ORACLE CLOUD INFRASTRUCTURE
OCI :
=======
Oracle Cloud Infrastructure (OCI) is Oracle's cloud computing platform that provides a wide range of cloud services, including computing, storage, networking, databases, and security. It is designed for running enterprise workloads with high performance, security, and reliability.
OCI Service Models
OCI offers services across three major cloud models:
1)Infrastructure as a Service (IaaS)
-------------------------------------
Provides fundamental cloud resources like compute, storage, and networking.
Examples:
Compute (Bare Metal, Virtual Machines, GPUs)
Block, File & Object Storage
Networking (Load Balancers, VPN, FastConnect)
Oracle Cloud VMware Solution
Dedicated Bare Metal Servers
2)Platform as a Service (PaaS) :
-------------------------------
Provides managed services for databases, application development, and AI/ML without managing underlying infrastructure.
Examples:
Oracle Autonomous Database (Self-driving, self-securing, and self-repairing DB)
Oracle Database Cloud Service, MYSQL, PostgreSQL ,GoldenGate
AI and Machine Learning Services
Application Integration (OCI API Gateway, OCI Functions)
Analytics Cloud
3)Software as a Service (SaaS) :
-------------------------------
Offers complete, fully managed software applications for business needs.
Examples:
Oracle Fusion Cloud Applications (ERP, HCM, SCM, CX)
Oracle NetSuite (Cloud ERP)
Oracle Cloud Customer Experience (CX)
Oracle Marketing, Sales, and Service Cloud
Why Choose OCI?
High performance and low-latency networking
Cost-effective pricing compared to competitors
Strong security and compliance features
Hybrid and multi-cloud support (including Oracle-Azure Interconnect)
Autonomous and AI-driven cloud services
Region in OCI :
==============
Answer: A region in OCI is a geographically isolated data center. Each region consists of multiple availability domains (ADs), which are physically separate and isolated data centers with their own power and networking. ADs within a region are interconnected by a low-latency, high-bandwidth network.
A Region in OCI is a geographical area where Oracle has multiple data centers (Availability Domains and Fault Domains).
Each Region is independent and isolated from others.
Resources within a Region can communicate with low latency.
OCI provides multiple Regions worldwide (e.g., us-ashburn-1, uk-london-1, ap-mumbai-1).
Availability Domain (AD) in OCI :
--------------------------------
An Availability Domain (AD) is a physically separate data center within a Region.
Each AD has its own power, cooling, and network connectivity.
Regions can have 1, 2, or 3 ADs.
ADs within the same Region are connected via a low-latency network high-bandwidth
If one AD fails, others continue to function.
How to use ADs effectively?
✔ Distribute workloads across multiple ADs for high availability.
✔ Place primary and backup databases in different ADs for disaster recovery.
✔ Use ADs to run fault-tolerant applications (e.g., Active-Active setup).
Example: ADs in the us-ashburn-1 Region
- us-ashburn-1 (Region)
├── us-ashburn-1-AD1 (Availability Domain 1)
├── us-ashburn-1-AD2 (Availability Domain 2)
├── us-ashburn-1-AD3 (Availability Domain 3)
🔹 Fault Domain (FD) in OCI :
----------------------------
Each AD is further divided into Fault Domains (FDs).
FDs are logical groupings of hardware within an AD.
They help protect workloads from hardware failures.
Each AD typically has 3 FDs.
Example: Fault Domains in us-ashburn-1-AD1
- us-ashburn-1-AD1 (Availability Domain 1)
├── Fault Domain 1
├── Fault Domain 2
├── Fault Domain 3
✔ Best Practice: Deploy VMs across different Fault Domains to minimize failure impact.
What is a Compartment in OCI?
-----------------------------
Collection of releated resources in OCI which is used to access and manage OCI resources efficiently.
A compartment in Oracle Cloud Infrastructure (OCI) is a logical container used to organize and isolate cloud resources such as compute instances, databases, storage, and networking components.
It helps in access control, billing, and resource management, making it easier to manage permissions and monitor costs for different teams, projects, or departments.
Key Features of Compartments
🔹 Logical Isolation: Each compartment acts as a separate unit for managing resources.
🔹 Security & Access Control: Policies define who can access what in a compartment.
🔹 Billing Separation: Helps track and control costs for different teams/projects.
🔹 Nested Compartments: Compartments can contain sub-compartments for better organization.
Example: Organizing Compartments in OCI
A company can use compartments to manage its cloud resources efficiently:
- Tenancy (Root)
├── Production (for live apps)
│ ├── Compute (instances)
│ ├── Database (DB systems)
│ ├── Storage (buckets)
│
├── Development (for testing)
│ ├── Compute (test servers)
│ ├── Database (test DBs)
│ ├── Storage (logs)
│
├── Finance (for financial reports)
│ ├── Storage (invoice backups)
│ ├── Database (transaction DBs)
1. Tenancy
============
✅ What is it?
A Tenancy is the top-level entity in OCI that represents an entire organization’s cloud account.
It includes all resources, compartments, and policies under a single ownership.
🔹 Key Characteristics:
Created when you sign up for OCI.
Assigned a unique OCID (Oracle Cloud Identifier).
Contains all compartments, users, groups, and policies.
Controls billing and subscriptions.
Has a default Root Compartment.
✅ Use Cases:
Managing an organization's OCI account.
Controlling billing and access across multiple departments.
Defining organization-wide security policies.
2. Root Compartment
====================
✅ What is it?
The Root Compartment is the first compartment inside a tenancy and contains all other compartments and resources.
🔹 Key Characteristics:
Created by default inside the tenancy.
Used to organize and manage resources like compute, storage, and networking.
Can contain child compartments to segment resources.
Cannot be deleted.
✅ Use Cases:
Organizing OCI resources (compute, storage, databases).
Defining IAM policies for resource access.
Creating sub-compartments for different projects, teams, or environments.
How They Work Together?
A Tenancy is the highest-level structure → It owns everything in OCI.
Inside the Tenancy, there is a Root Compartment → This contains all resources.
You can create multiple sub-compartments inside the Root Compartment to organize resources.
