Hub and spoke routing within a cloud provider can be confusing and hard to configure. To achieve this we need to configure multiple objects with different types of configuration. Network routing and network security across multiple levels inside the cloud make this confusing.

In this tutorial, we will explain how to configure a hub VCN with three-spoke VCNs. The hub VCN will contain the pfSense firewall and the connection to the internet and OCI services network. All network traffic originating from the spoke VCN that needs to communicate with other spoke VCNs or with the Internet or the OCI services network needs to pass the hub VCN for firewall inspection.

The following images illustrate the traffic flows.

- Spoke to spoke connectivity

- Spoke to Hub connectivity

- Hub to Spoke connectivity

- Spoke to Internet connectivity

- Spoke to Service connectivity

- Hub to Internet connectivity

- Internet to Hub connectivity

<aside> In this tutorial, we will use several networks in the spokes.

- Spoke A VCN subnet: `172.16.1.0/25`.
- Spoke B VCN subnet: `172.16.2.0/25`.
- Spoke C VCN subnet: `172.16.3.0/25`. </aside>

Objectives

- Set up an OCI routing environment with hub and spoke routing fully configured. We will route all network traffic to the hub VCN where the hub VCN will contain a firewall that will inspect all the traffic coming from the spokes.

- Task 1: Create the hub and spoke VCNs.
- Task 2: Create the subnets inside the hub and spoke VCNs.
- Task 3: Create a DRG, internet gateway, and a NAT gateway.
- Task 4: Add instances attached to different subnets inside all VCNs.
- Task 5: Add a pfSense firewall in the hub VCN.
- Task 6: Open firewall rules on the security lists.
- Task 7: Configure routing between the different VCNs and the internet with hub firewall inspection.
- Task 8: Verify the connectivity.

Task 1 - Create the Hub and Spoke VCNs

- Log in to the OCI Console and click Virtual cloud Networking or click the hamburger menu (≡), Networking and Virtual cloud networks.

- Click Create VCN to create the VCN.

1. Enter the Name for the hub VCN.
2. Enter an IPv4 CIDR Block for the hub VCN.
3. Scroll down.

- Click Create VCN.

1. Notice that the hub VCN is AVAILABLE.
2. Click Virtual Cloud Networks to return to the VCN page.

- The following image illustrates the visual representation of what you have created so far.

Now, we will create three spoke VCNs (Spoke A, Spoke B, and Spoke C).

- Click Create VCN to create the first spoke VCN (Spoke A).

1. Enter the Name for the spoke VCN.
2. Enter an IPv4 CIDR Block for the spoke VCN.
3. Click Create VCN.

1. Notice that the spoke VCN is AVAILABLE.
2. Click Virtual Cloud Networks to return to the VCN page.

- Click Create VCN to create the second spoke VCN (Spoke B).

1. Enter the Name for the spoke VCN.
2. Enter an IPv4 CIDR Block for the hub VCN.
3. Click Create VCN.

1. Notice that the spoke VCN is AVAILABLE.
2. Click Virtual Cloud Networks to return to the VCN page.

1. Click Create VCN to create the third spoke VCN.
2. Enter the Name for the spoke VCN.
3. Enter an IPv4 CIDR Block for the hub VCN.
4. Click Create VCN.

1. Notice that the spoke VCN is AVAILABLE.
2. Click Virtual Cloud Networks to return to the VCN page.

- Notice that we have created 1 hub and 3 spoke VCNs.

- The following image illustrates the visual representation of what you have created so far.

Task 2 - Create the Subnets inside the Hub and Spoke VCNs

We have the hub and spoke VCNs in place. Now, create subnets inside the VCNs.

Create a Subnet inside Hub VCN

In the hub VCN we will create 1 private subnet and 1 public subnet.

- Click the hub VCN.

- Click Create Subnet to create the first subnet (private).

1. Enter the Name for the private subnet.
2. In Subnet Type, select Regional.
3. Enter IPv4 CIDR Block for the private subnet.
4. Scroll down.

1. In Route Table, select the default route table.
2. In Subnet Access, select a Private Subnet.
3. Scroll down.

1. In DHCP options, select the default DHCP options.
2. In Security List, select the default security list.
3. Click Create Subnet.

- Notice that the state is set to Provisioning.

1. After a few minutes the state is changed to Available.
2. Click Create Subnet to create the second subnet (public).

1. Enter the Name for the private subnet.
2. In Subnet Type, select Regional.
3. Enter IPv4 CIDR Block for the public subnet.
4. Scroll down.

