Associate Private Views to the VCN Private Resolvers with ATP Database and Oracle SQL Developer in Different VCNs

From Iwan
Jump to: navigation, search

In Oracle Cloud Infrastructure (OCI), associating private views to the Virtual Cloud Network (VCN) Private Resolver involves setting up DNS configurations to ensure that specific DNS queries within your VCN resolve to private IP addresses according to your defined DNS records. This setup enhances the management and resolution of internal domain names.

A Private View is a collection of DNS zones and records that can be associated with VCNs to resolve domain names internally.

0b290ce9436fdd123d7392849aad8f45.png

In this tutorial, we will combine this with a use-case to create an Autonomous Transaction Processing Database (ATP) and perform basic network connectivity tests and tests with the Oracle SQL Developer application from within the same VCN, and from another VCN. This way we can see how the Virtual Cloud Network (VCN) Private Resolver works and how to configure the Private Views.

C82ae82ad06e5a4b175421c4c59ea6c1.png

The steps

  • [ ] STEP 01: Create the VCN environments
  • [ ] STEP 02: Create an Autonomous Transaction Processing Database (with a private access endpoint)
  • [ ] STEP 03: Download the Credentials Wallet
  • [ ] STEP 04: Use Oracle SQL Developer to test the Database connection from the same VCN
  • [ ] STEP 05: Use Oracle SQL Developer to test the Database connection from a different VCN
  • [ ] STEP 06: Associated private views to the VCN Private resolver
  • [ ] STEP 07: Use Oracle SQL Developer to test the Database connection from a different VCN (Associated private views to the VCN Private resolver)

STEP 01 - Create the VCN environments

To create an Autonomous Transaction Processing (ATP) Database and test the connections across multiple VCNs we need to have multiple VCNs configured and because the networks inside the VCNs need to communicate with each other we need to attach the VCNs to a Dynamic Routing Gateway.

Creating the VCN environments is out of the scope of this tutorial, but if you want to create multiple VCNs with Hub and Spoke Routing I have explained how to do this in [this article].

In the example that is illustrated below, I have created

  • 1 x VCN with a public and private subnet
  • 1 x VCN with a private subnet
  • 1 x DRG that has both VCNs attached
  • 1 x Windows Instance in the public subnet of the Hub VCN
  • 1 x Windows Instance in the private subnet of the Spoke VCN

The goal is to deploy the ATP Database in the private subnet of the Hub VCN and to test the connection from both Windows instances using Oracle SQL Developer.

7d7782223acf1f2128ffaa114d2e5008.png

STEP 02 - Create an Autonomous Transaction Processing Database with a private access endpoint

  1. Click in the left upper corner of the hamburger menu.
  2. Click on Databases.
  3. Click on Autonomous Transaction Processing.

0faec70e2bc30b502fd6196e2df85603.png

  • Click on the Create Autonomous Database button.

F0e72dd30c506e31046b150bb57959ff.png

  1. Specify a Display Name.
  2. Specify a Database Name.
  3. Choose the workload type to be Transaction Processing.
  4. Scroll down.

317ef130aaf7c5cd256eaaf7fcfc6673.png

  1. Choose the database type to be Serverless.
  2. Scroll down.

A1fcda471abaf69e88f6bfe20b9ff7bf.png

  1. Specify and confirm a password.
  2. Scroll down.

Df1806dca66cca05a43d87b1ce19efb8.png

  1. For the network access select the Access type Private endpoint access only.
  2. Select the VCN you want to deploy the ATP Database in.
  3. Select the subnet you want to deploy the ATP Database in.
  4. Check the box to enable mutual TLS (mTLS) authentication.
  5. Scroll down.

Cf26945f3ce28c5bb1b57b96f734abee.png

  • Click on the Create Autonomous Database button.