Policies can be set at the Tenancy or Compartment level to control access.
Compute in OCI (Oracle Cloud Infrastructure):
============================================
In Oracle Cloud Infrastructure (OCI), Compute refers to the services and resources that allow you to run virtual machines (VMs), containers, and bare metal instances for your applications, workloads, and services. Compute resources are used to provide processing power for your applications, websites, databases, and more.
Key Components of OCI Compute :
1. Compute Instances
Virtual Machine (VM):
These are virtualized instances of servers running in OCI.
OCI provides different shapes (types) of VMs based on the amount of CPU, memory, and networking required.
Examples include Standard, GPU, and High-performance shapes.
✅ Use Cases:
Running web applications, databases, and enterprise applications.
Hosting dev/test environments.
General-purpose virtual servers for light-to-medium workloads.
Bare Metal Instances:
Dedicated physical servers without virtualization, providing complete access to the hardware.
No hypervisor overhead, giving maximum performance and isolation.
✅ Use Cases:
High-performance computing (HPC) workloads that require full control over hardware.
Databases and applications that demand high CPU and memory.
Autonomous Linux (AL):
A fully managed OS designed by Oracle to run in OCI with automatic patching, maintenance, and security updates.
✅ Use Cases:
Running Oracle workloads without manual maintenance.
Ideal for database and enterprise applications.
2. Compute Shapes
A shape in OCI determines the resource allocation for a compute instance, such as CPU cores, memory, and network performance.
Standard shapes: General-purpose, balanced compute.
High-performance shapes: For compute-heavy workloads like big data, AI/ML, and video rendering.
GPU shapes: For graphics-intensive workloads, including AI/ML and rendering.
3. Oracle Cloud VM Types
VM.Standard: General-purpose virtual machines for everyday workloads.
VM.DenseIO: For workloads that need higher storage IOPS.
VM.GPU: For AI, ML, graphics, and high-performance computing.
VM.Extended: For memory-intensive workloads.
4. Oracle Functions (Serverless Compute)
A serverless compute service allowing you to run stateless functions without provisioning or managing servers.
Triggered by events (e.g., file uploads, database updates).
Automatically scales based on demand.
✅ Use Cases:
Building event-driven architectures.
Running small pieces of code without worrying about infrastructure.
Key Benefits of OCI Compute:
Scalability:
Scale vertically (up/down) by resizing instances, or horizontally (in/out) by adding or removing instances.
Customization:
Choose from a wide variety of shapes, storage options, and network configurations to meet the needs of your workloads.
Flexibility:
You can use VMs, bare metal instances, and serverless to run applications in the way that best suits your architecture.
Cost-effective:
Pay for the exact compute resources you use. You can also utilize preemptible instances for additional cost savings in non-production workloads.
High Availability & Redundancy:
Instances can be distributed across Availability Domains and Fault Domains for resilience.
Auto-scaling can be set to scale the instance based on workload demand.
Security:
Secure compute instances with firewalls, security lists, and private IPs.
Use Oracle Cloud’s Identity and Access Management (IAM) to control access.
Use Cases for OCI Compute:
Hosting Applications: Running enterprise applications, databases, and middleware.
Development & Testing: Easily spin up and tear down VMs or bare metal instances for dev/test environments.
Big Data & Machine Learning: Run large-scale analytics, AI, and ML workloads with high-performance compute shapes and GPUs.
Web Hosting: Hosting websites and web apps in scalable compute instances.
Disaster Recovery: Quickly provision compute resources for backup and DR scenarios.
Example Scenario:
If you are running a web application, you would likely:
Provision a Compute Instance (VM) with enough CPU and memory to handle your application's load.
Attach Block Volumes for additional storage, like for databases or file storage.
Use Load Balancers and Auto-scaling to ensure that your application scales based on traffic.
Virtual Cloud Network (VCN):
===========================
It allow Securely Communication between OCI resources and internet or on-premises database.Lives in OCI region highly available , scalable and secure.
Each resource that is connected to this VCN will get its own unique private IP.
It is a Virtual Cloud Network (VCN) is a customizable, private network that allows you to deploy resources like compute instances, databases, and storage. It is similar to a traditional data center network but in the cloud.
Components of a VCN:
CIDR Block: Defines the IP address range for the VCN (e.g., 10.0.0.0/16).
Subnets: Logical divisions within the VCN, used to group resources.
Route Table: Determines how network traffic is directed within the VCN and to external networks.
Internet Gateway: Allows resources within the VCN to communicate with the internet.
NAT Gateway: Enables instances in a private subnet to access the internet without being directly exposed.(only outbound communication inbound blocks)patch and updates
Dynamic Routing Gateway (DRG): Connects the VCN to on-premises networks via VPN or FastConnect.
Service Gateway: Allows private access to Oracle Cloud services like Object Storage without internet exposure.
Security Lists: Acts as a firewall, controlling inbound and outbound traffic at the subnet level.
Network Security Groups (NSG): Provides security rules at the instance level, offering more flexibility than security lists.
Local Peering Gateway (LPG): Enables communication between two VCNs in the same region.
Remote Peering Gateway (RPG): Enables communication between VCNs in different regions.
1. Local Peering Gateway (LPG)
==============================
Purpose: Connects two VCNs within the same OCI region.
Use Case: Useful when you want to enable private communication between VCNs in the same region without routing traffic over the internet.
Key Points:
Supports private IP communication between VCNs in the same region.
No need for a public internet gateway or NAT gateway.
The two VCNs can be in the same or different compartments but must be in the same region.
Route rules must be configured in both VCNs to enable traffic flow.
ex - DR setup
2. Remote Peering Gateway (RPG)
==============================
Purpose: Connects two VCNs located in different OCI regions.
Use Case: Enables private traffic exchange between VCNs in different regions without using the public internet.
Key Points:
Enables secure, private connectivity between VCNs in different regions.
Requires a DRG (Dynamic Routing Gateway) on each side to establish the connection.
Route rules and security lists must be properly configured for traffic flow.
Unlike LPGs, RPGs are set up using RPC (Remote Peering Connection) between regions.
Which One to Use?