1. In Route Table, select the default route table.
2. In Subnet Access, select a Public Subnet.
3. Scroll down.

1. In DHCP options, select the default DHCP options.
2. In Security List, select the default security list.
3. Click Create Subnet.

- Notice that the state is set to Provisioning.

- After a few minutes the state is changed to Available.

- The following image illustrates the visual representation of what you have created so far.

Create a Subnet in Spoke VCN A

Create one private subnet inside the spoke VCN A.

- Click the spoke VCN A.

- Click Create Subnet to create the subnet (private).

1. Enter the Name for the private subnet.
2. Enter IPv4 CIDR Block for the private subnet.
3. Scroll down.

1. In Route Table, select the default route table.
2. In Subnet Access, select a Private Subnet.
3. Scroll down.

1. In DHCP options, select the default DHCP options.
2. In Security List, select the default security list.
3. Click Create Subnet.

- Notice that the state is set to Provisioning.

1. Notice that the state is changed to Available.
2. Click Virtual Cloud Networks to return to the VCN page.

- The following image illustrates the visual representation of what you have created so far.

Create a Subnet in Spoke VCN B

Create one private subnet inside the spoke VCN B.

- Click the spoke VCN B.

- Click Create Subnet to create the subnet (private).

1. Enter the Name for the private subnet.
2. Enter IPv4 CIDR Block for the private subnet.
3. Scroll down.

1. In Route Table, select the default route table.
2. In Subnet Access, select a Private Subnet.
3. Scroll down.

1. In DHCP options, select the default DHCP options.
2. In Security List, select the default security list.
3. Click Create Subnet.

- Notice that the state is set to Provisioning.

1. Notice that the state is changed to Available.
2. Click Virtual Cloud Networks to return to the VCN page.

- The following image illustrates the visual representation of what you have created so far.

Create Subnet inside Hub VCN C

Create one private subnet inside the spoke VCN C.

- Click the spoke VCN C.

- Click Create Subnet to create the subnet (private).

1. Enter the Name for the private subnet.
2. Enter IPv4 CIDR Block for the private subnet.
3. Scroll down.

1. In Route Table, select the default route table.
2. In Subnet Access, select a Private Subnet.
3. Scroll down.

1. In DHCP options, select the default DHCP options.
2. In Security List, select the default security list.
3. Click Create Subnet.

- Notice that the state is set to Provisioning.

- Notice that the state is changed to Available.

- The following image illustrates the visual representation of what you have created so far.

Task 3 - Create a Dynamic Routing Gateway -DRG- and Internet Gateway and a NAT Gateway in the Hub VCN

Create a DRG that will be used to route traffic between the VCNs. We also need to create an internet gateway and a NAT gateway for our access to the Internet.

- Click the hub VCN.

- Click Internet Gateways.

1. Click Create Internet Gateway.
2. Enter the Name of the internet gateway.
3. Click Create Internet Gateway.

1. Notice that the state is Available.

- The following image illustrates the visual representation of what you have created so far.

1. We are inside the hub VCN configuration page after internet gateway creation. Scroll down.
2. Click NAT Gateways.
3. Click Create NAT Gateway.

1. Enter the Name of the NAT Gateway.
2. Select Ephemeral Public IP Address.
3. Click Create NAT Gateway.

1. Notice that the state is Available.

- The following image illustrates the visual representation of what you have created so far.

- Create the Dynamic Routing Gateway (DRG).

1. Click the hamburger menu (≡) icon from the upper left corner.
2. Click Networking.
3. Click Dynamic routing gateway.

- Click Create dynamic routing gateway.

1. Enter the Name of the dynamic routing gateway.
2. Click Create dynamic routing gateway.

1. Notice that the state is PROVISIONING.

- Notice that the state is changed to AVAILABLE.

- The following image illustrates the visual representation of what you have created so far.

Task 4 - Add Instances attached to different Subnets inside all VCNs

We will add various OCI Compute instances in all the VCNs so we can test out the routing flows.

Create Instance in Hub VCN

In the hub VCN, we will create a Windows compute instance that will have two main functions:

- The Windows instance will act as a stepstone machine to access the other instances inside our OCI environment.

- The Windows instance will also be a network endpoint that can be used for testing the routing flows.

Windows Instance as Step Stone

To create a Windows instance (hub-step-stone) that can act as a stepping stone inside your OCI environment, use [Deploy a Windows Instance in Oracle Cloud Infrastructure.]

Note

Create the Windows stepping stone instance (hub-step-stone) before you continue with the tutorial.

The following image illustrates the visual representation of what you have created so far.

Create Instance in Hub VCN Spoke VCN A

In the spoke VCN A, we will create a simple Linux instance that will act as a network endpoint that we can use to test our routing flows.

