05 Networking ‐ IP Management - KleberVales/OCI-Architect-Associate GitHub Wiki

1. IP Management

2. Reserved Public IP

3. BYOIP

4. Public IP Pools

.
.
.
.
.

1. IP Management

IP management in OCI involves private IP addresses and public IP addresses. Private IP addresses are used for internal communication within a VCN, between peered VCNs, and with on-premises networks through Site-to-Site VPN or FastConnect. A VNIC can have one primary private IP address and up to 32 secondary private IP addresses, for a maximum of 33 private IPv4 addresses per VNIC. Any of these private IPs can also have a public IP assigned to it. Public IP addresses are reachable from the internet, and OCI offers two types: ephemeral and reserved. Ephemeral public IPs are temporary, last only for the lifetime of the instance, and can only be assigned to a VNIC’s primary private IP. Reserved public IPs are persistent, survive instance termination, can be reassigned to another instance, and can be assigned to either a primary or secondary private IP. Understanding these differences is essential for designing and managing network connectivity in OCI.

1. Private IP Addresses

What Are Private IP Addresses?

A private IP address is used for internal communication within a VCN, between peered VCNs, or between a VCN and an on-premises network. It is not directly reachable from the internet.

Use Cases for Private IP Addresses

Private IP addresses are used in three main scenarios:

Communication within the same VCN
An instance can communicate with other instances in the same VCN using private IP addresses. The instances may be in different subnets, as long as they are in the same VCN.
Peering
When two VCNs are peered, instances in those VCNs communicate using private IP addresses. The peered VCNs can be in the same region or in different regions.
Communication with on-premises networks
An instance can communicate with hosts in an on-premises network using private IP addresses. This typically happens through:
- Site-to-Site VPN
- FastConnect

2. Private IP Addresses and VNICs

Primary and Secondary VNICs

An instance can have:

A primary VNIC
One or more secondary VNICs

Primary Private IP Addresses

A primary VNIC has one primary private IP address.
A secondary VNIC also has one primary private IP address.

So each VNIC has exactly one primary private IP address.

Secondary Private IP Addresses

A VNIC can also have secondary private IP addresses.
The maximum number of secondary private IP addresses per VNIC is 32.

Maximum Private IPv4 Addresses per VNIC

A single VNIC can have a maximum of 33 private IPv4 addresses:

1 primary private IP address
32 secondary private IP addresses

All these private IP addresses can have a public IP address assigned to them at your discretion.

3. Public IP Addresses

What Are Public IP Addresses?

A public IP address is reachable from the internet. In OCI, some resources, such as a NAT gateway, are designed to be directly reachable from the internet and therefore come with a public IP address.

Types of Public IP Addresses

OCI has two types of public IP addresses:

Ephemeral public IP
Reserved public IP

4. Ephemeral vs. Reserved Public IP Addresses

Feature	Ephemeral Public IP	Reserved Public IP
Persistence	Temporary	Persistent
Lifetime	Exists for the lifetime of the instance	Exists beyond the lifetime of the instance
Behavior on instance termination	The public IP goes away	The public IP remains and can be reassigned
Assignment	Can only be assigned to a VNIC’s primary private IP	Can be assigned to either a primary or secondary private IP

Ephemeral Public IP

The word “ephemeral” means temporary. An ephemeral public IP:

Is associated with an instance.
Exists only for the lifetime of that instance.
Is released when the instance is terminated or deleted.
Can only be assigned to a VNIC’s primary private IP.

Reserved Public IP

A reserved public IP:

Is persistent.
Exists even after the instance it was associated with is terminated.
Can be reassigned to another instance whenever you want.
Can be assigned to either a primary private IP or a secondary private IP.

IP Management - part 2

In OCI, every instance has at least one primary private IP address, and each VNIC can have one primary private IP plus up to 32 secondary private IPs. If an instance has multiple VNICs, each VNIC follows the same pattern, allowing a resource to have many private IPs. A public IP address is reachable from the internet and is always assigned to a private IP object. For a public IP to be reachable, the VCN must have an Internet Gateway, the subnet must have a route to that gateway, and security lists must permit the traffic. Because each private IP can have a public IP, a resource can have multiple public IPs. There are two types of public IPs: ephemeral, which is temporary and disappears when the instance is terminated, and reserved, which persists beyond the instance lifetime and can be reassigned. Public IP addresses, including unassociated reserved ones, are provided at no charge. This overview reinforces the fundamentals of IP management in OCI and prepares you for more advanced topics such as Bring Your Own IP and IP pools.