Use LPG when you need to connect VCNs inside the same region.
Use RPG when you need to connect VCNs across different OCI regions.
CIDR :
------
(Classless Inter-Domain Routing) blocks are a method for representing IP address ranges and subnetting in a more flexible and efficient way than traditional IP address classes.
CIDR is widely used in networking to allocate IP addresses and manage routing.
Why Use CIDR?
Flexibility: Allows for variable-length subnet masking, accommodating networks of different sizes.
Scalability: Reduces the size of routing tables by aggregating smaller subnets into a single block.
Conservation: Helps conserve IP address space by avoiding the waste associated with fixed class boundaries.
Subnet :
--------
In Oracle Cloud Infrastructure (OCI), a subnet is a segment of a Virtual Cloud Network (VCN) that allows you to organize and control resources such as compute instances and databases within a VCN. Subnets are critical for defining the IP addressing, access control, and routing within your cloud environment.
Subnets let you divide the VCN into one or more subnetworks
Components of a Subnet:
Subnet CIDR Block: A portion of the VCN’s IP range allocated to the subnet (e.g., 10.0.1.0/24).
Public or Private Subnet:
Public Subnet: Resources can access the internet via an Internet Gateway.
Private Subnet: Resources do not have direct internet access and usually use a NAT Gateway for outbound traffic.
Route Table Association: Defines how traffic from the subnet is routed.
Security List: Controls inbound and outbound traffic at the subnet level.
DHCP Options: Provides DNS configuration and search domains for resources in the subnet.
Key Features of Subnets in OCI
IP Addressing:
Each subnet has a CIDR block (a range of IP addresses).
Resources within a subnet receive private IP addresses from this range.
Subnets can be as small as /30 (4 IPs) and as large as /16 (65,536 IPs).
Regional or Availability Domain (AD) Scope :
Subnets can be either:
Regional: Spanning all availability domains in a region.
AD-Specific: Limited to a single availability domain.
Regional subnets are more flexible and widely recommended.
Public and Private Subnets:
Public Subnet: Associated with a route table that has an internet gateway. Resources in a public subnet can access the internet directly if assigned a public IP.
Private Subnet: Does not have a route to the internet gateway. Resources in a private subnet cannot directly access the internet.
Security:
Subnets are linked to security lists or network security groups (NSGs) to control inbound and outbound traffic.
Routing:
Subnets are associated with a route table that determines how traffic is routed within and outside the VCN.
Security List:
--------------
Set of rules which define what kind of traffic is allowed in and out in the subnet - Ingress and eggress rules
A set of stateful and stateless firewall rules applied to a subnet, controlling inbound and outbound traffic at the subnet level.
What is a Security List in OCI?
--------------------------------
A Security List in Oracle Cloud Infrastructure (OCI) acts as a virtual firewall that controls ingress (incoming) and egress (outgoing) traffic at the subnet level. It defines rules that determine which types of network traffic are allowed or denied for instances in a VCN (Virtual Cloud Network).
Key Features of Security Lists
✔ Subnet-Level Control → Applied to all instances within a subnet.
✔ Stateless & Stateful Rules → Supports both stateful and stateless filtering.
✔ Ingress & Egress Rules → Define incoming and outgoing traffic policies.
✔ Flexible Management → Multiple security lists can be applied to a subnet.
✔ Works with Network Security Groups (NSG) → For fine-grained instance-level security.
Types of Security Rules in OCI Security Lists
Ingress Rules (Incoming Traffic) → Control inbound traffic to instances.
Egress Rules (Outgoing Traffic) → Control outbound traffic from instances.
How to Configure a Security List in OCI?
1. Create or Modify a Security List
Go to OCI Console → Networking → Virtual Cloud Networks (VCN)
Select your VCN → Click Security Lists
Click Create Security List or select an existing one
2. Add Ingress Rules (Example for SSH & Web Traffic)
Source CIDR Protocol Port Description
0.0.0.0/0 TCP 22 Allow SSH access (Linux)
0.0.0.0/0 TCP 3389 Allow RDP access (Windows)
0.0.0.0/0 TCP 80 Allow HTTP access
0.0.0.0/0 TCP 443 Allow HTTPS access
3. Add Egress Rules (Allow All Outbound Traffic)
Destination CIDR Protocol Port Description
0.0.0.0/0 All Protocols All Allow all outbound traffic
4. Attach Security List to a Subnet
Go to VCN → Subnets
Edit the Subnet and attach the Security List
Best Practices for Using Security Lists in OCI
✅ Use Stateful Rules for most traffic to avoid unnecessary return traffic rules.
✅ Restrict SSH/RDP Access → Instead of 0.0.0.0/0, allow only from specific IPs (e.g., your office network).
✅ Use Network Security Groups (NSG) for instance-level security when needed.
✅ Apply Least Privilege → Only allow necessary ports and protocols.
NSG (Network Security Group)
------------------------------
It is a security feature used to control inbound and outbound traffic in a network by defining rules based on IP addresses, ports, and protocols.
A virtual firewall with rules for controlling traffic at the resource level, offering fine-grained security for specific instances or services in a VCN.
Key Features of NSG:
✅ Traffic Control: Allows or denies network traffic based on defined rules.
✅ Applied at Different Levels: Can be associated with subnets or individual network interfaces (vNICs).
✅ Inbound & Outbound Rules: Controls both incoming and outgoing traffic.
✅ Stateful Security: If an inbound rule allows traffic, the corresponding outbound response is automatically allowed.
✅ Common in Cloud Environments: Used in Azure, OCI (Oracle Cloud Infrastructure), AWS (as Security Groups).
Example Use Case:
In Azure: An NSG attached to a virtual machine's vNIC allows SSH (port 22) traffic only from a specific IP range.
In Oracle Cloud Infrastructure (OCI): An NSG restricts database access (port 1521) to only application servers.
Stateful vs. Stateless in Network Security Rules :
OCI Security Lists and Network Security Groups (NSGs) allow you to define Ingress (Inbound) and Egress (Outbound) rules. These rules can be stateful or stateless.
