FastConnect: With an Oracle Partner

This topic is for customers who want to use Oracle Cloud Infrastructure FastConnect by connecting to an Oracle partner. For a summary of the different ways to connect, see the connectivity models.

If you instead want to use a network provier that is not on the list of Oracle partners, see FastConnect: With a Third-Party Provider. Or if you want to use FastConnect by colocating with Oracle, see FastConnect: Colocation with Oracle.

For general information about FastConnect, see FastConnect.

Getting Started with FastConnect

The following flow chart shows the overall process of setting up FastConnect.

This flow chart shows the steps for getting started with FastConnect

Also see the sequence diagram in To get the status of your virtual circuit.

Caution

Avoid entering confidential information when assigning descriptions, tags, or friendly names to your cloud resources through the Oracle Cloud Infrastructure Console, API, or CLI.
Task 2: Set up connection to the Oracle partner

If you haven't already, start the process of ordering the connection from the Oracle partner, setting it up, and then testing it with the partner. It can take some time, depending on the partner.

Task 3: Set up a DRG (private peering only)
Summary: If you plan to use a private virtual circuit (private peering), you need a DRG. If you haven't already, use the Oracle Cloud InfrastructureConsole to set up a DRG, attach it to your VCN, and update routing in your VCN to include a route rule to send traffic to the DRG. It's easy to forget to update the route table. Without the route rule, no traffic will flow.

Instructions:

Task 4: Set up your virtual circuit

Summary: Create one or more virtual circuits for your connection in the Oracle Console. If your network design includes more than one virtual circuit, complete the following steps for each one.

Instructions:

Repeat the following steps for each virtual circuit you want to create.

  1. In the Console, confirm you're viewing the compartment  that you want to work in. If you're not sure which one, use the compartment that contains the DRG that you'll connect to (for a private virtual circuit). The choice of compartment, along with a corresponding IAM policy, controls who has access to the virtual circuit you're about to create.
  2. Open the navigation menu. Under Core Infrastructure, go to Networking and click FastConnect.

    The resulting FastConnect page is where you'll create a new connection and later return to when you need to manage the connection.

  3. Click Create FastConnect.
  4. Select FastConnect Partner and choose the partner from the list.
  5. Click Next.
  6. Enter the following for your virtual circuit:

    • Name: A friendly name that helps you track your virtual circuits. The value does not need to be unique across your virtual circuits, and you can change it later. Avoid entering confidential information.
    • Create in Compartment: Leave as is (the compartment you're currently working in).
  7. Choose the virtual circuit type (private or public). A private virtual circuit is for private peering (where your existing network receives routes for your VCN's private IP addresses). A public virtual circuit is for public peering (where your existing network receives routes for the Oracle Cloud Infrastructure public IP addresses). Also see Uses for FastConnect.

    • For a private virtual circuit, enter the following:

      • Dynamic Routing Gateway: Select the DRG to route the FastConnect traffic to.
      • Provisioned Bandwidth: Choose a value. If your bandwidth needs increase later, you can update the virtual circuit to use a different value (see To edit a virtual circuit).

      If your BGP session goes to Oracle (see Basic Network Diagrams), the dialog box includes other fields for the BGP session:

      • Customer BGP IP Address: The BGP peering IP address for your edge (your CPE), with either a /30 or /31 subnet mask.
      • Oracle BGP IP Address: The BGP peering IP address you want to use for the Oracle edge (the DRG), with either a /30 or /31 subnet mask.
      • Enable IPv6 Address Assignment: Available only in the Government Cloud. For more information, see FastConnect and IPv6.
      • Customer BGP ASN: The public or private ASN for your network.
      • Use a BGP MD5 Authentication Key (optional): Select this check box and provide a key if your system requires MD5 authentication. Oracle supports up to 128-bit MD5 authentication.
    • For a public virtual circuit, enter the following:

      • Provisioned Bandwidth: Choose a value. If your bandwidth needs increase later, you can update the virtual circuit to use a different value (see To edit a virtual circuit).
      • Public IP Prefixes: The public IP prefixes that you want Oracle to receive over the connection. All prefix sizes are allowed. You can enter a comma-separated list of prefixes, or one per line.
      • Customer BGP ASN: The public ASN for your network. Present only if your BGP session goes to Oracle (see Basic Network Diagrams). Oracle specifies the BGP IP addresses for a public virtual circuit.
      • Use a BGP MD5 Authentication Key (optional): Select this check box and provide a key if your system requires MD5 authentication. Oracle supports up to 128-bit MD5 authentication.
  8. Click Create.