Spoke A Client Instance

- Create a instance.

1. Click the hamburger menu (≡) icon from the upper left corner.
2. Click Compute.
3. Click Instances.

- Click Create Instance.

1. Enter the Name of the instance.
2. Scroll down.

- Scroll down.

1. In Primary network, select Select existing virtual cloud network.
2. In VCN, select SPOKE-VCN-A.
3. In Subnet, select Select existing subnet.
4. Select Private Subnet from the spoke VCN A.
5. Scroll down.

1. In Private IPv4 address, select Automatically assign private IPv4 address.
2. Scroll down.

1. In Add SSH keys, select Generate a key pair for me.
2. Click Save private key to save the private key locally.
3. Click Save public key to save the public key locally.

- Make sure the keys are stored somewhere locally.

Note

We will use the same key pair for the other spoke instances.

- Scroll down.

- Click Create.

- Notice that the state is PROVISIONING.

1. Notice that the state is changed to RUNNING.
2. Note the Private IP address for later.
3. Click Instances to return to the instances page.

1. Notice that the Instance A is running.
2. Click Create Instance to create the next instance.

- The following image illustrates the visual representation of what you have created so far.

Create Instance in Spoke VCN B

In the Spoke VCN B, we will create a simple Linux Instance that will act as a network endpoint that we can use to test our routing flows.

Spoke B Client Instance

- Create an instance.

1. Enter the Name of the instance.
2. Scroll down.

- Scroll down.

1. In Primary network, select Select existing virtual cloud network.
2. In VCN, select SPOKE-VCN-B.
3. In Subnet, select Select existing subnet.
4. Select the Private Subnet from spoke VCN B.
5. Scroll down.

1. In Private IPv4 address, select Automatically assign private IPv4 address.
2. Scroll down.

1. Upload public key files.
2. Click Browse. Select the public key file you saved when you created instance A.
3. Make sure the public key is selected.
4. Scroll down.

- Scroll down.

- Click Create.

- Note that the state is PROVISIONING.

1. Note that the state is changed RUNNING.
2. Note the Private IP address to be used in a later step.
3. Click Instances to return to the instances page.

1. Note that Instance B is Running.
2. Click Create Instance to create the next instance.

- The following image illustrates the visual representation of what you have created so far.

Create Instance in Spoke VCN C

In the Spoke VCN C, we will create a simple Linux instance that will act as a network endpoint that we can use to test our routing flows.

Spoke C Client Instance

- Create an instance.

1. Enter a name of the instance.
2. Scroll down.

- Scroll down.

1. In Primary network, select Select existing virtual cloud network.
2. In VCN, select SPOKE-VCN-C.
3. In Subnet, select Select existing subnet.
4. Select the Private Subnet from the spoke VCN C.
5. Scroll down.

1. In Private IPv4 address, select Automatically assign private IPv4 address.
2. Scroll down.

1. Upload public key files.
2. Click Browse. Select the public key file you saved when you created instance A.
3. Make sure the public key is selected 4. Scroll down.

- Scroll down.

- Click Create.

- Notice that the state is PROVISIONING.

1. Notice that the state is changed to RUNNING.
2. Note the Private IP address for later.
3. Click Instances to return to the instances page

- Notice that the Instance C is running.

- The following image illustrates the visual representation of what you have created so far.

Task 5 - Add a pfSense Firewall Instance in the Hub VCN

The last instance we need for our network setup is a firewall. For example, this can be any firewall like the OCI Network Firewall. In this tutorial, we will use the pfSense firewall.

To create a pfSense instance (`hub-fw`) which can act as a firewall inside your OCI environment, use [this tutorial.]

Note

Create the pfSense instance before you continue the tutorial.

The following image illustrates the visual representation of what you have created so far.

Task 6 - Open Firewall Rules on the Security Lists

In an OCI environment, there are multiple layers of network security. By default, all ingress network traffic is blocked for most protocols and ports. To make testing with ping possible we will open the ICMP ports on the hub and spoke VCNs so that we can allow all ICMP traffic that is coming into the VCN.

Add Ingress Rule in Hub VCN

- Go to the OCI Console.

1. Click the hamburger menu (≡) from the upper left corner.
2. Click Virtual Cloud Networks or navigate to Networking and Virtual Cloud Networks.

- Select the hub VCN to which your pfSense firewall is attached.

1. Scroll down.
2. Click Security Lists.
3. Click Default Security List for HUB-VCN.

- Click Add Ingress Rules.