1bb1568b2e7cdb91dde46534882223de.png

  1. When the ATP Database is created you will see that the status is AVAILABLE.
  2. Scroll down.

B9c362475e4b8680948dfa9627fa5e89.png

  1. Notice the Private IP address of the ATP Database. Make a note of this as we will be using this later to test the connection.
  2. We also need the Private Endpoint URL for testing. Click on Show.

7fb54f5515b5c82e94c8f51012b832b8.png

  1. Make a note of the Private Endpoint URL as we will be using this later to test the connection.
  2. Scroll up.

7aa4fc8cef2444f34c3ea22e37855f97.png

  • In the picture below you will see an illustration of what we have created so far.

6c1898169c9fc193bb9ec2049be85908.png

STEP 03 - Download the Credentials Wallet

  • Click on the Database connection button.

7674b1a9158637caea9dd95055602f95.png

  1. Select the Wallet type to be the Instance Wallet.
  2. Click on the Download wallet button to download the zip file with the wallet.
  3. Click on the Close button.

074b49ca13d320f59698e9192820dc15.png

  • You will need this wallet file for (testing) the authentication.

STEP 04 - Use Oracle SQL Developer to test the Database connection from the same VCN

Before we are going to use the Oracle SQL Developer application to test the Database connection we are first going to test the network connectivity towards the ATP Database. We first use the Windows Instance (client) that is hosted in the SAME VCN where the ATP Database is deployed.

  • Open a Command terminal window.
  • Type in the command `telnet 172.16.0.64 1522`.
  • Because we are using a secured connection the database will have to listen to TCP port 1522.
  • Press Enter.

73787cfc29d99f4a3342948274fec2ca.png

  • Notice that the connection is accepted. So from a network level, we can confirm that the connection works using the IP address from the SAME VCN.

28676c077a628240a6267be2b3766569.png

  • Now let's do the same test again but now we will use the Private Endpoint URL.
  • Type in the command `telnet zps0ilns.adb.eu-frankfurt-1.oraclecloud.com 1522`.

4442ebfa63a3775f7bb72cff37bc4d66.png

  • Notice that the connection is accepted. So from a network level, we can confirm that the connection works using the Private Endpoint URL. from the SAME VCN.

117583c36942c14a6fb68a334d560692.png

6c620b615eae0d456fea94fd3e787704.png

  1. Right-click on Oracle Connections.
  2. Click on New Connection.

Ea46d7404b2974df0e9e9455f30fa7a1.png

  1. Specify a name.
  2. Specify the username (admin) for the database.
  3. Specify the password for the database.
  4. Select the Connection type to be Cloud Wallet.
  5. Click on the Browse button to select the (downloaded .zip file) Cloud Wallet.
  6. Make sure the Cloud Wallet file is selected in the path.
  7. Select the Service to be ihatp_tpurgent.
  8. Click on the Save button.

0b2565dd5baaf1c2e25d0491763e0482.png

  1. Notice the new connection is saved.
  2. Click on the Test button.

88f24e253d2d1261188ef30fe99b2e7a.png

  1. Notice the status will display Success.
  2. Click on the Connect button.

Ba462a31d928171c5a7283ef6954d5a0.png

  1. The username is already specified.
  2. Specify the password.
  3. Click on the OK button.

41e49097ea660ede671f0d883c3c0eb3.png

  • Notice that the Oracle SQL Developer application is now connected to the ATP Database.

14f5db66f6e5c73be85708321c5dec26.png

  • Click on the + sign to expand the ATP Database connection.

5d62ff4a652e597b7422d2a898ba3894.png

  • In the picture below you will see an illustration of what we have created so far.

4fa37150dc066d32f08dc17847e9f849.png

STEP 05 - Use Oracle SQL Developer to test the Database connection from a different VCN

Not that we have tested the ATP Database with the Oracle SQL Developer application in the SAME VCN, we will not do the same test, but now the Oracle SQL Developer application will be in a DIFFERENT VCN.

Bd368a3c92013d22f3730b537237e526.png

  • Let's perform the same network connectivity tests we did before, but now from a different VCN.
  • Open a Command terminal window.
  • Type in the command `telnet 172.16.0.64 1522`.
  • Because we are using a secured connection the database will have to listen to TCP port 1522.
  • Press Enter.