    The virtual circuit is created. Its OCID and a link to the partner's portal are displayed in the resulting confirmation box at the top of the page. The OCID is also available with the other virtual circuit details.

  9. Copy and paste the OCID to another location. You give it to your partner in the next task.

The virtual circuit is listed on the FastConnect page.

Until you complete the next task and the partner does their provisioning work, the virtual circuit's Lifecycle State is PENDING PROVIDER and the BGP state is DOWN. After the partner does their work, the Lifecycle State switches to PROVISIONED. When the BGP session is established and working, the BGP state changes to UP.

Tip

For a virtual circuit where your BGP session goes to the Oracle partner, the BGP state for the virtual circuit reflects the status of the separate BGP session between the Oracle partner and Oracle. For reference, see Basic Network Diagrams.

Also see the diagram in To get the status of your virtual circuit.

Task 5: Give the partner information about the virtual circuit

Contact the partner and give the OCID of each virtual circuit that you created, along with any other information the partner requests. Depending on the partner, you might do this in the partner's portal, or over the phone. The partner then configures each virtual circuit on their end to complete the connectivity.

If your partner is AT&T: After AT&T gives you the service key for your virtual circuit, create a ticket at My Oracle Support to request provisioning, and give Oracle the service key.

Task 6: Configure your edge

If your BGP session goes to Oracle: (see Basic Network Diagrams), configure your edge (your CPE) to use the BGP peering information (see General Requirements). Oracle's BGP ASN for the commercial cloud is 31898. For the Government Cloud, see Oracle's BGP ASN. By default, Oracle uses the default BGP timers of 60 seconds for keep-alive and 180 seconds for hold-time. If you need fast BGP convergence, you can use any value in these supported ranges: 6-60 seconds for keep-alive, and 18-180 seconds for hold-time. Also configure the router for redundancy according to the network design you decided on earlier (see FastConnect Redundancy Best Practices). After you successfully configure the BGP session, the virtual circuit's BGP session state changes to UP.

If your BGP session instead goes to the Oracle partner: You still need to configure your router if you haven't already. You may need to contact your partner to get the required BGP peering information. This BGP session must be up and running for FastConnect to work. Also configure your edge router for redundancy according to the network design you decided on earlier (see FastConnect Redundancy Best Practices).

Important

For a public virtual circuit: Your existing network can receive advertisements for Oracle's public IP addresses through multiple paths (for example: FastConnect and your internet service provider). Make sure to give FastConnect higher preference than your ISP. You must configure your edge appropriately so that traffic uses your desired path to receive the benefits of FastConnect. This is particularly important if you decide to also set up your existing network with private access to Oracle services. For important information about path preferences, see Routing Details for Connections to Your On-Premises Network.
Task 7: Check light levels

Confirm that the light levels are good for each of your physical network connections to the partner. Don't proceed until they are.

Task 8: Confirm your interfaces are up

Confirm your side of the interfaces for the connections to the partner are up. Don't proceed until they are.

BGP Session Goes to Oracle

Task 9a: Ping the Oracle BGP IP address

For each virtual circuit, ping the Oracle BGP IP address assigned to the virtual circuit. Check the error counters and look for any dropped packets. Don't proceed until you can successfully ping this IP address without errors.

Task 9b: Confirm that the BGP session is established

For each virtual circuit, confirm that the BGP session is in an established state. When it is, the connection is ready to test (see Task 11: Test the connection).

BGP Session Goes to the Partner

Task 10a: Ping the partner's edge

For each virtual circuit, ping the partner's edge. Check the error counters and look for any dropped packets. Don't proceed until you can successfully ping the partner's edge without errors.

Task 10b: Confirm the BGP session is established

Confirm the BGP session you have with the partner is in an established state. Don't proceed until it is.

Task 10c: Ping the Oracle BGP IP address

For each virtual circuit, ping the Oracle BGP IP address (which you can get from the partner). Check the error counters and look for any dropped packets. When you can successfully ping this IP address without errors, the connection is ready to test.

Task 11: Test the connection

For a private virtual circuit: You should be able to launch an instance in your VCN and access it (for example, with SSH) from a host in your existing private network. See Creating an Instance. If you can, your FastConnect private virtual circuit is ready to use.

