In this video, I'll discuss and demonstrate usage of Local Peering Gateways on the Oracle
Private Cloud Appliance.
In this diagram, we see 2 Local Peering Gateways, LPG-1 and LPG-2.
LPG-1 is on VCN-1 which has a CIDR block of 10.0.0.0/16.
LPG-2 is on VCN-2 which has a CIDR block of 192.168.0.0/16.
VCN-1 has one subnet, called Subnet A, and one compute instance with a private IP address
of 10.0.0.2.
VCN-2 has one subnet, called Subnet X, and one compute instance with a private IP address
of 192.168.0.2.
These two local peering gateways allow these instances, which are on different VCNs, to
communicate using private IP addresses, without routing the traffic over the Internet or through
your on-premise network.
I've constructed this environment on my Oracle Private Cloud Appliance which includes an
Internet Gateway on VCN-1.
This allows communication with public resources that need to be reached from the Internet.
If you haven't already done so, I suggest you view the Internet Gateway on Oracle Private
Cloud Appliance video before proceeding with this video.
I've logged on to the Compute Web UI and here I'm showing the 10.0.0.2 instance that is
on VCN-1.
This instance also has a public IP address of 10.80.79.153.
I'll click the link to view the VCN details and here we see the CIDR block of 10.0.0.0/16.
I'll scroll down and view Subnets and we see Subnet-A.
This VCN also has one Internet Gateway so I'll click on this link.
The name of the Internet Gateway is IG-1.
I'll click on the Route Tables link and view the details for the default route table.
I'll scroll down to see the route rules and notice there is a route rule for the Internet
Gateway.
With all of this in place, I'm able to ssh into this instance from my local laptop.
I'll run the ssh command and provide the private key filename and connect as the opc user to
the public IP address.
I'll now switch back to the Compute Web UI and view the details for my instance on the
192.168 VCN.
The private IP address for the instance is 192.168.0.2.
I don't care about the public IP address because with Local Peering Gateways properly configured,
I can communicate using the private IP address, without routing the traffic over the Internet.
I'm going to attempt to ssh into the 192.168.0.2 instance but because the private key from
the SSH key pair is needed, I want to show that I've already copied this key file, named
id_rsa, to my instance on the 10.0.0.0 VCN.
I'll run the ssh command and provide the private key filename and attempt to connect as the
opc user to the private IP address.
After a few seconds, my connection attempt times out and fails.
I'll now demonstrate the steps needed to configure the Local Peering Gateways to allow this connection
to work.
I'll click the link to view the VCN-2 details.
I'll scroll down and click Local Peering Gateway.
I'll click Create Local Peering Gateway.
I'll give it a name of LPG-2.
You can specify a different compartment and enter tagging information but I'll not do
so for this demonstration.
I'll click Create Local Peering Gateway and after a few seconds, LPG-2 appears in the
list.
I also need to add a route rule to my route table for this gateway.
I'll click Route Tables and then from the Actions menu, I'll click View Details.
I'll scroll down and click Add Route Rules.
For the Target Type, I'll select Local Peering Gateway.
For the CIDR block, I want to enter the Destination CIDR Block, that is, the other VCN's CIDR
block.
If I review my diagram again, I'm creating LPG-2 for VCN-2.
So the destination CIDR block is VCN-1's CIDR block, which is 10.0.0.0/16.
So I'll return to the Compute Web UI and enter 10.0.0.0/16 for the CIDR block.
I'll select LPG-2 from the drop-down list for the Local Peering Gateway, then click
Create Route Table Rule.
After a few seconds, the new route rule appears in the list.
I next need to create the Local Peering Gateway for VCN-1.
I'll scroll up and click Virtual Cloud Networks from the breadcrumbs.
From here I'll select VCN-1 from the list to view the details.
I'll scroll down and click Local Peering Gateway.
I'll click Create Local Peering Gateway.
I'll give it a name of LPG-1.
I'll click Create Local Peering Gateway and after a few seconds, LPG-1 appears in the
list.
I also need to add a route rule to my route table for this gateway.
I'll click Route Tables and then from the Actions menu, I'll click View Details.
I'll scroll down and click Add Route Rules.
For the Target Type, I'll select Local Peering Gateway.
For the CIDR block, I want to enter the Destination CIDR Block, that is, the other VCN's CIDR
block.
If I review my diagram again, I'm now creating LPG-1 for VCN-1.
The destination CIDR block is VCN-2's CIDR block, which is 192.168.0.0/16.
So I'll return to the Compute Web UI and enter 192.168.0.0/16 for the CIDR block.
I'll select LPG-1 from the drop-down list for the Local Peering Gateway, then click
Create Route Table Rule.
After a few seconds, the new route rule appears in the list.
Now that we have our two Local Peering Gateways in place, let's try again to ssh into this
instance using the private IP address.
I'll return to my terminal window and re-run the ssh command that I ran before and, after
a few seconds, it times out and fails.
So there is one more step needed for this to work.
We have to establish a peering connection between the two Local Peering Gateways.
From the Compute Web UI, I'll scroll up and click VCN-1 from the breadcrumbs to view the
details.
Then scroll back down and click Local Peering Gateway.
From the Actions menu for LPG-1, I'll click Establish Peering Connection.
I want to establish this connection from my current VCN, which is VCN-1, to VCN-2.
So for VCN, I'll select VCN-2 from the drop-down list.
And from the Local Peering Gateway list, I'll select LPG-2, which is the only local peering
gateway on VCN-2.
I'll click Establish Peering Connection and after a few secongs, LPG-1 is now peered with
192.168.0.0/16, which is the CIDR block for VCN-2.
You only need to establish this connection from one Local Peering Gateway, not both.
If I scroll up and click Virtual Cloud Networks from the breadcrumbs, then select VCN-2 from
the list, then scroll down and select Local Peering Gateway, you see that LPG-2 is automatically
peered with 10.0.0.0/16, which is the CIDR block for VCN-1.
I'll return to my terminal window and re-run the ssh command that I ran before.
This time it works and I'm asked to want to continue connecting.
I'll enter yes but then get an error message about bad permissions on my private ssh key
file.
I'll change the permissions and run the ssh command again, and now I'm connected to the
compute instance via the private IP address as the opc user.
Just to further verify connectivity, I'll run the ip a command and see the private IP
address of 192.168.0.2.
So to summarize, Local Peering Gateways allow instances on different VCNs to communicate
using private IP addresses without routing the traffic over the Internet or through your
on-premise network.
You need to add a Local Peering Gateway on each VCN in the peering relationship.
You also need to add a route rule to your route table for the Local Peering Gateways.
For the CIDR block in the route rule, provide the Destination VCN's CIDR Block.
You have to establish a peering connection between the two Local Peering Gateways.
You only need to establish the connection for one Local Peering Gateway.
Once you establish the connection for one, the connection is automatically established
for the other Gateway.
One additional point not called out in the video but you need to be aware of, the CIDR
blocks for the VCNs linked by the Local Peering Gateways cannot overlap.
Refer to the Oracle Private Cloud Appliance documentation for more information.
For additional training videos like this, go to oracle.com/goto/pcalearning.
This concludes this video.
Thank you for watching.