1. Private IP Addresses

Every instance in OCI has at least one primary private IP address. This private IP can optionally have a public IP assigned to it. For example, an instance in a public subnet will have both a private IP and a public IP.

VNIC IP Structure

Each VNIC can have:

One primary private IP address
Up to 32 secondary private IP addresses

If an instance has multiple VNICs (a primary VNIC and one or more secondary VNICs), each VNIC follows the same structure: one primary private IP and up to 32 secondary private IPs. Therefore, a single instance can have many private IP addresses across its VNICs.

2. Public IP Addresses

A public IP address is an IP address that is reachable from the internet. In OCI, a public IP is always assigned to a private IP object on a resource.

Conditions for Public IP Reachability

For a public IP to be reachable over the internet, the following conditions must be met:

An Internet Gateway must be created in the VCN.
The public subnet must have route tables correctly configured with a route to the internet through the Internet Gateway.
Security lists must be correctly configured to allow the desired traffic.

Because each private IP address can have a public IP assigned to it, and a resource can have multiple VNICs (each with multiple private IPs), a resource can have multiple public IP addresses.

3. Types of Public IP Addresses

OCI offers two types of public IP addresses:

Ephemeral Public IP

Temporary in nature.
Exists only for the lifetime of the instance.
Is released when the instance is terminated or deleted.
Can only be assigned to a VNIC’s primary private IP.

Reserved Public IP

Persistent in nature.
Exists beyond the lifetime of the instance.
Can be reassigned to another resource even after the original instance is terminated.
Can be assigned to either a primary private IP or a secondary private IP.

Billing

There is no charge for using public IP addresses in OCI. Even a reserved public IP that is not associated with any resource incurs no cost.

2. Reserved Public IP

A Reserved Public IP Address is a persistent public IP that exists beyond the lifetime of an instance. Unlike ephemeral public IPs, which are temporary and tied to the instance's lifecycle, reserved public IPs remain available even after the instance is terminated. This persistence provides greater control and flexibility in managing public IP addresses within Oracle Cloud Infrastructure.

Reserved public IPs are created one at a time, and there is a limit of 50 reserved public IP addresses per region. The scope of a reserved public IP is regional, meaning it can be assigned to a private IP in any Availability Domain within the region. This regional availability ensures that the IP can be used flexibly across different resources and locations within the same region.

One of the key characteristics of a reserved public IP is that it is never automatically deleted. It exists until you explicitly delete it, giving you full control over its lifecycle. Additionally, reserved public IPs are reassignable — they can be unassigned from one resource and reassigned to another whenever needed. When a private IP moves between VNICs, the associated reserved public IP moves along with it, ensuring continuity and consistency.

Overall, reserved public IPs provide flexibility by allowing you to maintain consistent public IP addresses while changing underlying resources. This reduces security risks and simplifies IP management, making reserved public IPs an essential tool for managing public connectivity in OCI.

Learning Objectives

By the end of this lesson, you will be able to:

Define a reserved public IP address and its key characteristics.
Explain the creation and assignment process for reserved public IPs.
Identify the limits associated with reserved public IP addresses.
Describe the regional scope of reserved public IPs.
Understand how reserved public IPs behave when moved between VNICs.
Recognize that reserved public IPs are never automatically deleted.

1. What Is a Reserved Public IP Address?

A reserved public IP address is a persistent public IP address.

Key Characteristics

Persistent: Exists beyond the lifetime of an instance.
Not automatically deleted: Remains until you explicitly delete it.
Reassignable: Can be unassigned and reassigned to other resources.
Regional scope: Can be assigned to a private IP in any Availability Domain within the region.

2. Creation and Assignment

Creation

Reserved public IP addresses are created one at a time.
When creating one, you provide:
- A name
- A compartment
- The IP address source (e.g., Oracle)

Assignment

After creation, the reserved public IP can be assigned to a private IP.
If unassigned, the IP returns to the tenancy's pool of reserved public IPs.
It is never automatically deleted — it exists until you delete it.

Limit

You can have up to 50 reserved public IP addresses per region.

3. Regional Scope

The scope of a reserved public IP address is regional.

It can be assigned to a private IP in any Availability Domain within the region.
This provides flexibility in how and where the IP is used.

