Welcome to Oracle Cloud Infrastructure. This is a demo on How to connect OCI
Object Storage Service from On-premises Via Site-to-Site VPN or Fast-connect.
Before you begin, ensure that the required policies to manage an instance, VCN,
Site-to-Site VPN and Object storage are added at the compartment level.
For this demo, I am using Libreswan because my customer-premise equipment
is running on an Oracle Linux 8.8 instance.
Please note that I have already set the connectivity for this video. In this demo,
I am considering the OCI Mumbai region as my On-premises, which is connected to OCI Zurich
(Switzerland North) via Site-to-Site VPN. OCI Zurich is hosting the Object Storage.
In this demo, we will test the On-Premises connectivity to the OCI Object storage via
Site-to-Site VPN and DRG. In the Mumbai region:
I have created “On_premises_VCN”, which has “Libreswan_CPE_Instance” in “Public_Subnet”
In “On_premises_VCN” I have only “Internet Gateway Attachment”
Now let me navigate to subnet, here I have routes only to the “Site_to_site VPN Public IP in OCI
Zurich” & “Route for Login via Remote Desktop”. In the OCI Zurich Region:
We have “Transit_VCN” but note that we don’t have any subnets
created in this VCN, the only attachments here are “Servicegateway_Attachment_to_Object_Storage” and
“DRG_Attachment_Trasit_From_VCN_To_Service_Gateway” Next, let me login to my Libreswan CPE:
Here, note that I cannot ping 8.8.8.8. As I mentioned earlier,
we have connectivity only for CPE login and VPN Public IP which is in OCI Zurich region.
Run “ifconfig” to see the status of “vti1”. We can see that “vti1” is UP. “systemctl status
ipsec.service” indicates that IPSEC Connection is established. Please note that, for the ease
of demonstration, I am using BGP routing. Now, let’s check the BGP status in CPE,
I see that the neighbor is UP. The received routes show the object
storage related CIDR range of the region. If I ping the object storage API endpoint.
I can see that packets are moving via the “vti1” interface.
Hence, I can see that I have a successful connection to OCI Zurich object storage endpoint.
Also, notice that I can download an image file using PAR link
that is present in Object storage bucket. At this point it is very important to know how to
get this route of the Object storage CIDR, which is a Public range from the IPSEC Tunnel in OCI.
Going back to OCI region Site-to-Site VPN in Zurich, note here on “BGP advertised routes”
we see the required CIDR advertised. These object storage CIDRs are basically
received from the “DRG Route table” attached to IPSEC attachments in DRG, So by clicking
“Get all routes” I can see a dynamic entry. I am receiving this dynamic entry from the next
hop attachment, so on the next hop I have the VCN route table “Object_Storage_Route_Table”
attached to the DRG Attachment of “Transit_VCN” This is a Manually created route table and has
routes only to the respective object storage via the service gateway and this attachment
which we can also view at the VCN level as well. The previous step helps in reaching the Object
storage but fails to return the traffic to on-premises, So we associate the VCN Route
table “On-Premises_Route_Table” to the service gateway attachment, which has entries to reach
On-Premises ranges. Hence from this association, the service gateway knows that return packets
need to be sent to the DRG attachment. I hope this demo helps, please go through
the documents in the description as well. Please contact OCI Support if you still
need assistance. Thank you!