1. In Source Type, select CIDR.
2. In Source CIDR, enter `0.0.0.0/0`.
3. In IP Protocol, select ICMP.
4. Click Add Ingress Rules.

- Note the ICMP rules is added.

- Click Virtual cloud networks to return to the VCN page.

- The following image illustrates the visual representation of what you have created so far.

Add Ingress Rule in Spoke VCN A

- Click the spoke VCN A.

1. Scroll down.
2. Click Security Lists.
3. Click Default Security List for SPOKE-VCN-A

- Click Add Ingress Rules.

1. In Source Type, select CIDR.
2. In Source CIDR, enter `0.0.0.0/0`.
3. In IP Protocol, select ICMP.
4. Click Add Ingress Rules.

- Notice the ICMP rule is added.

- The following image illustrates the visual representation of what you have created so far.

Add Ingress Rules in Spoke VCN B

- Click the spoke VCN B.

1. Scroll down.
2. Click Security Lists.
3. Click Default Security List for SPOKE-VCN-B

- Click Add Ingress Rules.

1. In Source Type, select CIDR.
2. In Source CIDR, enter `0.0.0.0/0`.
3. In IP Protocol, select ICMP.
4. Click Add Ingress Rules.

- Note the ICMP rule is added.

- The following image illustrates the visual representation of what you have created so far.

Add Ingress Rules in Spoke VCN C

- Click spoke VCN C.

1. Scroll down.
2. Click Security Lists.
3. Click Default Security List for SPOKE-VCN-C

- Click Add Ingress Rules.

1. In Source Type, select CIDR.
2. In Source CIDR, enter `0.0.0.0/0`.
3. In IP Protocol, select ICMP.
4. Click Add Ingress Rules.

- Note the ICMP rule is added.

- The following image illustrates the visual representation of what you have created so far.

Task 7 - Configure Routing between the different VCNs and the Internet with Hub Firewall Inspection

We already have all the required components. Now, we need to configure routing. Before we can configure routing we need to first attach the VCNs to the DRG.

After this, we will create the attachments that we need to create different VCN routing tables, DRG routing tables and to associate these routing tables to different VCNs, DRG VCN attachments, subnets, and gateways.

Task 7-1 - Create VCN Attachments on DRG

- Create VCN attachments on the DRG.

1. Click the hamburger menu (≡) from the upper left corner.
2. Click Networking.
3. Click Dynamic Routing Gateway.

- Click the DRG created in Task 3.

1. Click VCN attachments.
2. Click Create virtual network attachment.

1. Enter a Attachment name for the hub VCN.
2. Select the hub VCN.
3. Click Create VCN attachment.

- Notice that the hub VCN state is Attaching.

- The following image illustrates the visual representation of what you have created so far.

1. Notice that the hub VCN state changed to Attached.
2. Click Create virtual network attachment to create the next attachment.

1. Enter Attachment name for the spoke VCN A.
2. Select the spoke VCN A.
3. Click Create VCN attachment.

- Note that the spoke VCN A state is Attaching.

- The following image illustrates the visual representation of what you have created so far.

1. Note that the spoke VCN A state has changed to Attached.
2. Click Create virtual network attachment to create the next attachment.

1. Enter Attachment name for the spoke VCN B.
2. Select the spoke VCN B.
3. Click Create VCN attachment.

- Note that the spoke VCN B state is Attaching.

- The following image illustrates the visual representation of what you have created so far.

1. Note that the spoke VCN B state has changed to Attached.
2. Click Create virtual network attachment to create the next attachment.

1. Enter a Attachment name for spoke VCN C.
2. Select spoke VCN C.
3. Click Create VCN attachment.

- Note that the spoke VCN C state is Attaching.

- Note that the spoke VCN C state has changed to Attached.

- The following image illustrates the visual representation of what you have created so far.

Task 7-2 - Create and Configure Spoke VCN Routing Tables

We need to create two types of routing tables: VCN Routing Tables and DRG Routing Tables.

Note

By default when you create a VCN, a default routing table is created.

- Spoke VCN A only has the default VCN routing table.

Destination	Target Type	Target	Route Type
0.0.0.0/0	Dynamic Route Gateway	DRG	Static

1. Click the hamburger menu (≡) from the upper left corner.
2. Click Networking.
3. Click Virtual cloud networks.

- Click spoke VCN A.

1. Click Route Tables.
2. Click Default route table for SPOKE-VCN-A.

- Click Add Route Rules.

1. In Target Type, select the Dynamic Routing Gateway.
2. In Destination Type, select CIDR Block.
3. In Destination CIDR Block, enter `0.0.0.0/0`.
4. Click Add Route Rules.