For a public virtual circuit:

  1. Make sure that Oracle has successfully verified at least one of the public prefixes you've submitted. You can see the status of each prefix by viewing the virtual circuit's details in the Console. When one of the prefixes has been validated, Oracle starts advertising the regional Oracle Cloud Infrastructure public addresses over the connection.
  2. Launch an instance with a public IP address.
  3. Ping the public IP address from a host in your existing private network. You should see the packet on the FastConnect interface on the virtual circuit. If you do, your FastConnect public virtual circuit is ready to use. However, remember that only the public prefixes that Oracle has successfully verified so far are advertised on the connection.

Managing Your Virtual Circuit

To get the status of your virtual circuit
  1. In the Console, go to Networking, and then click FastConnect to view your list of connections.
  2. Click the virtual circuit you're interested in to view its details.

The following diagram shows the different states of the virtual circuit when you're setting it up.

This image shows a sequence diagram with the different virtual circuit states

To edit a virtual circuit

You can change these items for a virtual circuit:

  • The name
  • The bandwidth
  • Which DRG it uses (for a private virtual circuit)
  • The public IP prefixes (for a public virtual circuit)
  • Depending on the situation, you might also have access to the BGP session information for the virtual circuit and thus can change it.
Important

If your virtual circuit is working and in the PROVISIONED state before you edit it, be aware that changing any of the properties besides the name, bandwidth, and public prefixes (for a public virtual circuit) causes the virtual circuit's state to switch to PROVISIONING and may cause the related BGP session to go down. After Oracle re-provisions the virtual circuit, its state returns to PROVISIONED. Make sure you confirm that the associated BGP session is back up.

If you change the public IP prefixes for a public virtual circuit, the BGP status is unaffected. Oracle begins advertising a new IP prefix over the connection only after verifying your ownership of it. The virtual circuit's state changes to PROVISIONING while Oracle implements any prefix changes.

  1. Open the navigation menu. Under Core Infrastructure, go to Networking and click FastConnect.

  2. Select the compartment where the connection resides, and then click the connection to view its details.
  3. Click Edit and make your changes.
  4. Click Save Changes.
To terminate a virtual circuit
Important

Also terminate the connection with the partner, or else the partner may continue to bill you.
  1. Open the navigation menu. Under Core Infrastructure, go to Networking and click FastConnect.

  2. Select the compartment where the connection resides, and then click the connection to view its details.
  3. Click Delete.
  4. Confirm when prompted.

The virtual circuit's Lifecycle State changes to TERMINATING and then to TERMINATED.

To manage public IP prefixes for a public virtual circuit

For general information about the prefixes, see Basic Network Diagrams.

You can specify your public IP prefixes when you create the virtual circuit. See Task 4: Set up your virtual circuit.

You can add or remove public IP prefixes later after creating the virtual circuit. See To edit a virtual circuit. If you add a new prefix, Oracle first verifies your company's ownership before advertising it across the connection. If you remove a prefix, Oracle stops advertising the prefix within a few minutes of your editing the virtual circuit.

You can view the state of Oracle's verification of a given public prefix by viewing the virtual circuit's details in the Console. Here are the possible values:

  • In progress: Oracle is in the process of verifying your organization's ownership of the prefix.
  • Failed: Oracle could not verify your organization's ownership. Oracle will not advertise the prefix over the virtual circuit.
  • Completed: Oracle successfully verified your organization's ownership. Oracle is advertising the prefix over the virtual circuit.
To move a connection to a different compartment

You can move a connection from one compartment to another. After you move the connection to the new compartment, inherent policies apply immediately and affect access to the connection through the Console. Moving the connection to a different compartment does not affect the connection between your data center and Oracle Cloud Infrastructure. For more information, see Moving a Compartment to a Different Parent Compartment.

  1. Open the navigation menu. Under Core Infrastructure, go to Networking and click FastConnect.

  2. Find the connection in the list, click the the Actions icon (three dots), and then click Move Resource.
  3. Choose the destination compartment from the list.
  4. Click Move Resource.
  5. If there are alarms monitoring the connection, update the alarms to reference the new compartment. See To update an alarm after moving a resource for more information.

Monitoring Your Connection

You can monitor the health, capacity, and performance of your Oracle Cloud Infrastructure resources by using metrics, alarms, and notifications. For more information, see Monitoring Overview and Notifications Overview.

For information about monitoring your connection, see FastConnect Metrics.