LAB 67 ‐ Prepare DR and establish inter hub connectivity - DevWithNehaCloud/Oracle-Cloud-Infrastructure-wiki GitHub Wiki
Prepare DR and Establish Inter-Region Hub Connectivity Using DRG and RPC
Lab Note: For this lab, Ashburn was used as the Primary region and Hyderabad as the DR (Secondary) region because Hyderabad had already been subscribed for testing and learning purposes. In a production environment, the DR region should be selected based on business requirements, compliance, latency, disaster recovery strategy, and regulatory considerations.
Objective
The objective of this lab is to prepare a Disaster Recovery (DR) environment in a secondary OCI region (Hyderabad), establish private connectivity between the primary region (Ashburn) and DR region using DRG and Remote Peering Connection (RPC), and validate connectivity using private IP communication.
Architecture
Primary Region (Ashburn)
| Resource | CIDR |
|---|---|
| Hub VCN | 10.0.0.0/24 |
| Public Subnet | 10.0.0.0/25 |
| Private Subnet | 10.0.0.128/25 |
| Bastion VM | 10.0.0.x |
DR Region (Hyderabad)
| Resource | CIDR |
|---|---|
| Hub VCN | 10.0.2.0/24 |
| Public Subnet | 10.0.2.0/25 |
| Private Subnet | 10.0.2.128/25 |
| Test VM | 10.0.2.x |
High Level Architecture
Ashburn Region (Primary)
------------------------------------------------
Hub VCN (10.0.0.0/24)
|
|
DRG
|
|
RPC
================ OCI Backbone Network ================
RPC
|
|
DRG
|
|
Hub VCN (10.0.2.0/24)
------------------------------------------------
Hyderabad Region (DR)
Step 1 - Subscribe to DR Region
- Navigate to:
Identity & Security
→ Regions
- Subscribe to:
ap-hyderabad-1
- Wait until the region becomes active.
Step 2 - Create DR Hub VCN
Navigate to:
Networking
→ Virtual Cloud Networks
→ Create VCN
Provide:
| Parameter | Value |
|---|---|
| VCN Name | hyd-hub-vcn |
| CIDR Block | 10.0.2.0/24 |
Step 3 - Create Public Subnet
Navigate to:
VCN
→ Create Subnet
| Parameter | Value |
|---|---|
| Name | hyd-hub-public-subnet |
| CIDR | 10.0.2.0/25 |
| Type | Public |
Step 4 - Create Private Subnet
Navigate to:
VCN
→ Create Subnet
| Parameter | Value |
|---|---|
| Name | hyd-hub-private-subnet |
| CIDR | 10.0.2.128/25 |
| Type | Private |
Step 5 - Create DRG in Hyderabad
Navigate to:
Networking
→ Dynamic Routing Gateways
→ Create DRG
Example:
hyd-drg
Step 6 - Attach Hub VCN to DRG
Navigate to:
DRG
→ Create Attachment
Select:
Attachment Type : VCN
VCN : hyd-hub-vcn
Verify attachment status:
Attached
Step 7 - Create RPC in Hyderabad
Navigate to:
DRG
→ Remote Peering Connections
→ Create RPC
Example:
hyd-to-ash-rpc
Save the RPC.
Step 8 - Create RPC in Ashburn
Navigate to:
Ashburn Region
→ DRG
→ Remote Peering Connections
→ Create RPC
Example:
ash-to-hyd-rpc
Step 9 - Establish RPC Peering
Copy the Hyderabad RPC OCID.
Navigate to Ashburn RPC.
Actions
→ Establish Connection
Provide:
| Parameter | Value |
|---|---|
| Region | ap-hyderabad-1 |
| Remote RPC OCID | Hyderabad RPC OCID |
Click:
Establish Connection
Step 10 - Verify RPC Status
Navigate to:
DRG
→ Remote Peering Connections
Verify:
Peer Status = PEERED
Expected:
Ashburn RPC → PEERED
Hyderabad RPC → PEERED
Step 11 - Configure Route Table (Ashburn)
Navigate to:
Hub Public Subnet
→ Route Table
Add Rule:
| Destination | Target |
|---|---|
| 10.0.2.0/24 | DRG |
Step 12 - Configure Route Table (Hyderabad)
Navigate to:
Hub Public Subnet
→ Route Table
Add Rule:
| Destination | Target |
|---|---|
| 10.0.0.0/24 | DRG |
Step 13 - Configure Security Rules (Ashburn)
Navigate to:
Security List
→ Ingress Rules
Add:
| Source CIDR | Protocol |
|---|---|
| 10.0.2.0/24 | ICMP |
Step 14 - Configure Security Rules (Hyderabad)
Navigate to:
Security List
→ Ingress Rules
Add:
| Source CIDR | Protocol |
|---|---|
| 10.0.0.0/24 | ICMP |
Step 15 - Launch Test VM in Hyderabad Hub VCN
Navigate to:
Compute
→ Create Instance
Select:
| Parameter | Value |
|---|---|
| VCN | hyd-hub-vcn |
| Subnet | hyd-hub-public-subnet |
| Public IP | Yes |
Example:
hyd-test-vm
Step 16 - Connectivity Validation
Login to Ashburn Bastion Server.