4. Moving Reserved Public IPs Between VNICs

Consider an instance with multiple VNICs:

VNIC 1 has a primary private IP and up to 32 secondary private IPs.
VNIC 2 also has a primary private IP and up to 32 secondary private IPs.

Moving a Private IP

If you move a secondary private IP from VNIC 1 to VNIC 2:

The reserved public IP associated with that private IP moves along with it.

Important: The reserved public IP follows the private IP when it is moved between VNICs.

5. No Automatic Deletion

There is no concept of automatic deletion for reserved public IPs.
The IP address exists until you explicitly delete it.
This ensures you retain control over the IP address for as long as needed.

6. Benefits of Reserved Public IPs

Persistence: Survives instance termination.
Flexibility: Can be unassigned and reassigned to any resource.
Reduced security risk: Allows you to maintain consistent public IPs while changing underlying resources.
Regional availability: Can be used across Availability Domains within a region.

3. BYOIP

Bring Your Own IP (BYOIP) allows customers to migrate their own public IPv4 CIDR blocks or IPv6 prefixes from their on-premises environment to Oracle Cloud Infrastructure. This is particularly valuable when applications have hard-coded IP addresses or architectural dependencies on specific IPs, enabling smooth migration and solution continuity. The process involves requesting an import, receiving a verification token from Oracle, adding that token to your Regional Internet Registry (RIR) records, creating a Route Origin Authorization (ROA) with Oracle's BGP ASN, and waiting for Oracle to validate ownership. Once validated, the IP addresses are provisioned to your compartment, where you can manage them through IP pools and advertise them to the internet.

Lesson Definition

Bring Your Own IP (BYOIP) is an OCI service that enables customers to import their own public IPv4 CIDR blocks or IPv6 prefixes into Oracle Cloud Infrastructure. Oracle validates ownership of these addresses through a supported Regional Internet Registry (RIR) before provisioning them to the customer's compartment. This service provides solution continuity for migrations, supports IP reputation, and allows customers to maintain control over their public IP address space.

Learning Objectives

By the end of this lesson, you will be able to:

Define Bring Your Own IP (BYOIP) and its purpose.
Explain why organizations use BYOIP for cloud migration.
Describe the BYOIP import process step by step.
Identify the role of Regional Internet Registry (RIR) and Route Origin Authorization (ROA).
Understand the limits for IPv4 CIDR blocks and IPv6 prefixes.
Recognize the benefits of using BYOIP.

1. What Is Bring Your Own IP (BYOIP)?

When you use a public IP address in OCI, it is typically owned by Oracle. However, some organizations have their own public IP addresses that they want to use in the cloud.

BYOIP allows you to:

Bring your own IPv4 CIDR block or IPv6 prefix to OCI.
Use those IP addresses with your OCI resources.
Maintain IP address continuity during migration.

Why Use BYOIP?

Hard-coded IP addresses: Applications may have IP addresses hard-coded in devices or configurations.
Smooth migration: Enables seamless migration to OCI without changing IP addresses.
Solution continuity: Ensures that existing architectures and dependencies remain intact.

2. Prerequisites and Limits

Ownership Validation

You must be the owner of the IPv4 CIDR block or IPv6 prefix.
Ownership must be registered with a supported Regional Internet Registry (RIR) .
Oracle validates your ownership before importing the addresses.

Limits

Address Type	Minimum	Maximum
IPv4 CIDR Block	/24	/8
IPv6 Prefix	/48 or larger	—

3. BYOIP Process Overview

The BYOIP import process involves several steps:

Step 1: Request to Import

You request to import a public IPv4 CIDR block or IPv6 prefix that you own into OCI.

Step 2: Receive Verification Token

Oracle issues a verification token.
You must add this token to the information about your IP addresses kept by your Regional Internet Registry (RIR) .
This step can take up to one day.

Step 3: Create Route Origin Authorization (ROA)

Create a ROA with your RIR.
Provide Oracle's BGP ASN for the commercial cloud.
The ROA allows Oracle to advertise the BYOIP CIDR block.

Step 4: Request Oracle to Finish Import

Request that Oracle complete the import process.
This workflow can take up to 10 business days.
Oracle communicates with the RIR to verify ownership.

Step 5: Provisioning

Oracle provisions the BYOIP addresses to your compartment within your tenancy.
The IPv4 CIDR block or IPv6 prefix is now yours to manage.

Step 6: Advertise to Internet

You can advertise the CIDR block or prefix to the internet.

