Requirement:

In this lab, we will create one Bastion Server in the public subnet of the Hub VCN and establish secure connectivity to an Application Server in the private subnet of the Spoke VCN using a Dynamic Routing Gateway (DRG).

Planning and execution:

Dynamic Routing Gateway (DRG):

It is OCI's central router that connects your cloud network to the outside world — on-premises data centers, other VCNs, or other cloud regions — and dynamically learns and exchanges routes between them (that's the "dynamic" part, using BGP under the hood, instead of you hand-maintaining static routes).

Attachment:

It is simply the act of linking a VCN (or on-premises connection) to the DRG so traffic can flow through it. Think of the DRG as an airport hub, and each attachment as a gate connecting one terminal (VCN) to that hub.

Working flow:

• You create a DRG as a standalone object — it doesn't belong to any single VCN.

• You attach VCN(s) to it — this creates a "DRG attachment," which is what actually lets traffic move between the VCN and the DRG.

• You attach the outside connection — either an IPSec VPN or FastConnect (dedicated private connectivity) for on-premises, or another VCN for hub-and-spoke routing.

• You update route tables in each attached VCN's subnet, pointing relevant traffic (e.g., your on-prem CIDR range) toward the DRG.

• Once attached and routed, the DRG handles moving packets between all connected networks — on-prem ↔ VCN, or VCN ↔ VCN — without you manually managing every path.

Validation:

Step:1 Login to Bastioan_Instance.

Step:2 Ping to Meesho_spoke_instance via Bastioan_Instance

Step:3 Adding .ppk key under key section in Bastioan_Instance

Step:4 Providing read and write access to the key

Step:5 Login to Meesho_spoke_instance via Bastioan_Instance followed by ssh key.

Step:6 Checking the hardening software which is used to create Meesho_spoke_instance.