- This rule will route all traffic coming from spoke VCN A to the DRG.

1. Note that the `0.0.0.0/0` route is now added to the default route table of spoke VCN A.
2. Click Virtual cloud networks to return to the VCN page.

- The following image illustrates the visual representation of what you have created so far.

- Spoke VCN B only has the default VCN routing table.

Destination	Target Type	Target	Route Type
0.0.0.0/0	Dynamic Route Gateway	DRG	Static

- Click spoke VCN B.

1. Click Route Tables.
2. Click Default Route Table from SPOKE-VCN-B.

- Click Add Route Rules.

1. In Target Type, select the Dynamic Routing Gateway.
2. In Destination Type, select CIDR Block.
3. In Destination CIDR Block, enter `0.0.0.0/0`.
4. Click Add Route Rules.

- This rule will route all traffic coming from spoke VCN B to the DRG.

1. Note that the `0.0.0.0/0` route is now added to the default route table of spoke VCN B.
2. Click Virtual cloud networks to return to the VCN page.

- The following image illustrates the visual representation of what you have created so far.

- Spoke VCN C only has the default VCN routing table.

Destination	Target Type	Target	Route Type
0.0.0.0/0	Dynamic Route Gateway	DRG	Static

- Click spoke VCN C.

1. Click Route Tables.
2. Click Default Route Table for SPOKE-VCN-C.

- Click Add Route Rules.

1. In Target Type, select the Dynamic Routing Gateway.
2. In Destination Type, select CIDR Block.
3. In Destination CIDR Block, enter `0.0.0.0/0`.
4. Click Add Route Rules.

- This rule will route all traffic coming from spoke VCN C to the DRG.

- Note that the `0.0.0.0/0` route is now added to the default route table of spoke VCN C.

- The following image illustrates the visual representation of what you have created so far.

Task 7-3 - Create and Configure Hub VCN Routing Tables

- Create a route table (`VCN_HUB_RT_DRG_TRANSIT`) in the Hub VCN.

Destination	Target Type	Target	Route Type
0.0.0.0/0	Private IP	172.16.0.20 (FW IP)	Static
172.16.1.0/24	Private IP	172.16.0.20 (FW IP)	Static
172.16.2.0/24	Private IP	172.16.0.20 (FW IP)	Static
172.16.3.0/24	Private IP	172.16.0.20 (FW IP)	Static

{{note|To route the traffic that is going from spoke to spoke VCN's we also need to add in the specific routes in this route table as the default `0.0.0.0/0` is not enough to make this work.}

- Go to the OCI Console.

1. Click the hamburger menu (≡) from the upper left corner.
2. Click Networking.
3. Click Virtual cloud networks.

- Click the hub VCN.

1. Click Route Tables.
2. Click Create Route Table.

1. Enter the Name of the new hub VCN route table.
2. Click + Another Route Rule (not in the screenshot).
3. In Target Type, select Private IP.
4. Scroll down.

1. In Destination Type, select CIDR Block.
2. In Destination CIDR Block, enter `0.0.0.0/0`.
3. In Target Selection, enter `172.16.0.20` (this is the IP address of our pfSense firewall).
4. Click Create.

1. Note that you will get the following error: `PrivatelP (ocid 1.privateip.oc1.eu-frankfurt-1.abtheljtrcahk23t4vtbeguxxxxxxxxxxxxxxxxxvwbgypf36ad4cyjmka) is an invalid route target. (The Private IP is attached to a VNIC whose SRC/DST check is enabled)`.

2. Click Cancel.

- To fix this, we need to enable the skip source/destination check on the pfSense firewall instance VNIC.

1. Click the hamburger menu (≡).
2. Click Compute.
3. Click Instances.

- Click the `hub-fw` (pfSense instance).

- Scroll down.

1. Click Attached VNICs.
2. Click the three dots of the VNIC.
3. Click Edit VNIC.

1. Select Skip source/destination check.
2. Click Save changes.

- Now, create the hub VNC routing tables.

1. Click the hamburger menu (≡) from the upper left corner.
2. Click Networking.
3. Click Virtual cloud networks.

- Click the hub VCN.

1. Click Route Tables.
2. Click Create Route Table.

1. Enter the Name for the new hub VCN route table.
2. Click + Another Route Rule.

1. InTarget Type, select Private IP.
2. Scroll down.

1. In Destination Type, select CIDR Block.
2. In Destination CIDR Block, enter `0.0.0.0/0`.
3. In Target Selection, enter `172.16.0.20` (this is the IP address of our pfSense firewall).
4. Click Create.