0537b4acc33d2a3ca4007e4531b4f5c9.png

  • Notice that the connection is accepted. So from a network level, we can confirm that the connection works using the IP address from the OTHER VCN.

73ab51ee26d082d259c55dbc8078505e.png

  • Now let's do the same test again but now we will use the Private Endpoint URL.
  • Type in the command `telnet zps0ilns.adb.eu-frankfurt-1.oraclecloud.com 1522`.

D8fe4debf62c08d31bd024b4c16260ab.png

  • Notice that the connection is NOT accepted. So from a network level, we can confirm that the connection does NOT work using the Private Endpoint URL from the OTHER VCN.
Connecting To zps@ilns.adb.eu-frankfurt-1.oraclecloud.com...Could not open a connection to the host, on port 1522: Connection failed.

14f9d5e1432c13b8973465eee9a640ea.png

  1. Specify a name.
  2. Specify the username (admin) for the database.
  3. Specify the password for the database.
  4. Select the Connection type to be Cloud Wallet.
  5. Click on the Browse button to select the (downloaded .zip file) Cloud Wallet.
  6. Make sure the Cloud Wallet file is selected in the path.
  7. Select the Service to be ihatp_tpurgent.
  8. Click on the Save button.

8661fa24a2df09395d3facd646aaefd5.png

  1. Notice the new connection is saved.
  2. Click on the Test button.

5757586689b81a991495a2730b2a62c0.png

  • Notice that the application is trying to connect.

496ce828df03acb1ab12d15d4edd3626.png

  • Notice that the connection fails with the following error:
Status : Failure -Test failed: IO Error: The Network Adapter could not establish the connection (CONNECTION_ID=zdt8muWqQs+N+gWfgIDCTg==)

722ebda254892853e58c734d7e747ed5.png

So the question arises:

  • Why can we successfully connect with the Oracle SQL Developer application using the cloud wallet in the SAME VCN and not in ANOTHER VCN?
  • Why can we successfully test the network connection with telnet using the IP address of the ATP Database, and not the Private Endpoint URL?
  • In the picture below you will see an illustration of what we have created so far.

4c52bff4e66a74efb451ab06306e30d5.png

By default, each VCN creates a (Private) DNS resolver with DNS host entries for components that are INSIDE that VCN. DNS host entries from OTHER VCNs are not allowed by default.

The connection wallet file is using the Private Endpoint URL to establish the connection and NOT the IP address.

This means that when we tested the ATP Database connection with the Oracle SQL Developer Application from the same VCN we were able to successfully connect to the ATP Database.

But when we tested the ATP Database connection with the Oracle SQL Developer Application from ANOTHER VCN we were NOT able to connect to the ATP Database.

This also answers the question of why the telnet IP address connectivity test was successful on both VCNs and the Private Endpoint URL was not.

To fix the issue we need to allow the associated private views to the VCN Private resolver and allow both VCNs to resolve (hosts or endpoints) in the other VCN.

STEP 06 - Associated private views to the VCN Private resolver

  1. Click on the hamburger menu in the upper left corner of the OCI console.
  2. Click on Networking.
  3. Click on Virtual cloud networking.

Dd7d75da3c1ee4765afc050281f19f1f.png

  • Click on the VCN where the ATP Database is hosted in.

5ba6b802a67346ad0d551ad2c7016c6b.png

  • Click on the DNS Resolver of the VCN.

Fb989962e315760de9795512224a519f.png

  • Scroll down.

686f96232745338ce6e94c14a161e416.png

  • Click on the Manage private views button.

A3bb1eab771bede8afd025e1d1aef3a3.png

  1. Select the OTHER VCN to allow so that that VCN can resolve DNS host names in THIS VCN.
  2. Click on the Save changes button.

121d1230e6e3b3add8415fd2715acc0a.png

  • Notice that the Private Resolver status will change to UPDATING.

