OCI Networking Design Question

You are tasked with designing the networking for a new Spoke VCN in Oracle Cloud Infrastructure (OCI).

Background

The Network Team has allocated 10.0.0.0/16 exclusively for all OCI networking.

This allocation represents the maximum address space available for OCI.

Not all of this space should be consumed by a single Spoke VCN, as additional Spoke VCNs will be required in the future.

Existing Allocation

Hub VCN: 10.0.0.0/24 (CIDR reserved)

Requirements

1. Spoke VCN

• Create a Spoke VCN with sufficient IP address space to support approximately 256 IP addresses.

• Ensure the Spoke VCN CIDR does not overlap with the Hub VCN (10.0.0.0/24) or any future Spoke VCNs.

2. Subnets within the Spoke VCN

• Application Private Subnet:

Must support 60 instances.

Allocate a CIDR block that provides adequate usable IP addresses.

• Future Subnet 1:

Reserve IP address space for a subnet capable of supporting 30 IP addresses.

CIDR block should be allocated now to prevent future IP conflicts and redesign.

• Future Subnet 2:

Reserve IP address space for a subnet capable of supporting 20 IP addresses.

CIDR block should be allocated now to ensure scalability and avoid overlap in future deployments.

3.Route Tables

• Create the required route tables for the Spoke VCN.

• Do not add any route rules at this stage.

Constraints

• The Spoke VCN CIDR must not overlap with the existing Hub VCN (10.0.0.0/24).

• The design must leave sufficient address space within the reserved 10.0.0.0/16 range for additional Spoke VCNs in the future.

• No CIDR overlap should occur anywhere in the design.

📐 OCI Spoke VCN Subnetting Plan

1. Spoke VCN CIDR

CIDR Block: 10.0.1.0/24

• Rationale:

Provides 256 IP addresses (usable ~251 after OCI reservations).

Avoids overlap with Hub VCN (10.0.0.0/24).

Leaves sufficient space in the overall 10.0.0.0/16 range for future Spoke VCNs.

2. Subnet Allocation within Spoke VCN

The VCN, subnet, security list, and route table configuration will be prepared in multiple stages. The steps involved in each stage are described below.

Stage 1 Create vcn stack file for terraform

Create VCN from oci console

Stage 2 Create and configure the Terraform Network and Root Modules.

Step 1 Open Code editor and Create the project directory named vcn_codes

Step 2 Create folder terraform_network_template inside vcn_codes directory

Create and configure the following files inside the folder:

terraform_network_template/
├── vcn.tf
├── variable.tf
└── priv.pem

vcn.tf – Configure the OCI Virtual Cloud Network (VCN) resource by replacing all hardcoded values with input variables.

resource "oci_core_vcn" "generated_oci_core_vcn" {
        cidr_blocks     = [var.vcn_cidr]
        compartment_id  = var.compartment_ocid
        display_name    = var.vcn_name
        dns_label       = var.dns_label
        is_ipv6enabled  = var.is_ipv6enabled
}

variables.tf – Declare all necessary input variables for the VCN module configuration.

variable "compartment_ocid" {
  description = "OCI Compartment OCID"
  type        = string
}

variable "vcn_name" {
  description = "VCN Display Name"
  type        = string
}

variable "vcn_cidr" {
  description = "VCN CIDR Block"
  type        = string
}

variable "is_ipv6enabled" {
  description = "Enable IPv6"
  type        = bool
}

variable "dns_label" {
  description = "VCN DNS Label"
  type        = string
}

priv.pem – Store the OCI API private key used for authentication.

Step 3. Create the Root Module Folder and Configure the Files

Within the network_codes directory, create a new folder named network.

Create and configure the following files inside the folder:

vcn/
├── asus_vcn.tf
├── provider.tf
├── variable.tf
└── terraform.tfvars

provider.tf – Configure the OCI Terraform provider.

provider "oci" {
    auth                = "APIKey" 
    tenancy_ocid        = "ocid1.tenancy.oc1..aaaaaaaae264lss2tpg5w3rc6ktkttm22tjyzy46tgfnwihjdaw7x5csbkea"
    user_ocid           = "ocid1.user.oc1..aaaaaaaapqcjvc574ck55obqyviqetxyx4xtoazcio2hwvl3ux7a55wqcrqa"
    fingerprint         = "95:fc:ce:5c:4e:2e:dd:80:10:67:03:57:20:47:28:a6"
    private_key_path    = "/home/arunsinghc/compartment_template/priv.pem"
    region              = "us-ashburn-1"
}

asus_vcn.tf – Invoke the reusable terraform_network_template module and provide the required input variables.

module "network" {
    source = "/home/arunsinghc/network_codes/terraform_network_templates"

    compartment_ocid = var.compartment_ocid
    vcn_name         = var.vcn_name
    vcn_cidr         = var.vcn_cidr
    dns_label        = var.dns_label
    is_ipv6enabled   = var.is_ipv6enabled
}

variables.tf – Define all input variables required by the root module.

variable "compartment_ocid" {
  description = "OCI Compartment OCID"
  type        = string
}

variable "vcn_name" {
  description = "VCN Display Name"
  type        = string
}

variable "vcn_cidr" {
  description = "VCN CIDR Block"
  type        = string
}

variable "dns_label" {
  description = "VCN DNS Label"
  type        = string
}

variable "is_ipv6enabled" {
  description = "Enable IPv6"
  type        = bool
}

terraform.tfvars – Specify the values for all input variables declared in the root module.

vcn_cidr         = "10.0.1.0/24"
compartment_ocid = "ocid1.compartment.oc1..aaaaaaaaslhysntcuboaatapizdunlujrgrwojffc6idqbcbbiioe6kk3qea"
vcn_name         = "asus_vcn"
dns_label        = "asusvcn"
is_ipv6enabled   = false

Step 4. Verify the Project Structure

After completing the configuration, the project directory should be organized as follows:

network_codes/
│
├── terraform_network_template/
│   ├── vcn.tf
│   ├── priv.pem
│   └── variable.tf
│
└── network/
    ├── asus_vcn.tf
    ├── provider.tf
    ├── terraform.tfvars
    └── variable.tf

step 5: Open the Integrated Terminal

• Open code editor in oci console.
• Right-click the network folder in the Explorer pane.
• Select Open in Integrated Terminal.

The terminal will open with the network directory as the current working directory.

Step 6: Initialize Terraform

Initialize the Terraform working directory. This command downloads the required provider plugins and prepares the project for deployment.

terraform init

Step 7: Review the Terraform Execution Plan

Before creating any resources, review the execution plan to validate the changes Terraform will make.

terraform plan

Verify the following:

• Terraform plans to create the Virtual Cloud Network (VCN).
• The VCN name, CIDR block, and compartment details match your configuration.
• No unexpected resources are listed for creation, modification, or deletion.

Step 8: Create the VCN

Apply the Terraform configuration to provision the OCI resources.

terraform apply

When prompted, type:

yes

Terraform will begin creating the Virtual Cloud Network (VCN) and any associated resources defined in the configuration.

Expected Result:

Terraform provisions the resources successfully.

A message similar to the following is displayed:

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Step 9 : Verify the VCN in the OCI Console

After the terraform apply command completes successfully, verify that the VCN has been created.

Sign in to the Oracle Cloud Infrastructure (OCI) Console.

1. Navigate to Networking → Virtual Cloud Networks.
2. Select the appropriate Compartment (for example, asus_app_network).
3. Verify that the asus_vcn is listed.

Validate the following:

• The VCN amazon_vcn exists.
• The configured CIDR block is correct.
• The VCN status is Available.
• The VCN has been created in the correct compartment.

Note: If the VCN is visible and its status is Available, the Terraform deployment has completed successfully.

Stage 3. Extend the Terraform Network and Root Modules

Step 1. Create Additional Resource Files in the Template Module

Navigate to the existing terraform_network_template module folder.

Create and configure the following Terraform resource files to define additional network components such as Security Lists, Route Tables, and Subnets.

Module Folder Structure:

terraform_network_template/
├── security_list.tf
├── route_table.tf
└── subnet.tf

security_list.tf – Configure the OCI Security List resource.

  resource "oci_core_security_list" "asus_security_list" {

  compartment_id = var.compartment_ocid

  vcn_id = oci_core_vcn.generated_oci_core_vcn.id

  display_name = var.security_list_name

  defined_tags = var.defined_tags

  
  # Ingress Rule - SSH from Hub VCN
  
  ingress_security_rules {

    protocol = "6"

    source = var.ssh_source_1

    source_type = "CIDR_BLOCK"

    tcp_options {

      min = 22
    
      max = 22

    }

  }

 
  # Ingress Rule - Allow Internal VCN Communication


  ingress_security_rules {

    protocol = "6"

  source = var.ssh_source_2

  source_type = "CIDR_BLOCK"

  tcp_options {
    min = 22
    max = 22
  }

}
  
  # Egress Rule - Allow All Outbound Traffic


  egress_security_rules {

    protocol = "all"

    destination = "0.0.0.0/0"

    destination_type = "CIDR_BLOCK"

  }

}

route_table.tf – Configure the OCI Route Table resource.

  resource "oci_core_route_table" "asus_route_table" {

  compartment_id = var.compartment_ocid

  vcn_id = oci_core_vcn.generated_oci_core_vcn.id

  display_name = var.route_table_name

}

subnet.tf – Configure the OCI Private Subnet resource.

resource "oci_core_subnet" "asus_private_subnet" {

  for_each                  = var.subnets

  compartment_id            = var.compartment_ocid

  vcn_id                     = oci_core_vcn.generated_oci_core_vcn.id

  display_name               = each.value.display_name

  cidr_block                 = each.value.cidr_block

  dns_label                  = each.value.dns_label

  prohibit_public_ip_on_vnic = each.value.prohibit_public_ip_on_vnic

  route_table_id             = oci_core_route_table.asus_route_table.id

  security_list_ids          = [
                 oci_core_security_list.asus_security_list.id
  ]

}

Important Note: existing vcn.tf, variable.tf, and privkey.pem files will remain unchanged.

Step 2.Update the Template Module Variables

Update the existing terraform_network_template/variable.tf file.

The existing VCN variables remain unchanged.

Add the following variables.

  variable "security_list_name" {
  description = "Security List Name"
  type        = string
}

variable "route_table_name" {
  description = "Route Table Name"
  type        = string
}

variable "ssh_source_1" {
  description = "First SSH Source CIDR"
  type        = string
}

variable "ssh_source_2" {
  description = "Second SSH Source CIDR"
  type        = string
}

variable "subnets" {
  description = "Subnet Configuration"
}

Step 3. Update the Root Module

Navigate to the existing network directory and update the following Terraform configuration files to incorporate the new network resources and variable definitions:

network/
├── asus_network.tf
├── variable.tf
└── terraform.tfvars

Step 4. Update amazon_network.tf

Modify the amazon_network.tf file to extend the reusable terraform_network_template module.

Add the following input variables to support the creation and configuration of the Security List, Route Table, and Private Subnet resources.

security_list_name = var.security_list_name
route_table_name   = var.route_table_name

ssh_source_1       = var.ssh_source_1
ssh_source_2       = var.ssh_source_2

subnets            = var.subnets

These variables enable the module to provision and manage the additional networking components in a reusable and configurable manner.

Step 5.Update the Root Module Variables

Update the existing network/variable.tf file to define the input variables required for the newly added networking resources.

The existing VCN-related variables remain unchanged.

Add the following variable definitions to support the configuration of the Security List, Route Table, and Private Subnet resources in the root module. These variables will be passed to the reusable terraform_network_template module during deployment.

  variable "security_list_name" {
  description = "Security List Name"
  type        = string
}

variable "route_table_name" {
  description = "Route Table Name"
  type        = string
}

variable "ssh_source_1" {
  description = "First SSH Source CIDR"
  type        = string
}

variable "ssh_source_2" {
  description = "Second SSH Source CIDR"
  type        = string
}

variable "subnets" {
  description = "Subnet Configuration"
}

Step 6. Update terraform.tfvars

Update the existing terraform.tfvars file to provide values for the newly added input variables.

The existing VCN configuration remains unchanged.

Add the following configuration values to define the Security List, Route Table, and Private Subnet settings that will be used during the Terraform deployment.

security_list_name = "asus_sl"

route_table_name = "asus_rt"

ssh_source_1 = "10.0.0.0/24"

ssh_source_2 = "10.0.1.0/24"

subnets = {
  app = {
    display_name               = "amazon_pvt_subnet"
    cidr_block                 = "10.0.1.0/26"
    dns_label                  = "asuspvt"
    prohibit_public_ip_on_vnic = true
  }
}

Step 7: Verify the Updated Project Structure

After completing the configuration, the project structure should look like this.

network_codes/
│
├── terraform_network_template/
│   ├── vcn.tf
│   ├── security_list.tf
│   ├── route_table.tf
│   ├── subnet.tf
│   ├── variable.tf
│   └── priv.pem
│
└── network/
    ├── asus_network.tf
    ├── provider.tf
    ├── terraform.tfvars
    └── variable.tf

step 8. Open the Integrated Terminal

In Oci Code editor, right-click the network folder and select Open in Integrated Terminal.

Step 9. Initialize Terraform

Since new Terraform resources and input variables have been added to the existing project, reinitialize the Terraform working directory to download any required providers and update the module configuration.

terrraform init

Verify that the initialization completes successfully before proceeding.

Step 10.Review the Execution Plan

Review the execution plan to validate the changes before provisioning the additional networking resources.

terraform plan

Confirm that Terraform plans to create the following resources:

• Security List
• Route Table
• Private Subnet

Note: The existing asus_vcn should remain unchanged and must not be recreated.

Step 11. Create the Remaining Network Resources

Apply the Terraform configuration to provision the remaining network resources.

terraform apply

When prompted for confirmation, enter:

```yes``

Terraform will create the following resources and associate them with the existing asus_vcn:

• Security List (asus_sl)
• Route Table (asus_rt)
• Private Subnet (asus_pvt_subnet)

Step 12. Verify the Network Resources

After the deployment completes successfully, verify the resources in the Oracle Cloud Infrastructure (OCI) Console.

Navigate to:

OCI Console → Networking → Virtual Cloud Networks → asus_vcn

Ensure that the following resources have been created successfully:

Additionally, verify the following configurations:

• The Security List contains the configured SSH ingress rules.
• The Route Table is associated with the Private Subnet.
• The Private Subnet is associated with the Security List.
• Public IP assignment is disabled for the Private Subnet.
• The Private Subnet is created within the existing asus_vcn and uses the configured CIDR block.