Example:
ssh opc@<Ashburn-Public-IP>
Verify Hyderabad VM connectivity using Private IP:
ping 10.0.2.x
Expected Result:
64 bytes from 10.0.2.x
icmp_seq=1 ttl=61 time=xx ms
Step 17 - Security Validation
To validate security controls:
- Remove ICMP ingress rule from Hyderabad Security List.
- Retry ping.
Expected:
100% packet loss
- Re-add ICMP rule.
- Retry ping.
Expected:
Ping successful
This confirms Security List enforcement is working correctly.
Troubleshooting Performed
Issue
Ping failed after successful RPC peering.
Root Cause
Test VM was deployed in Hyderabad Spoke VCN instead of Hyderabad Hub VCN.
Resolution
Created VM in:
hyd-hub-vcn
Configured:
Route Table
Security List
DRG Route
Connectivity was restored successfully.
Validation Checklist
- Hyderabad Region Subscribed
- DR Hub VCN Created
- Public Subnet Created
- Private Subnet Created
- DRG Created
- DRG Attached to VCN
- RPC Created in Ashburn
- RPC Created in Hyderabad
- RPC Peering Established
- Route Tables Configured
- Security Lists Configured
- Test VM Created
- Private IP Connectivity Verified
- Security Validation Performed
Result
Successfully prepared a Disaster Recovery environment in Hyderabad region and established private inter-region connectivity between Ashburn and Hyderabad using DRG and Remote Peering Connection (RPC). Connectivity was validated using private IP communication over the OCI backbone network.
Interview Questions
What is RPC?
RPC (Remote Peering Connection) enables private communication between VCNs located in different OCI regions using Oracle's backbone network.
Why use RPC instead of Public Internet?
RPC provides secure, private, and low-latency connectivity without exposing traffic to the public internet.
What is the purpose of DRG?
DRG acts as a virtual router that connects VCNs to remote networks, on-premises environments, and other OCI regions.
How did you validate inter-region connectivity?
I configured DRG route rules, established RPC peering, configured security rules, and verified communication using private IP ping between VMs in Ashburn and Hyderabad regions.
What troubleshooting did you perform?
Initially, the test VM was deployed in the Hyderabad Spoke VCN. After identifying the issue, I deployed the VM in the Hyderabad Hub VCN, verified routing and security configurations, and successfully established connectivity.
STEPS
Creating the Hub VCN in the Hyderabad DR region
Creating a Public Subnet in the Hyderabad Hub VCN
Creating a Private Subnet in the Hyderabad Hub VCN
Creating the Spoke VCN in the Secondary (DR) Region
Creating the Public Subnet in the DR Spoke VCN
Creating the Private Subnet in the DR Spoke VCN
Creating a DRG in the Secondary (DR) Region to Connect the Hub and Spoke VCNs
Attaching the Hub VCN to the DRG in the Secondary (DR) Region
Attaching the Spoke VCN to the DRG in the Secondary (DR) Region
Creating RPCs in the Primary and Secondary (DR) Regions
primary region
secondary region
Copying the RPC OCID from the Secondary (DR) Region
Pasting the Secondary Region RPC OCID into the Primary Region RPC
Verifying the RPC Peer Status in Both Regions
Open the Hub VCN route table in the Ashburn (Primary) region and add a route rule with the DRG as the target, using the CIDR of the Hub VCN in the DR (Secondary) region as the destination.
Open the Hub VCN route table in the Hyderabad (Secondary/DR) region and add a route rule with the DRG as the target, using the CIDR of the Hub VCN in the Ashburn (Primary) region as the destination CIDR block.
Create a public VM instance in the Hub VCN in both the Primary (Ashburn) and Secondary (Hyderabad/DR) regions for connectivity testing and DR validation.
Log in to the jump server (bastion host) in the Primary (Ashburn) region.
Ping the private IP address of the server in the Secondary (Hyderabad/DR) region to verify connectivity between the Primary and DR regions.
The ping test is not working because ICMP traffic is not allowed in the Security Lists (or NSGs) of the VCNs in either the Primary (Ashburn) or Secondary (Hyderabad/DR) region. Configure ICMP ingress and egress rules in both regions, then retry the connectivity test.
Configure ICMP security rules in the Security Lists (or NSGs) of both the Primary (Ashburn) and Secondary (Hyderabad/DR) regions to allow ping traffic between the VCNs.
The ping test is now successful, confirming that connectivity between the Primary (Ashburn) and Secondary (Hyderabad/DR) regions is working correctly after configuring the ICMP security rules.