720be4cce45a13789a79dd5b0deacf25.png

  1. Notice that the Private Resolver status will change from UPDATING to ACTIVE.

* You might have to refresh the browser if the Console does not update automatically.

  1. Notice that the other VCN is added to the Private Views.
  2. Scroll up.

E3cc7aac22833e9a3fb0d814cfae096f.png

  • Click on the Virtual cloud networks breadcrumbs menu to return to the VCN page.

E757b82264a7d95209053c63f122d59a.png

  • Click on the other VCN (where the ATP Database is NOT hosted in).

550efae521b2192f657cb6607eab543b.png

  • Click on the DNS Resolver of the VCN.

93f15131641a57dbbab9dbdf46e2e9f8.png

  • Scroll down.

4051cbbd5f6fb79cf353318bf4706309.png

  • Click on the Manage private views button.

Ab9bd1ddb2cd1e3f0abfd3656a447ba3.png

  1. Select the OTHER VCN to allow so that that VCN can resolve DNS host names in THIS VCN.
  2. Click on the Save changes button.

9443c2be1f34ca414804e3f59421a1a9.png

  • Notice that the Private Resolver status will change to UPDATING.

6b25c69c5b0f6814a3f3b3a508e4b19d.png

  1. Notice that the Private Resolver status will change from UPDATING to ACTIVE.

* You might have to refresh the browser if the Console does not update automatically.

  1. Notice that the other VCN is added to the Private Views.

E891350f158855b3b4617eff02c1672c.png

  • In the picture below you will see an illustration of what we have created so far.

15ae7bb22daa630b644a137d10c4ba72.png

STEP 07 - Use Oracle SQL Developer to test the Database connection from a different VCN Associated private views to the VCN Private resolver

  • Now let's do the same test again with the Private Endpoint URL.
  • Type in the command `telnet zps0ilns.adb.eu-frankfurt-1.oraclecloud.com 1522`.

C2a9f35f92c4d673f882a5e343069f6b.png

  • Notice that the connection is now accepted. So from a network level, we can confirm that the connection works using the Private Endpoint URL. from the OTHER VCN.

Ced890a15e1fd125af5e56c583da35f0.png

  • With the Oracle SQL Developer application still open click on the Test button again.

1d6d4ad02fa12f365acf03b6d236d112.png

  1. Notice the status will display Success.
  2. Click on the Connect button.

7b82b862316c0da71b77cd08d8150884.png

  1. The username is already specified.
  2. Specify the password.
  3. Click on the OK button.

Efa0d6da951af7937f9c971d9c59f4a0.png

  • Notice that the Oracle SQL Developer application is now connected to the ATP Database.

Ed97ba15e68532acd73860a563d5253a.png

  • Click on the + sign to expand the ATP Database connection.

3b0b98bcc38635da219285a4b7bd42af.png

  • In the picture below you will see an illustration of what we have created so far.

072f2e3b12f9d730cad890859f966a88.png

Conclusion

In this tutorial, we have created a Private View inside the Virtual Cloud Network (VCN) Private Resolver to allow components from one VCN to resolve DNS records from another VCN component.

We explained a use case where we will create an Autonomous Transaction Processing Database (ATP) and perform some basic network connectivity tests and tests with the Oracle SQL Developer application from within the same VCN, and from another VCN.

We used the Wallet file (that uses the Private Access DNS name or the ATP Database) and tested the ATP Database connection from the same and a different VCN. To allow connectivity from a different VCN (using the private URL with an FQDN) the Private Resolvers needed to be configured.

  • In the picture below you will see an illustration of what we have created so far.

C82ae82ad06e5a4b175421c4c59ea6c1.png

Retrieved from "http://www.iwanhoogendoorn.nl/index.php?title=Associate_Private_Views_to_the_VCN_Private_Resolvers_with_ATP_Database_and_Oracle_SQL_Developer_in_Different_VCNs&oldid=6691"