Feature Stateful Stateless
Connection Tracking Yes (keeps track of session state) No (each packet is treated independently)
Automatic Return Traffic Allowed automatically Must be explicitly allowed with another rule
Performance Slightly slower due to connection tracking Faster due to no tracking overhead
Use Case Secure critical workloads (DB, app servers) High-performance workloads (DNS, stateless APIs)
Example:
Stateful Rule: If you allow an incoming SSH (port 22) connection, the return traffic is automatically allowed.
Stateless Rule: You must create a separate outbound rule to allow the return SSH traffic.
Gateways:
---------
Gateways enable connectivity between your VCN and external networks or services:
Internet Gateway: Provides public internet access for resources in a VCN. ( VCN to Internet communication)
NAT Gateway: Allows private resources to access the internet without being exposed.(Only outbound traffic allowed inbound blocks)patching and updates
Service Gateway: Enables private access to Oracle services (e.g., database,Object Storage) without internet.(VCN to OCI resources private access )
Dynamic Routing Gateway (DRG): Connects your VCN to on-premises networks via VPN or FastConnect.( Communication between VCN and apart from internet access like onprem db,GG services)
What is an Internet Gateway in OCI?
-----------------------------------
An Internet Gateway (IGW) in Oracle Cloud Infrastructure (OCI) is a virtual gateway that allows resources in a Virtual Cloud Network (VCN) to access the public internet. It also enables incoming connections from the internet to resources like web servers.
Key Features of Internet Gateway (IGW):
Enables Public Internet Access → Allows outbound and inbound traffic to/from the internet.
Used for Public Resources → Typically used for resources with public IPs, such as web servers.
No NAT Required → Unlike a NAT Gateway, IGW does not mask private IPs; it directly routes traffic.
Requires a Route Rule → Needs to be added to the VCN Route Table to function properly.
Security Controlled via Security Lists → You must allow the necessary ingress (incoming) and egress (outgoing) rules in Security Lists or Network Security Groups (NSG).
How to Set Up an Internet Gateway in OCI?
Create an Internet Gateway
Go to Networking → Virtual Cloud Networks (VCN)
Select your VCN → Click Internet Gateway
Click Create Internet Gateway, give it a name, and click Create
Update the Route Table
Go to VCN → Route Tables
Select the Default Route Table (or create a new one)
Add a new route rule:
Destination CIDR: 0.0.0.0/0 (this means all internet traffic)
Target Type: Internet Gateway
Target: Select the Internet Gateway created in step 1
Configure Security Rules
Go to VCN → Security Lists
Edit the Security List attached to your Subnet
Add an Ingress Rule (to allow incoming traffic):
Source CIDR: 0.0.0.0/0 (public internet)
Protocol: TCP
Port: 80 (HTTP) or 443 (HTTPS) for web servers
Add an Egress Rule (to allow outgoing traffic):
Destination CIDR: 0.0.0.0/0
Protocol: All Protocols (or specify needed ones)
Use Cases of Internet Gateway
Hosting Public-Facing Web Applications → Web servers, APIs, etc.
Connecting Cloud Resources to the Internet → Software updates, API calls, etc.
Allowing Users to Access OCI Resources from Anywhere → Remote SSH/RDP access to public instances.
What is a NAT Gateway in OCI?
-----------------------------
A NAT (Network Address Translation) Gateway in Oracle Cloud Infrastructure (OCI) allows resources in a private subnet to initiate outbound internet traffic while preventing any inbound traffic from the internet.
Key Features of NAT Gateway in OCI
✔ Outbound Internet Access for Private Subnets → Resources in a private subnet can connect to the internet (e.g., for updates or API calls).
✔ Blocks Incoming Internet Traffic → Ensures security by not exposing private resources to the internet.
✔ No Public IP Required → Private instances don’t need public IPs to access the internet.
✔ Stateless & Scalable → Automatically manages NAT sessions without user intervention.
✔ Works with Route Tables → Requires a route rule for traffic forwarding.
How to Set Up a NAT Gateway in OCI?
1. Create a NAT Gateway
Go to OCI Console → Networking → VCNs
Select your VCN → Click NAT Gateway
Click Create NAT Gateway, give it a name, and click Create
2. Update the Route Table
Go to VCN → Route Tables
Select the Route Table for the Private Subnet
Add a new route rule:
Destination CIDR: 0.0.0.0/0 (all internet traffic)
Target Type: NAT Gateway
Target: Select the NAT Gateway created in Step 1
3. Security List Rules (Optional)
Ensure Egress (outgoing) traffic is allowed in the Security List of the private subnet:
Destination CIDR: 0.0.0.0/0
Protocol: All Protocols or specific ones (e.g., HTTP, HTTPS, etc.)
Use Cases of NAT Gateway
✅ Updating Software in Private Instances (e.g., yum update in Linux servers)
✅ Downloading Patches & Packages without exposing private resources
✅ Connecting to Public APIs & Services securely
✅ Secure Data Transfer from private instances to the internet
What is a Service Gateway in OCI?
--------------------------------
A Service Gateway in Oracle Cloud Infrastructure (OCI) allows private resources in a VCN (Virtual Cloud Network) to securely access OCI services (like Object Storage, Autonomous Database, etc.) without using the public internet.
Key Features of Service Gateway
✔ Private Access to OCI Services → No need for public IPs or NAT Gateway.
✔ Highly Secure → Traffic stays within OCI's private backbone network.
✔ Works with Route Tables → Needs proper routing rules for traffic forwarding.
✔ No Additional Cost → Included as part of OCI networking services.
✔ Supports Multiple OCI Services → Access Object Storage, Autonomous DB, API Gateway, etc.
How to Set Up a Service Gateway in OCI?
1. Create a Service Gateway
Go to OCI Console → Networking → VCNs
Select your VCN → Click Service Gateway
Click Create Service Gateway, give it a name, and choose:
Service Category: "All Oracle Services in <region>" (recommended)
Click Create
2. Update the Route Table
Go to VCN → Route Tables
Select the Route Table for the Private Subnet
Add a new route rule:
Destination CIDR: OCI Services CIDR (e.g., all-services-in-oracle-services-network)
Target Type: Service Gateway
Target: Select the Service Gateway created in Step 1
Use Cases of Service Gateway
✅ Access OCI Object Storage privately (e.g., backups, log storage).
