN and FastConnect

For enterprise workloads requiring connectivity back to physical datacenters, OCI provides two options that correspond directly to GCP’s hybrid portfolio.

1. Site-to-Site VPN

OCI Site-to-Site VPN establishes redundant, encrypted IPSec tunnels over the public internet between a DRG and your customer-premises equipment (CPE).
* OCI automatically provisions two redundant tunnels per connection, mapping to different physical endpoints within the OCI region.
* You can configure routing statically (using CIDR blocks) or dynamically using Border Gateway Protocol (BGP).
* This is equivalent to GCP’s HA Cloud VPN.

2. FastConnect

For high-bandwidth, consistent latency, and dedicated private access, OCI offers FastConnect.
* FastConnect bypasses the public internet entirely, establishing a direct physical fiber connection between your network infrastructure and OCI.
* You can establish FastConnect through a colocation provider (direct cross-connect) or via a supported network carrier (Partner model).
* FastConnect is billed on port speed (e.g., 1 Gbps or 10 Gbps) with no charges for data egress—a significant difference from many cloud providers.
* This maps directly to GCP’s Cloud Interconnect (Dedicated or Partner).

Declarative Provisioning via Terraform

Instead of scripting manual CLI commands, you configure OCI VCN connectivity and hybrid routing using Terraform. The following configuration defines a DRG, attaches it to a VCN, and creates a Remote Peering Connection for cross-region networking:

# 1. Create the Dynamic Routing Gateway (DRG)
resource "oci_core_drg" "hub_drg" {
  compartment_id = "ocid1.compartment.oc1..aaaaaaaadevvv..."
  display_name   = "Hub-DRG"
}

# 2. Attach the DRG to your VCN
resource "oci_core_drg_attachment" "vcn_prod_attachment" {
  drg_id       = oci_core_drg.hub_drg.id
  vcn_id       = "ocid1.vcn.oc1.iad.aaaaaaaaxxx..."
  display_name = "VCN-Prod-Attachment"

  # Optional: Specifying attachment type (defaults to VCN)
  network_details {
    id   = "ocid1.vcn.oc1.iad.aaaaaaaaxxx..."
    type = "VCN"
  }
}

# 3. Create a Remote Peering Connection (RPC) on the DRG
resource "oci_core_remote_peering_connection" "rpc_to_london" {
  compartment_id = "ocid1.compartment.oc1..aaaaaaaadevvv..."
  drg_id         = oci_core_drg.hub_drg.id
  display_name   = "RPC-To-London"

  # Once created, cross-region peering is established by connecting
  # this RPC to a remote RPC OCID in another region.
}

By leveraging the Dynamic Routing Gateway as a unified transit router and defining connections declaratively using Terraform, you can manage VCN peering, VPNs, and dedicated private circuits under a single routing control plane.

Related Posts