Oracle Cloud Infrastructure Documentation

FastConnect Overview

Oracle Cloud Infrastructure FastConnect provides an easy way to create a dedicated, private connection between your data center and Oracle Cloud Infrastructure. FastConnect provides higher-bandwidth options, and a more reliable and consistent networking experience compared to internet-based connections.

Uses for FastConnect

With FastConnect, you can choose to use private peering, public peering, or both.

  • Private peering: To extend your existing infrastructure into a virtual cloud network (VCN) in Oracle Cloud Infrastructure (for example, to implement a hybrid cloud, or a lift and shift scenario). Communication across the connection is with IPv4 private addresses (typically RFC 1918).
  • Public peering: To access public services in Oracle Cloud Infrastructure without using the internet. For example, Object Storage, the Oracle Cloud Infrastructure Console and APIs, or public load balancers in your VCN. Communication across the connection is with IPv4 public IP addresses. Without FastConnect, the traffic destined for public IP addresses would be routed over the internet. With FastConnect, that traffic goes over your private physical connection.

In general it's assumed you'll use private peering, and you might also use public peering. Most of this documentation is relevant to both, with specific details called out for private versus public.

How and Where to Connect

With FastConnect, there are different connectivity models to choose from.

Oracle Provider

Third-Party Provider

Colocation with Oracle in an Oracle Cloud Infrastructure FastConnect Location

The following table summarizes several important requirements for each connectivity model.

Requirement With Oracle Provider With Third-Party Provider Colocation with Oracle
Routing requirements Yes Yes

Yes

BGP support Yes Yes Yes
Layer 3 support Recommended Recommended Recommended
Obtain a Letter of Authority (LOA) from Oracle N/A Yes Yes
Network connectivity Yes Yes N/A
Cross-connect Yes (from the provider) Yes Yes
Redundant network connectivity Recommended Recommended Recommended
Cloud connectivity solution architecture support Recommended Recommended Recommended
FastConnect SKU Yes Yes Yes
Oracle Cloud Infrastructure Console user login (IAM policy unique setup) Yes Yes Yes
Tenancy established Yes Yes Yes

Concepts

Here are some important concepts to understand (also see the following diagrams):

FastConnect
The general concept of a connection between your existing network and Oracle Cloud Infrastructure over a private physical network instead of the internet.
FastConnect location
A specific Oracle data center where you can connect with Oracle Cloud Infrastructure.
metro area
A geographical area (for example, Ashburn) with multiple FastConnect locations. All locations in a metro area connect to the same set of availability domains for resiliency in case of failure in a single location.
Oracle provider
A network service provider that has integrated with Oracle in a FastConnect location. See the list of the Oracle providers in How and Where to Connect. If your provider is in the list, see FastConnect: With an Oracle Provider.
third-party provider
A network service provider that is NOT on the list of Oracle providers in How and Where to Connect. If you have a third-party provider and want to use FastConnect, see FastConnect: With a Third-Party Provider.
colocation
The situation where your equipment is deployed into a FastConnect location. If your network service provider is not on the list of Oracle providers in How and Where to Connect, you must colocate.
cross-connect
In a colocation or third-party provider scenario, this is the physical cable connecting your existing network to Oracle in the FastConnect location.
cross-connect group
In a colocation or third-party provider scenario, this is a link aggregation group (LAG) that contains at least one cross-connect. You can add additional cross-connects to a cross-connect group as your bandwidth needs increase. This is applicable only for colocation.
virtual cloud network (vcn)
Your virtual network in Oracle Cloud Infrastructure. You can use a VCN to extend your infrastructure into the cloud. For more information, see VCNs and Subnets.
dynamic routing gateway (drg)
A virtual edge router attached to your VCN. Necessary for private peering. The DRG is a single point of entry for private traffic coming in to your VCN, whether it's over FastConnect or an IPSec VPN. After creating the DRG, you must attach it to your VCN and add a route for the DRG in the VCN's route table to enable traffic flow. Instructions for everything are included in the sections that follow.
virtual circuit
An isolated network path that runs over one or more physical network connections to provide a single, logical connection between the edge of your existing network and Oracle Cloud Infrastructure. Private virtual circuits support private peering, and public virtual circuits support public peering (see Uses for FastConnect). Each virtual circuit is made up of information shared between you and Oracle, as well as a provider (if you're connecting through an Oracle provider). You could have multiple private virtual circuits, for example, to isolate traffic from different parts of your organization (one virtual circuit for 10.0.1.0/24; another for 172.16.0.0/16), or to provide redundancy.

Basic Network Diagrams

The diagrams in this section introduce the basic logical and physical connections involved in FastConnect. Details specific to private versus public peering are called out.