4. Key Concepts

Regional Internet Registry (RIR)

An organization that manages the allocation and registration of IP addresses.
Your IP addresses must be registered with a supported RIR.
Oracle validates ownership through the RIR.

Route Origin Authorization (ROA)

A cryptographic signed statement that authorizes an ASN to advertise a specific IP prefix.
You provide Oracle's BGP ASN to the RIR as part of the ROA.
The ROA allows Oracle to advertise your BYOIP CIDR block.

5. Managing BYOIP Addresses

After the import process is complete:

The BYOIP addresses are provisioned to your compartment.
You can manage IPv4 addresses through IP pools.
IP pools allow you to:
- Summarize groups of IPv4 addresses.
- Create resources for deployment, such as load balancers.

Note: IP pools are specifically for IPv4 addresses.

6. Benefits of BYOIP

Benefit	Description
Smooth Migration	Enables migration to OCI without changing hard-coded IP addresses.
Solution Continuity	Maintains architectural dependencies on specific IP addresses.
IP Reputation	Some internet services rely on contiguous IP address space.
IP Pool Management	Allows summarization of IPv4 addresses into pools for resource deployment.
Load Balancer Support	BYOIP addresses can be used with load balancers and other resources.

4. Public IP Pools

Paragraph Summary

Public IP Pools are sets of IPv4 CIDR blocks allocated to a tenancy, created from Bring Your Own IP (BYOIP) address space. These pools are exclusively available for your tenancy and provide a centralized way to manage your public IP addresses. Once you import your addresses and create a public IP pool, you have two options: create reserved public IPs from the pool and attach them to resources like NAT gateways, load balancers, or compute instances, or enable direct launch from the pool where resources are launched with an IP directly allocated from the pool. Public IP pools currently support IPv4 CIDR blocks, with a minimum size of /28 and a maximum size of /24.

Lesson Definition

A Public IP Pool is a collection of IPv4 CIDR blocks allocated to a tenancy, derived from Bring Your Own IP (BYOIP) address space. It is exclusively available for use within that tenancy and allows you to create reserved public IPs or directly allocate public IPs to resources during launch.

1. What Is a Public IP Pool?

A Public IP Pool is a set of IPv4 CIDR blocks allocated to a tenancy.

Key Characteristics

Created from your Bring Your Own IP (BYOIP) CIDR block.
Can be the entire BYOIP CIDR block or part of it.
Exclusively available for your tenancy — no other tenancy can use it.
Currently supports IPv4 CIDR blocks only.
IPv6 addresses do not use the IP pools functionality.

Prerequisites

Before creating a Public IP Pool:

You must import your addresses using the BYOIP process.
After import, you can create a Public IP Pool from your BYOIP CIDR block.

2. Using Public IP Pools

Once you have a Public IP Pool, you have two options for using the IP addresses:

Option 1: Create Reserved Public IPs

Create a reserved public IP from the pool.
Attach the reserved IP to resources such as:
- NAT Gateway
- Load Balancer
- Compute Instances
This provides flexibility to reassign the IP as needed.

Option 2: Direct Launch from Pool

Launch resources directly with an IP allocated from the pool.
No need to create a reserved IP first.
The IP is directly allocated from the Public IP Pool during resource creation.

Comparison

Method	Description	Use Case
Create Reserved IP	Reserve an IP from the pool, then attach to a resource	When you need flexibility to reassign IPs
Direct Launch from Pool	Launch a resource with an IP directly from the pool	When you want immediate allocation without reservation

3. Limits and Quotas

When creating a Public IP Pool:

Parameter	Value
Number of CIDR Ranges	Zero or more
Minimum Size Range	/28
Maximum Size Range	/24

Note: The pool can have zero CIDR ranges initially, and you can add ranges later.

4. Benefits of Public IP Pools

Benefit	Description
Exclusive Access	Available only for your tenancy.
Centralized Management	Manage all your BYOIP addresses in one place.
Flexibility	Choose between reserving IPs or direct allocation.
Resource Integration	Works with NAT gateways, load balancers, and compute instances.
IP Reputation	Maintain consistent IP addresses for your resources.

5. Workflow Summary

Import your IP addresses using the BYOIP process.
Create a Public IP Pool from your BYOIP CIDR block.
- Use the entire CIDR block or part of it.
Choose how to use the pool:
- Option A: Create a reserved public IP and attach it to a resource.
- Option B: Launch a resource directly from the pool.
Manage your IPs through the Public IP Pool.