✅ Connect to Autonomous Database without public internet exposure.
✅ Securely use Oracle Cloud Infrastructure Registry (OCIR) for container images.
✅ Enable API Gateway access for private applications.
Dynamic Routing Gateway :
--------------------------
In Oracle Cloud Infrastructure (OCI), DRG (Dynamic Routing Gateway) is a virtual gateway that provides private connectivity between on-premises networks, VCNs (Virtual Cloud Networks) in different regions, or even different tenancies. It enables routing of network traffic between these environments efficiently.
Key Features of DRG in OCI:
VCN Peering: Connects multiple VCNs across different regions or tenancies.
On-Premises Connectivity: Works with FastConnect or IPSec VPN for hybrid cloud architectures.
Multi-Path Routing: Supports BGP for dynamic route propagation.
Centralized Traffic Management: Routes traffic between VCNs, on-premises, and even third-party networks.
High Availability: Uses redundant paths to ensure reliable connectivity.
Use Cases:
Connecting on-premises data centers with OCI.
Enabling VCN-to-VCN communication across regions.
Building multi-cloud or hybrid cloud architectures.
To create a Dynamic Routing Gateway (DRG) in Oracle Cloud Infrastructure (OCI), follow these steps:
Using the OCI Console:
Log in to the OCI Console.
In the Navigation menu, go to Networking → Dynamic Routing Gateways.
Click Create Dynamic Routing Gateway.
Provide the following details:
Name: A meaningful name for the DRG.
Compartment: Choose the correct compartment.
Click Create DRG.
Attach DRG to a VCN:
Navigate to VCN → Your VCN Name.
Under Resources, select Dynamic Routing Gateway Attachments.
Click Attach DRG and select the DRG you just created.
Click Attach.
Update the Route Table:
Go to Networking → VCN → Route Tables.
Choose the Route Table associated with your VCN.
Click Add Route Rule:
Destination CIDR: The network you want to route.
Target Type: Dynamic Routing Gateway (DRG).
Target DRG: Select the DRG you created.
Click Save Changes.
Using OCI CLI:
Run the following command to create a DRG:
oci network drg create --compartment-id <compartment_OCID> --display-name "MyDRG"
Attach it to a VCN:
oci network drg-attachment create --drg-id <DRG_OCID> --vcn-id <VCN_OCID> --display-name "MyDRG_Attachment"
What is DHCP? (Dynamic Host Configuration Protocol) :
DHCP (Dynamic Host Configuration Protocol) is a network protocol that automatically assigns IP addresses and other network configurations (like DNS, gateway, and subnet mask) to devices on a network. This eliminates the need for manual IP configuration.
* What are the components of Oracle OCI?
The following components are involved in the OCI network:
Virtual Cloud Network
Subnet
Virtual network interface card
Security lists
Route tables
Route rules
Route tables :
==============
A Route Table is a data structure used in networking to determine where data packets should be forwarded. It contains a list of network destinations (routes) and the associated next hop (gateway) or interface that should be used to reach those destinations.
Key Components of a Route Table:
Destination: The target network or IP address.
Subnet Mask: Defines the range of IP addresses for the destination.
Next Hop: The IP address of the next router or gateway to forward the packet.
Interface: The network interface through which the packet should be sent.
Metric: A value that indicates the priority of the route (lower values are preferred).
vNIC :
======
A vNIC (Virtual Network Interface Card) is a software-based network interface that allows virtual machines (VMs) or containers to communicate over a network, just like a physical NIC in a traditional server.
Key Features of vNIC:
Used in Virtualization: vNICs are assigned to VMs in hypervisors like VMware, Oracle VirtualBox, KVM, and Hyper-V.
Software-Defined: Unlike physical NICs, vNICs exist in software and are managed by the hypervisor.
Connects VMs to Networks: Allows VMs to communicate within a virtual network, with other VMs, or external networks.
Supports VLANs & Security: Can be assigned to specific VLANs and security policies for network segmentation.
Performance & Scalability: Some vNICs support SR-IOV (Single Root I/O Virtualization) for better performance by bypassing the hypervisor.
Example Usage:
In VMware ESXi, a vNIC connects a VM to a vSwitch (Virtual Switch), enabling network communication.
In Oracle Cloud Infrastructure (OCI), a vNIC attaches a compute instance to a Virtual Cloud Network (VCN).
1. Virtual Machines (VMs) :
Architecture: VMs run on a hypervisor, which virtualizes hardware resources.
Isolation: Each VM has its own operating system (OS), kernel, libraries, and dependencies.
Resource Utilization: VMs require more resources as they run full OS instances.
Startup Time: Slower compared to containers because a full OS needs to boot.
Flexibility: Suitable for running traditional applications, databases, and enterprise workloads.
OCI Service: Compute Instances (e.g., Bare Metal or Virtual Machine instances).
2. Containers :
Architecture: Containers run on a shared OS kernel but are isolated at the application level.
Isolation: Lightweight compared to VMs since they share the host OS.
Resource Utilization: More efficient as they don’t require separate OS instances.
Startup Time: Faster because they don’t need to boot a full OS.
Flexibility: Ideal for microservices, cloud-native applications, and DevOps.
OCI Service: Oracle Container Engine for Kubernetes (OKE) or Container Registry (OCIR).
When to Use What?
Use VMs if you need full OS control, better isolation, and compatibility with legacy applications.
Use Containers for lightweight, scalable applications, DevOps, and microservices.
Hypervisor:
============
A hypervisor, also known as a virtual machine monitor (VMM), is software or firmware that enables virtualization. It allows multiple virtual machines (VMs) to run on a single physical server or host machine. These VMs can run different operating systems and applications independently, while sharing the resources (CPU, memory, storage) of the underlying physical machine.
Types of Hypervisors:
Type 1 Hypervisor (Bare-metal Hypervisor):
Runs directly on the physical hardware of the host machine, without an underlying operating system.
It manages the hardware and allocates resources to the virtual machines.
Since it has direct access to hardware, Type 1 hypervisors are generally more efficient and offer better performance.
✅ Examples:
VMware ESXi
Microsoft Hyper-V
Xen
Oracle VM Server for x86
✅ Use Cases:
Data centers and cloud environments where performance, security, and scalability are critical.
Type 2 Hypervisor (Hosted Hypervisor):
Runs on top of an existing operating system (the host OS).
It relies on the host OS for resource management and hardware access.
Type 2 hypervisors are typically easier to set up and use but can be less efficient than Type 1 because they depend on the host OS.
✅ Examples:
VMware Workstation
Oracle VirtualBox
Parallels Desktop
✅ Use Cases:
Desktop environments, personal computers, and testing environments where performance is not as critical.
How Hypervisors Work:
Virtual Machines (VMs):
A VM runs on top of the hypervisor, and each VM has its own guest operating system (OS).
The hypervisor allocates resources (CPU, RAM, disk space) to each VM and isolates them so they don't interfere with each other.
The VMs are virtualized environments running independent OSes and applications.
Resource Management:
The hypervisor manages and allocates resources of the physical hardware (called the host) to the VMs (called guests).
It controls access to CPU cycles, memory, disk, and network resources for each guest OS.
Isolation:
VMs are isolated from each other, meaning the activities of one VM (e.g., software installation or OS crash) do not affect the others.
OCID :
======
OCID (Oracle Cloud Identifier) is a unique, immutable identifier assigned to every resource in Oracle Cloud Infrastructure (OCI). It helps distinguish resources like compute instances, block volumes, VCNs, compartments, and users.
Key Features of OCID:
✅ Globally Unique: Each resource in OCI has a distinct OCID.
✅ Immutable: Once assigned, it does not change.
✅ Structured Format: OCIDs follow a specific pattern for easy identification.
OCID Format Example:
ocid1.instance.oc1.phx.abcdefghijklmno1234567890abcdef
What is IAM (Identity and Access Management) in OCI?
-----------------------------------------------------
OCI IAM (Identity and Access Management) is a framework that helps control who can access what resources in Oracle Cloud Infrastructure (OCI) and what actions they can perform. It allows administrators to manage authentication and authorization for users, groups, and services.
Key Components of OCI IAM
1️⃣ Tenancy
The root container for all OCI resources in an account.
Represents the organization or company using OCI.
2️⃣ Users
Individuals or services that need access to OCI resources.
Can belong to one or more groups.
Each user must be authenticated (via passwords, API keys, or federated login).
3️⃣ Groups
A collection of users who share the same permissions.
Example:
Allow group DBAAdmins to manage databases in compartment Production
✔ This allows DBAAdmins to manage databases in the Production compartment.
4️⃣ Policies
Rules that define permissions for users, groups, or services.
Written in a human-readable format.
Example:
Allow group Developers to use instances in compartment Dev
✔ Allows Developers to start/stop instances in the Dev compartment.
5️⃣ Compartments
Logical containers used to organize resources (e.g., compute, storage, databases).
Policies are applied at the compartment level.
Example compartments:
Production (for live apps)
Development (for testing)
Finance (for financial reports)
6️⃣ Dynamic Groups
Special groups for compute instances and other OCI resources.
Example:
Allow dynamic-group MyComputeInstances to use object-family in tenancy
✔ Allows compute instances in MyComputeInstances to access Object Storage.
7️⃣ Federation
Enables SSO (Single Sign-On) using external identity providers (e.g., Microsoft Azure AD, Okta, IDCS).
Users don’t need separate OCI credentials.
8️⃣ Authentication Methods
Password-based authentication (for console login).
API Key-based authentication (for CLI and SDKs).
Auth Tokens (for third-party applications like Terraform).
Instance Principals (to allow OCI resources to authenticate automatically).
What is a Principal in OCI?
---------------------------
In Oracle Cloud Infrastructure (OCI), a Principal is an identity that can make API requests to access OCI resources. A principal can be a user or a service with permissions defined by IAM policies.
Types of Principals in OCI
*IAM Users (Human Principals)
Created in OCI’s Identity and Access Management (IAM).
Authenticated using passwords, API keys, authentication tokens, or federated login.
Assigned permissions via groups and IAM policies.
Example:
Allow group DBA_Group to manage databases in tenancy
*Instance Principals (Compute Instance as a Principal)
Allows a compute instance (VM or bare metal) to act as a principal.
The instance inherits permissions via a dynamic group and IAM policy
Allow dynamic-group MyInstanceGroup to read objects in compartment MyCompartment
Useful for automated tasks (e.g., running scripts that access Object Storage).
* Service Principals (Service-to-Service Access)
Some OCI services act as principals and can access other OCI services.
Example: Oracle Functions accessing OCI Object Storage without storing credentials.
IAM policies control their permissions.
Example:
Allow service objectstorage to manage buckets in tenancy
Policies in Oracle Cloud Infrastructure (OCI) :
---------------------------------------------
In OCI, policies define access control rules that determine who (users, groups, or services) can access what resources and what actions they can perform. Policies are written in a human-readable format and help enforce security and governance across OCI resources.
Key Components of an OCI Policy
Principal: The entity (user, group, dynamic group, or service) that gets permission.
Verb: The action being allowed or denied (e.g., inspect, read, use, manage).
Resource-Type: The OCI service or resource being controlled (e.g., instance_family, db_family, vcn, bucket).
Location (Scope): Specifies the compartment or tenancy level where the policy applies.
Common OCI Policy Verbs (Permissions)
Verb Description
inspect View metadata but not resource details.
read View metadata and details, but no modifications.
use Read and perform common actions (e.g., attach a volume).
manage Full access, including creation, modification, and deletion.
Allow group {group name} to manage database-family(resource_type) in compartment;
Allow group DBAAdmins to manage instances in compartment Production
Allow group Developers to use instances in compartment Dev
Dynamic Group :
===============
In Oracle Cloud Infrastructure (OCI) it is a logical grouping of compute instances that allows you to define policies for them without needing to manage individual instance identities. This is useful when you want to grant permissions dynamically based on instance properties rather than assigning static IAM roles.