- We need to add three more routes to the `VCN_HUB_RT_DRG_TRANSIT` route table.

- Click Add Route Rules.

1. In Target Type, select Private IP.
2. In Destination Type, select CIDR Block.
3. In Destination CIDR Block, enter `172.16.1.0/24`.
4. In Target Selection, enter `172.16.0.20` (this is the IP address of our pfSense firewall).
5. Click + Another Route Rule.

1. In Target Type, select Private IP.
2. In Destination Type, select CIDR Block.
3. In Destination CIDR Block, enter `172.16.2.0/24`.
4. In Target Selection, enter `172.16.0.20` (this is the IP address of our pfSense firewall).
5. Click + Another Route Rule.

1. In Target Type, select Private IP.
2. In Destination Type, select CIDR Block.
3. In Destination CIDR Block, enter `172.16.3.0/24`.
4. In Target Selection, enter `172.16.0.20` (this is the IP address of our pfSense firewall).
5. Click + Another Route Rule.

1. Note that the 4 route rules created.
2. Click the Hub VCN to return to the Hub VCN page.

1. Note that the hub VCN routing table is now in the list.
2. Click Create Route Table again to create another hub VCN route table for the public subnet.

- The following image illustrates the visual representation of what you have created so far.

- Create a route table (`VCN_RT_HUB_PUBLIC_SUBNET`) in the hub VCN.

Destination	Target Type	Target	Route Type
0.0.0.0/0	Internet Gateway	hub-internet-gateway	Static
172.16.1.0/24	Private IP	172.16.0.20 (FW IP)	Static
172.16.2.0/24	Private IP	172.16.0.20 (FW IP)	Static
172.16.3.0/24	Private IP	172.16.0.20 (FW IP)	Static

- Create route table.

1. Enter the Name for the new hub VCN route table for the public subnet.
2. Click + Another Route Rule.

1. In Target Type, select Internet Gateway.
2. In Destination CIDR Block, enter `0.0.0.0/0`.
3. Scroll down.

1. In Target Internet Gateway, select the internet gateway you created earlier.
2. Click + Another Route Rule.

1. In Target Type, select Private IP.
2. In Destination Type, select CIDR Block.
3. In Destination CIDR Block, enter `172.16.1.0/24`.
4. In Target Selection, enter `172.16.0.20` (this is the IP address of our pfSense firewall).
5. Scroll down.

- Click + Another Route Rule.

1. In Target Type, select Private IP.
2. In Destination Type, select CIDR Block.
3. In Destination CIDR Block, enter `172.16.2.0/24`.
4. In Target Selection, enter `172.16.0.20` (this is the IP address of our pfSense firewall).
5. Scroll down.

- Click + Another Route Rule.

1. In Target Type, select Private IP.
2. In Destination Type, select CIDR Block.
3. In Destination CIDR Block, enter `172.16.3.0/24`.
4. In Target Selection, enter `172.16.0.20` (this is the IP address of our pfSense firewall).
5. Scroll down.

1. Note that the route table for the public subnet is created. Click the routing table name.
2. Also, note that this routing table contains 4 routing rules.

- Note if the 4 route rules are present.

1. Scroll up.
2. Click the Hub VCN to return to the Hub VCN page.

- The following image illustrates the visual representation of what you have created so far.

- Create a route table (`VCN_HUB_RT_NAT_TRANSIT`) in the Hub VCN.

Destination	Target Type	Target	Route Type
172.16.1.0/24	Private IP	172.16.0.20 (FW IP)	Static
172.16.2.0/24	Private IP	172.16.0.20 (FW IP)	Static
172.16.3.0/24	Private IP	172.16.0.20 (FW IP)	Static

1. Click Route Tables.
2. Click Create Route Table again to create another hub VCN route table for the NAT gateway.

1. Enter the Name for the new hub VCN route table for the NAT gateway.
2. Click + Another Route Rule.

1. In Target Type, select Private IP.
2. In Destination Type, select CIDR Block.
3. In Destination CIDR Block, enter `172.16.1.0/24`.
4. In Target Selection, enter `172.16.0.20` (this is the IP address of our pfSense firewall).
5. Scroll down.

- Click + Another Route Rule.

1. In Target Type, select Private IP.
2. In Destination Type, select CIDR Block.
3. In Destination CIDR Block, enter `172.16.2.0/24`.
4. In Target Selection, enter `172.16.0.20` (this is the IP address of our pfSense firewall).
5. Scroll down.

- Click + Another Route Rule.

