LAB 52 (Establish hub and spoke Connectivity and validate custom image software in private instances) - arunsinghchauhan38-arch/CLOUDARCHITECTDOC GitHub Wiki

πŸ” Dynamic Routing Gateway (DRG) Setup

1. Overview

  • A Dynamic Routing Gateway (DRG) is a virtual router in Oracle Cloud Infrastructure (OCI).

  • It acts as a centralized connectivity hub for:

Virtual Cloud Networks (VCNs)

On‑premises networks

Other supported network environments

Hub‑and‑Spoke Topology

  • Hub VCN = central transit point.

  • Spoke VCNs = connected networks.

  • Routing Control:

DRG Route Tables β†’ govern traffic forwarding across attachments.

VCN Route Tables β†’ determine when traffic is directed to the DRG.

Key Benefits

  • Centralized Connectivity β†’ simplifies topology.

  • Secure Private Communication β†’ isolated traffic exchange.

  • Scalable Architecture β†’ supports seamless expansion.

2. Configuration Steps: Hub Public Instance ↔ Spoke Private Instance

Step 1. Create a Dynamic Routing Gateway (DRG)

Console Path: Networking β†’ Dynamic Routing Gateways β†’ Create DRG

Action: Create and name the DRG.

Step 2. Attach Hub VCN

Path: Hub VCN β†’ Resources β†’ Gateway β†’ DRG Attachments β†’ Create DRG Attachment

Action: Select DRG β†’ Create attachment.

Step 3. Attach Spoke VCN

  • Path: Spoke VCN β†’ Resources β†’ Gateway β†’ DRG Attachments β†’ Create DRG Attachment

  • Action: Select DRG β†’ Create attachment.

Step 4. Verify Connectivity

Use Network Visualizer to confirm Hub ↔ Spoke connectivity.

Step 5. Add Route Rules

a) Hub Public Subnet

Target Type: Dynamic Routing Gateway
Destination Type: CIDR Block
Destination CIDR: 10.0.1.0/26 (Spoke App Private Subnet)
Target DRG Compartment: Hub_Network_Compartment
Target DRG: hub_drg

b) Spoke Private Subnet

Target Type: Dynamic Routing Gateway
Destination Type: CIDR Block
Destination CIDR: 10.0.0.0/25 (Hub Public Subnet)
Target DRG Compartment: Hub_Network_Compartment
Target DRG: hub_drg

Step 6. Configure Security Rules

a) Hub VCN Public Subnet (Egress Rule)

Protocol: ICMP
Destination CIDR: 10.0.1.0/26 (Spoke App Private Subnet)

b) Spoke VCN Private Subnet (Ingress Rule)

Protocol: ICMP
Destination CIDR: 10.0.0.0/25 (Hub Public Subnet)

Step 7. Validate Hub-to-Spoke Connectivity

Login into the hub instance

Ping Test (ICMP)

From the Hub public instance, run:

ping 10.0.1.51 <Spoke Private Instance IP>

Hub and spoke connectivity paired successfully and its work well.

Step 8. Update Port

Now we Update port in our security list.

To Update Port we first go to the public subnet and update the port 22 in egress rules.

Public Subnet Egress Rules

Destination CIDR - 10.0.1.0/26 (asus Pvt subnet)

IP Protocol - TCP

Destination Port Range - 22

Now we update Ingress Rules of ASUS Private subnet

Private Subnet Ingress Rules

CIDR Rang 10.0.0.0/25 (HUB Public Subnet)

Protocol - TCP

Destination Port - 22

After Adding port in both Hub Public and Asus Private subnet. We Try to check port Connectivity by the telnet Command in hub Public Subnet.

telnet 10.0.1.51 22

Port 22 connected Successfully

3. πŸ” SSH Connectivity & Custom Image Validation

1. Add SSH Public Key During Instance Creation

  • While creating the private instance, add the required SSH public key under the SSH Keys section.

  • Verify that the instance is provisioned with the correct public key.

2. Configure SSH Key on Bastion Server

  1. Create a Directory and Store the SSH Private Key :
mkdir keys

Check the created Directory

ls -lrth

Directory Name keys created

  1. Now we go into directory key
cd keys
  1. Next we create file in keys directory
vi privkey.pem
  1. Now we insert the our private Key here

To Enter the key press

ESC key + i Key

To Save the File Press

ESC key + : + wq + ! (esc:wq!)

we save the key and exit from the vi editor.

Now Check key and its permission

ls -lrth
  1. Now we have to change the permission of the Private key and give permission only to the owner
chmod 600 privkey.pem

ls -lrth
  1. Login in Asus spoke Private Subnet
ssh -i /home/opc/keys/privkey.pem [email protected]

Type Yes

Now we successfully login into the asus spoke Application server by hub pvt subnet.

  1. Validate the Custom Image Software

After launching a new instance using the Custom Image, log in to the system and verify that all required software packages and configurations are correctly applied.

To verify installation

yum list installed unzip curl httpd telnet