Key Features of Dynamic Groups
Instance-Based Access Control – Allows compute instances to call OCI APIs without requiring a user login.
Dynamic Membership – Instances are automatically added based on conditions (e.g., compartment, tag, or OCID).
IAM Policy Integration – You can define IAM policies to grant permissions to instances in a dynamic group.
Use Case Example
You have an autonomous database and need a compute instance to read/write data from/to Object Storage. Instead of assigning credentials manually, you create a dynamic group and define policies to allow that instance to access Object Storage.
How to Create a Dynamic Group?
Go to OCI Console → Identity & Security → Dynamic Groups.
Click Create Dynamic Group.
Define Matching Rules:
Example Rule:
ALL {instance.compartment.id = 'ocid1.compartment.oc1..xxxx'}
This means all instances in the specified compartment will be part of this dynamic group.
Click Create.
Example Policy for a Dynamic Group
Once the group is created, you need to create a policy to grant permissions:
Allow dynamic-group <dynamic-group-name> to read objectstorage-namespaces in tenancy
Allow dynamic-group <dynamic-group-name> to manage objects in compartment <compartment-name>
This allows instances in the dynamic group to read Object Storage namespaces and manage objects.
Benefits
✔ No manual user authentication – Instances authenticate via Instance Principals.
✔ Automatic membership – No need to update policies when new instances are created.
✔ Fine-grained access control – You can limit permissions to specific compartments or resources.
Patching an OCI Bare Metal/VM DB System :
-------------------------------------------
Navigate to OCI Console → Database → DB Systems.
Select the target DB System.
Click Patching → Patch History.
Choose the patch and Apply Patch.
Monitor the patching status.
1. Block Storage
✅ Best For: Databases, applications, and workloads requiring high IOPS and low latency.
🔹 Structure: Data is stored in fixed-size blocks like a traditional hard drive.
🔹 Persistence: Persistent even if the compute instance is stopped.
🔹 Performance: High-performance, supports IOPS-intensive workloads.
🔹 Access: Attached as a disk (via iSCSI) to OCI Compute instances.
🔹 Scalability: Can be expanded up to 32 TB per volume, multiple volumes per instance.
🔹 Backup: Supports snapshots and cross-region backups for disaster recovery.
🔹 Encryption: Default AES-256 encryption, supports customer-managed keys.
🔹 Pricing: Charged based on provisioned GB per month and IOPS tier.
✅ Use Cases:
Hosting databases (Oracle DB, MySQL, PostgreSQL)
Enterprise applications (SAP, ERP systems)
Virtual machines and container storage
High-performance transactional workloads
2. Object Storage
✅ Best For: Storing unstructured data, backups, media files, and big data.
🔹 Structure: Stores data as objects (key-value pairs) in a flat namespace.
🔹 Persistence: Highly durable and redundant across multiple availability domains.
🔹 Performance: Designed for high throughput, not low-latency transactional access.
🔹 Access: Accessed via REST APIs, SDKs, CLI, or OCI console.
🔹 Scalability: Virtually unlimited, no predefined size limits.
🔹 Backup: Supports automatic versioning, lifecycle policies, and cross-region replication.
🔹 Encryption: Default AES-256 encryption, supports custom encryption keys.
🔹 Pricing: Charged based on storage usage (per GB) and data retrieval requests.
✅ Use Cases:
Storing logs, backups, images, and videos
Big data analytics and archiving
Data lakes for AI/ML workloads
Storing GoldenGate trail files
3. File Storage
✅ Best For: Shared file systems for applications, analytics, and user home directories.
🔹 Structure: File/s and folders, similar to NFS (Network File System).
🔹 Persistence: Persistent, supports POSIX-compliant file system.
🔹 Performance: High-throughput storage for shared workloads.
🔹 Access: Accessed via NFS v3/v4 protocol by multiple compute instances.
🔹 Scalability: Supports up to 8 exabytes, auto-scaling capacity.
🔹 Backup: Supports snapshots for point-in-time recovery.
🔹 Encryption: Default AES-256 encryption, supports customer-managed keys.
🔹 Pricing: Charged based on storage used per GB per month.
✅ Use Cases:
High-performance computing (HPC) and AI/ML workloads
Shared storage for Oracle RAC databases
Web applications and content management systems
Shared home directories and collaboration
Which One Should You Use?
If you need high-performance disk storage for databases or VMs → Block Storage
If you need scalable, durable storage for backups, media, or logs → Object Storage
If you need shared file storage for multiple instances or applications → File Storage
1. Boot Volume :
===============
✅ Used For: Storing the operating system (OS) of a compute instance.
🔹 Purpose: Acts as the primary disk for booting up an OCI compute instance.
🔹 Size: Starts from 50 GB (default) and can be increased.
🔹 Persistence:
By default, deleted when the compute instance is terminated.
You can choose to preserve it for later use.
🔹 Attachment: Automatically attached to the compute instance as the primary disk.
🔹 Backup & Cloning:
Supports backups and snapshots.
Can be cloned to create a new boot volume for another instance.
🔹 Encryption:
AES-256 encryption by default.
Supports customer-managed encryption keys.
✅ Use Cases:
Booting and running an OS (Linux, Windows, etc.)
Creating custom images for new instances
Cloning a system for disaster recovery or migration
2. Block Volume :
================
✅ Used For: Storing additional data (applications, databases, logs, etc.).
🔹 Purpose: Works like an external hard drive attached to a compute instance.
🔹 Size: 50 GB – 32 TB per volume, multiple volumes can be attached.
🔹 Persistence: Data persists even if the compute instance is terminated.
🔹 Attachment:
Can be attached to multiple instances in read-only mode.
Supports Read/Write (single instance) or Read-Only (multi-instance) mode.
🔹 Backup & Cloning:
Supports snapshots and cross-region backups.
Can be detached and re-attached to other instances.
🔹 Encryption:
AES-256 encryption by default.
Supports customer-managed encryption keys.