1. In Target Type, select Private IP.
2. In Destination Type, select CIDR Block.
3. In Destination CIDR Block, enter `172.16.3.0/24`.
4. In Target Selection, enter `172.16.0.20` (this is the IP address of our pfSense firewall).
5. Scroll down.

1. Note that the route table for the NAT gateway is created. Click the routing table name.
2. Also, note that this routing table contains 3 routing rules.

1. Note the 3 route rules we created.
2. Click Hub VCN to return to the Hub VCN page.

- The following image illustrates the visual representation of what you have created so far.

- Create a route table (`VCN_RT_HUB_PRIVATE_SUBNET`) in the Hub VCN.

Destination	Target Type	Target	Route Type
0.0.0.0/0	NAT Gateway	hub-nat-gw	Static
172.16.1.0/24	Dynamic Route Gateway	DRG	Static
172.16.2.0/24	Dynamic Route Gateway	DRG	Static
172.16.3.0/24	Dynamic Route Gateway	DRG	Static

1. Click Route Tables.
2. Click the routing table for the private subnet. If you do not have this table, then create it. To create the route table, click Create Route Table.

1. Note that there is already one route rule present that will route all traffic (`0.0.0.0/0`) to the NAT gateway for the private subnet instances.
2. Click Add Route Rules.

1. In Target Type, select Dynamic Routing Gateway.
2. In Destination Type, select CIDR Block.
3. In Destination CIDR Block, enter `172.16.1.0/24`.
4. Click + Another Route Rule.

1. In Target Type, select Dynamic Routing Gateway.
2. In Destination Type, select CIDR Block.
3. In Destination CIDR Block, enter `172.16.2.0/24`.
4. Click + Another Route Rule.

1. In Target Type, select Dynamic Routing Gateway.
2. In Destination Type, select CIDR Block.
3. In Destination CIDR Block, enter `172.16.3.0/24`.
4. Click Add Route Rules.

- Note all the route rules for the private subnet routing table.

- The following image illustrates the visual representation of what you have created so far.

Error creating thumbnail: File with dimensions greater than 12.5 MP

Task 7-4 - Create and Configure DRG Routing Tables

- Create a route distribution group (`DRG_RDG_IMPORT`) in the DRG.

Priority	Match Type	Match Criteria	Action
1	Attachment	SPOKE_VCN-A_ATTACHMENT	ACCEPT
2	Attachment	SPOKE_VCN-B_ATTACHMENT	ACCEPT
3	Attachment	SPOKE_VCN-C_ATTACHMENT	ACCEPT

1. Click the hamburger menu (≡) from the upper left corner.
2. Click Networking.
3. Click Dynamic routing gateway.

- Click the DRG created in Task 3.

1. Click Import route distribution.
2. Click Create import route distribution.

- In the Create import route distribution page, enter the following information.

1. Enter the Name for the route distribution.
2. Create a new route distribution statement.

   - Priority: Enter 1.
   - Match Type: Select Attachment.
   - Attachment type filter: Select Virtual Cloud Network.
   - DRG attachment: Select spoke VCN A.
   - Action: Select Accept.

3. Create a new route distribution statement

   - Priority: Enter 2.
   - Match Type: Select Attachment.
   - Attachment type filter: Select Virtual Cloud Network.
   - DRG attachment: Select spoke VCN B.
   - Action: Select Accept.

4. Create a new route distribution statement

   - Priority: Enter 3.
   - Match Type: Select Attachment.
   - Attachment type filter: Select Virtual Cloud Network.
   - DRG attachment: Select spoke VCN C.
   - Action: Select Accept.

5. Click Create import route distribution.

- Click the new import route distribution.

1. Note the route distribution statements.
2. Click Dynamic routing gateways details to return to the DRG details page.

- The following image illustrates the visual representation of what you have created so far.

Error creating thumbnail: File with dimensions greater than 12.5 MP

- Create a route table (`DRG_RT_SPOKE_VCN_2`) in the DRG.

Destination CIDR	Next Hop Attachment Type	Next Hop Attachment Name
0.0.0.0/0	Virtual Cloud Network	HUB_VCN_ATTACHMENT

1. Click DRG route tables.
2. Click Create DRG route table.

1. Enter the Name for the DRG route table.
2. Add a new static rule:

   - Destination CIDR Block: Enter `0.0.0.0/0`.
   - Next hop attachment type: Select Virtual Cloud Network
   - Next hop attachment: Select hub VCN.

3. Click Create DRG route table.

- Wait for the creation of the route table.

1. Note that the new DRG route table is created.
2. Click Create DRG route table to create another DRG routing table.

- The following image illustrates the visual representation of what you have created so far.