General Concept of FastConnect

The following diagram illustrates the two ways to connect to Oracle with FastConnect: either through colocation with Oracle in the FastConnect location, or through an Oracle provider. In both cases, the connection goes between the edge of your existing network and Oracle.

This image shows the general concept of FastConnect between your network and Oracle

Physical Connection

The next two diagrams give more detail about the physical connections. They also show the metro area that contains the FastConnect location, and a VCN within an Oracle Cloud Infrastructure region.

The first diagram shows the colocation scenario, with your physical connection to Oracle within the FastConnect location.

This image shows the colocation scenario with basic physical connection details

The next diagram shows a scenario with either an Oracle provider or third-party provider. It shows your physical connection to the provider, and the provider's physical connection to Oracle within the FastConnect location.

This image shows the provider scenario with basic physical connection details

Logical Connection: Private Virtual Circuit

The next two diagrams show a private virtual circuit, which is a single, logical connection between your edge and Oracle Cloud Infrastructure by way of your DRG. Traffic is destined for private IP addresses in your VCN.

The first diagram shows the colocation scenario.

This image shows colocation scenario with the virtual circuit

The next diagram shows the scenario with either an Oracle provider or third-party provider.

This image shows the provider scenario with the virtual circuit

Logical Connection: Public Virtual Circuit

A public virtual circuit gives your existing network access to regional public IPv4 addresses in Oracle Cloud Infrastructure. For example, Object Storage, the Oracle Cloud Infrastructure Console and APIs, and public load balancers in your VCN. All communication across a public virtual circuit uses public IP addresses.

The first diagram shows the colocation scenario with both a private virtual circuit and a public virtual circuit. Notice that the DRG is not involved with the public virtual circuit, only the private virtual circuit.

This image shows colocation scenario with a public virtual circuit

The next diagram shows the scenario with either an Oracle provider or third-party provider.

This image shows the provider scenario with a public virtual circuit

Here are a few basics to know about public virtual circuits:

  • You choose which of your organization's public IP prefixes you want to use with the virtual circuit. Each prefix must be /31 or less specific. Oracle verifies your organization's ownership of each prefix before sending any traffic for it across the connection. Oracle's verification for a given prefix can take up to three business days. You can get the status of the verification of each prefix in the Oracle Console or API. Oracle begins advertising the Oracle Cloud Infrastructure public IP addresses across the connection only after successfully verifying at least one of your public prefixes.
  • Your existing network will receive Oracle's public IP addresses through both FastConnect and your Internet Service Provider (ISP). When configuring your edge, make sure to give higher preference to FastConnect over your ISP, or you will not receive the benefits of FastConnect.
  • You must configure your firewall rules to allow the desired traffic coming from the Oracle public IP addresses.
  • Oracle prefers the most specific route when routing traffic from Oracle Cloud Infrastructure to other destinations. This means that when Oracle replies to traffic coming from one of your verified public prefixes, the reply travels over the FastConnect public virtual circuit, even if you have an internet gateway on your VCN. Replies to traffic from any public prefixes that are not on your list or not yet verified by Oracle still go through the internet gateway. For reference, this diagram shows the private and public virtual circuits as well as an internet gateway on the VCN:

    This image shows a situation with both a public virtual circuit and an internet gateway

  • You can add or remove public IP prefixes at any time by editing the virtual circuit. If you add a new prefix, Oracle first verifies your company's ownership before advertising it across the connection. If you remove a prefix, Oracle stops advertising the prefix within a few minutes of your editing the virtual circuit.

Oracle Provider Scenario: BGP Session to Either Oracle or the Oracle Provider

This section is applicable if you're using FastConnect through an Oracle provider. A Border Gateway Protocol (BGP) session is established from your edge, but where it goes to depends on which Oracle provider you use.

Tip

For simplicity, the following diagrams show only a private virtual circuit. However, the location of the BGP session is the same for a public virtual circuit.

To Oracle: With some of the Oracle providers, the BGP session goes from your edge to Oracle, as shown in the following diagram. When setting up the virtual circuit with Oracle, you are asked to provide basic BGP peering information (see General Requirements).

This image shows the BGP session between the customer's edge router and Oracle

To the Oracle provider: With other Oracle providers, your BGP session goes from your edge to the provider's, as shown in the following diagram. When setting up the virtual circuit with Oracle, you are NOT asked for any BGP session information. Instead, you share BGP information with your Oracle provider. Notice that there's a separate BGP session that the provider establishes with Oracle.

This image shows the BGP session between the customer's edge router and the provider

What's Next?

See these topics to get started: