Article 10 – Site-to-Site VPN: IPsec Tunnels, BGP Routing, and High Availability

1. Introduction to OCI Site-to-Site VPN

Connecting on-premises enterprise data centers to Oracle Cloud Infrastructure (OCI) requires secure, encrypted network transport across public internet infrastructure. OCI delivers this through Site-to-Site VPN (formerly known as OCI IPSec VPN).

OCI Site-to-Site VPN provisions redundant, IPSec-encrypted tunnels connecting an on-premises firewall/router (Customer Premises Equipment – CPE) to an OCI Dynamic Routing Gateway (DRG v2).

OCI Site-to-Site VPN supports both Static Routing and Dynamic BGP Routing (Border Gateway Protocol) with active-active dual-tunnel failover.

2. Core Architectural Concepts

1. Customer Premises Equipment (CPE) Object

A CPE object in OCI is a software representation of your on-premises edge router or hardware firewall (e.g., Cisco ASA/Firepower, Palo Alto Networks, Fortinet FortiGate, Juniper SRX).
* Stores the Public IP Address of your on-premises firewall interface.
* Optionally defines vendor-specific device shapes for automated configuration helper generation.

2. Dual IPsec Tunnels for High Availability

For every Site-to-Site VPN connection provisioned, OCI automatically deploys two separate IPSec tunnels terminate on distinct, geographically redundant OCI VPN headend routers.

• Active-Active Dual Tunnels: Both tunnels carry traffic simultaneously if BGP dynamic routing is configured with equal-cost multi-pathing (ECMP).
• Active-Passive Dual Tunnels: If static routing is used or BGP AS-Path Prepending is enforced, Tunnel 1 serves as primary and Tunnel 2 acts as automatic hot-standby.

3. Static Routing vs. Dynamic BGP Routing

4. IPSec Cryptographic Parameters

OCI Site-to-Site VPN supports industry-standard IKE (Internet Key Exchange) parameters:

• IKE Versions: IKEv1 and IKEv2 (Recommended).
• Phase 1 (IKE SA):
• Encryption: AES-256-GCM, AES-256-CBC, AES-128-CBC.
• Authentication: SHA-384, SHA-256.
• Diffie-Hellman (DH) Groups: Group 20, Group 19, Group 14, Group 24.
• Phase 2 (IPSec SA):
• Encryption: AES-256-GCM, AES-256-CBC.
• Authentication: HMAC-SHA2-256-96.
• PFS (Perfect Forward Secrecy): DH Group 20, Group 19, Group 14.

5. OCI Web Console (GUI) Step-by-Step Walkthrough

Follow these steps to configure a BGP-based Site-to-Site VPN connection.

Step 1: Creating the CPE Object in OCI

1. Open Navigation Menu (≡) ➔ Networking ➔ Customer Premises Equipment.
2. Click Create CPE.
3. Configure:
4. Name: CPE-Corporate-HQ
5. Compartment: Network-Compartment
6. Public IP Address: 203.0.113.10 (On-Premises Gateway IP)
7. Click Create CPE.

Console Path: [≡ Main Menu] ➔ [Networking] ➔ [Customer Premises Equipment]

Step 2: Provisioning the Site-to-Site VPN Connection

1. Navigate to Networking ➔ Site-to-Site VPN.
2. Click Create IPSec Connection.
3. Fill out configuration parameters:
4. Name: VPN-HQ-To-Ashburn
5. Compartment: Network-Compartment
6. CPE: Select CPE-Corporate-HQ.
7. Dynamic Routing Gateway: Select DRG-Hub-Ashburn.
8. Routing Type: Select BGP Dynamic Routing.
9. Configure Tunnel 1 & Tunnel 2 Details:
10. BGP ASN (On-Premises): 65000
11. Shared Secret (Pre-Shared Key): Auto-generate or enter custom complex PSK.
12. IPv4 Inside Tunnel Interface: Specify /30 point-to-point IP range (e.g., 10.255.0.0/30).
13. Click Create IPSec Connection.

Step 3: Downloading CPE Configuration Helper File

1. On the newly created IPSec Connection details page, click Download CPE Configuration.
2. Select your firewall vendor (e.g., Cisco, Palo Alto, Fortinet) and model.
3. Click Download Configuration. OCI generates a customized CLI configuration script containing pre-filled IP addresses, PSKs, and BGP statements ready to paste into your on-premises firewall.

6. Common Architectural Misconceptions & Pitfalls

Misconception 1: “A Single IPSec Tunnel Provides Production High Availability”

• Reality: Provisioning only 1 of the 2 provided IPSec tunnels exposes your enterprise to downtime during scheduled OCI maintenance windows. Both Tunnel 1 and Tunnel 2 must be configured and active on your CPE for SLA coverage.

Misconception 2: “Inside Tunnel IP Addresses Conflict with VCN Subnets”

• Reality: The point-to-point /30 IP addresses assigned to the inside tunnel interfaces (e.g., 10.255.0.1 and 10.255.0.2) are strictly used for BGP session peering between CPE and DRG. They do not consume VCN subnet IP space.

7. OCI Site-to-Site VPN vs. Other Cloud Platforms