✅ Use Cases:
Storing databases, application files, logs, and large datasets
Adding extra storage to a compute instance
Moving storage between instances
Creating snapshots for backups and disaster recovery
Difference between IPv4 and IPv6:
| Feature | IPv4 | IPv6 |
|---------------------|----------------------------|--------------------------------------------|
| **Address Length** | 32-bit | 128-bit |
| **Address Format** | Dotted decimal (e.g., 192.168.1.1) | Hexadecimal with colons (e.g., 2001:0db8:85a3::8a2e:0370:7334) |
| **Number of Addresses** | ~4.3 billion | 340 undecillion (3.4 × 10³⁸) |
| **Header Complexity** | More complex | Simplified |
| **Broadcast Support** | Yes | No (uses multicast instead) |
| **Security** | Optional (IPSec optional) | Built-in IPSec support |
| **Address Auto-Configuration** | Uses DHCP | Supports both DHCPv6 and stateless auto-configuration |
| **Backward Compatibility** | No direct compatibility with IPv6 | Can work alongside IPv4 (dual stack) |
Key Differences:
- IPv6 provides a much larger address space, removing the need for NAT (Network Address Translation).
- IPv6 has better built-in security with mandatory IPSec.
- IPv6 simplifies packet processing, making routing more efficient.
OCI's Data safe featureds
1) Security assessment - It evaluate database security posture .It identifies, categorizes, and prioritizes risks and delivers comprehensive assessment reports on security parameters, security controls in use, and user roles and privileges. It creates baselines and provide recommendations
2) User Assessment – It identifies which users have the highest risk, reviews privileges granted to those users, and allows for analysis of user activity. Identify risky behavior and overprivileged users
3) Activity Auditing – it collects audit data from databases and identify anomalous operations to analyze database activity
4) Sensitive data discovery – It discovers and classify sensitive data based on a library of more than 150 predefined sensitive data types. Predefined data types also come with predefined masking formats, such as personal identifiers, IT data, financial data, healthcare data, and employment data.
5) Data Masking - It offers predefined masking formats as well as the ability to define custom-masking formats to meet specific organizational requirements.
6) Cloud or On-Prem Support – It helps to secure all Oracle databases, including Oracle Autonomous Database, Oracle Database Cloud Service, Oracle Database Enterprise Edition, and Oracle Database Standard Edition running on-premises, as well as databases in Oracle Cloud Infrastructure (OCI), in third-party public clouds, or on Oracle Exadata Cloud@Customer.
--------------------------------------------------------------------------
How does OCI handle data security, including encryption at rest and in transit?
Answer: OCI provides encryption mechanisms for data security. Data at rest is encrypted using encryption keys managed by OCI. Data in transit is secured through SSL/TLS encryption. Oracle Cloud offers robust security features to protect data.
What is the role of a load balancer in OCI, and why would you use it?
Answer: A load balancer distributes incoming traffic across multiple instances to ensure high availability and scalability of applications. Load balancers improve application performance and provide fault tolerance by directing traffic to healthy instances
Can you explain the concept of scaling in Oracle Cloud?
Ans: Scaling in Oracle Cloud involves adjusting the resources (such as CPU, memory, and storage) allocated to an application or service based on demand to ensure optimal performance and cost-efficiency.
How do you migrate an on-premises database to Oracle Cloud?
Ans: Oracle provides various migration tools such as Data Pump, RMAN, and the Database Migration Assistant for simplifying the migration process and moving databases from on-premises to Oracle Cloud.
What is the role of Oracle Integration Cloud (OIC)?
Ans: Oracle Integration Cloud enables organizations to integrate applications, data, and services across different systems, both on-premises and in the cloud, to streamline business processes.
How can you monitor and manage resources in Oracle Cloud?
Ans: Oracle Cloud offers a monitoring service that provides real-time insights into resource utilization, performance, and availability. Additionally, tools like Resource Manager and Cost Management help with resource management and optimization.
How do you ensure high availability in Oracle Cloud?
Ans: Oracle Cloud provides features such as Load Balancer, Auto Scaling, and regional data centers for redundancy, ensuring high availability and minimizing downtime.
What is Oracle Cloud Infrastructure as Code (IaC)?
Ans: Oracle Cloud Infrastructure as Code refers to the practice of defining and provisioning cloud resources using declarative configuration files or scripts, ensuring consistency and reproducibility.
How does Oracle Cloud support disaster recovery?
Ans: Oracle Cloud offers disaster recovery solutions like Oracle Data Guard and backup services, allowing organizations to replicate data and ensure business continuity in case of a disaster.
How can you optimize costs in Oracle Cloud?
Ans: Oracle Cloud provides cost management tools for analyzing resource usage, rightsizing instances, and implementing reserved instances or savings plans to optimize costs.
What are some key features of Oracle Analytics Cloud (OAC)?
Ans: Oracle Analytics Cloud offers self-service data visualization, advanced analytics, AI-driven insights, and embedded analytics capabilities to empower business users with data-driven decision-making.
Can you explain the concept of containers and container orchestration in Oracle Cloud?
Ans: Oracle Cloud supports containerized deployments using technologies like Docker and Kubernetes, providing container orchestration capabilities for managing and scaling containerized applications.
Can you explain how Oracle Cloud supports multi-cloud and hybrid cloud environments?
Ans: Oracle Cloud offers solutions like Oracle Cloud@Customer and Oracle Cloud Infrastructure FastConnect to support hybrid cloud architectures, enabling seamless integration with other cloud providers.
What is the role of Oracle Cloud Infrastructure Networking?
Ans: Oracle Cloud Infrastructure Networking enables organizations to create virtual networks, subnets, load balancers, and VPN connections, facilitating network connectivity and isolation within the cloud environment.
How do you handle data integration between Oracle Cloud and on-premises systems?
Ans: Oracle Cloud provides integration tools like Oracle Integration Cloud and Oracle Data Integrator (ODI) for seamless data integration between cloud and on-premises systems.
Can you explain the concept of serverless computing in Oracle Cloud?
Ans: Oracle Cloud provides a serverless computing platform, Oracle Functions, where developers can write and execute code without the need to manage server infrastructure, allowing for scalable and event-driven applications.
Comments
Post a Comment