Error creating thumbnail: File with dimensions greater than 12.5 MP

- Create a route table (`DRG_RT_HUB_VCN_3`) in the DRG and import the route distribution group (`DRG_RDG_IMPORT`).

1. Enter the Name for the DRG route table.
2. Click Show Advanced options.

- Import the Import Route Distribution created earlier.

1. Click Route table settings.
2. Select Enable import route distribution.
3. Select the import route distribution created earlier.
4. Click Create DRG route table.

1. Notice that the new DRG route table is created.

- The following image illustrates the visual representation of what you have created so far.

Error creating thumbnail: File with dimensions greater than 12.5 MP

Task 7-5 - Attach the Route Tables

Now that we have created route tables, we need to attach the route tables to the DRG, VCNs, subnets, and gateways.

Note

This is where routing is activated, so this is a careful process that needs to be thought of first and properly tested before you implement or make changes in a Production environment.

Attach the DRG Route Tables:

Let us first attach the DRG routing tables.

Attach DRG Routing Tables to the Spoke VCN Attachments

Routing Information: (`DRG_RT_SPOKE_VCN_2`) This DRG route table and route table attachment will make sure that all traffic that is coming from the spoke VCNs, is now routed to the hub VCN.

First, we are going to attach the ()`DRG_RT_SPOKE_VCN_2`) DRG Routing table to all the spoke VCN attachments.

- Go to the DRG page. Click Networking, Dynamic Routing Gateway and select the DRG created earlier.

1. Click VCN attachments.
2. Click the VCN attachment for Spoke A.

1. Note that the VCN attachment for Spoke A has the autogenerated DRG table associated. We need to change this.
2. Click Edit.

- Click Show Advanced options.

1. Select the DRG route table.
2. Select the DRG route table created earlier: `DRG_RT_SPOKE_VCN_2`.
3. Click Save Changes.

1. Note that a new DRG route table is active on the spoke A VCN attachment.
2. Click DRG to return to the DRG details page.

- The following image illustrates the visual representation of what you have created so far.

Error creating thumbnail: File with dimensions greater than 12.5 MP

- Click the VCN attachment for spoke B.

1. Note that the VCN Attachment for spoke B has the autogenerated DRG table associated. We need to change this.
2. Click Edit.

1. Click Show Advanced options.
2. Select the DRG route table tab.
3. Select the DRG route table created earlier (`DRG_RT_SPOKE_VCN_2`).
4. Click Save Changes.

1. Note that a new DRG route table is active on the spoke B VCN attachment.
2. Click DRG to return to the DRG details page.

- The following image illustrates the visual representation of what you have created so far.

Error creating thumbnail: File with dimensions greater than 12.5 MP

- Click the VCN attachment for spoke C.

1. Note that the VCN attachment for spoke C has the autogenerated DRG table associated. We need to change this.
2. Click Edit.

1. Click Show Advanced options.
2. Select the DRG route table tab.
3. Select the DRG route table created earlier (`DRG_RT_SPOKE_VCN_2`).
4. Click Save Changes.

1. Note that a new DRG route table is active on the spoke VCN C attachment.
2. Click DRG to return to the DRG details page.

- The following image illustrates the visual representation of what you have created so far.

Error creating thumbnail: File with dimensions greater than 12.5 MP

Attach DRG Routing Tables to the Hub VCN Attachment

We will attach the ()`DRG_RT_HUB_VCN_3`) DRG route table to the hub VCN attachment. We are also going to attach the (`VCN_HUB_RT_DRG_TRANSIT`) VCN route table to the hub VCN attachment.

Routing Information: (`DRG_RT_HUB_VCN_3`) This DRG route table and route table attachment will make sure that all networks from the spokes are known on the DRG and learned on the DRG so that the DRG knows what networks are available on the spokes and so it knows where to route the spoke networks to.

Routing Information: (`VCN_HUB_RT_DRG_TRANSIT`) This VCN route table and route table attachment will make sure that all traffic is routed to the firewall in the hub.

- Go to the DRG page. Click Networking, Dynamic Routing Gateway and select the DRG created earlier.

1. Click VCN attachments.
2. Click the VCN attachment for the hub.

1. Note that the VCN attachment for the hub has the autogenerated DRG table associated. We need to change this.
2. Note that the VCN attachment for the hub has no VCN table associated. We need to add this.
3. Click Edit.

1. Click Show Advanced options.
2. Select the DRG route table tab.
3. Select the DRG route table created earlier (`DRG_RT_HUB_VCN_3`).
4. Click the VCN route table tab.

1. Select Select existing to select an existing VCN route table.
2. Select the VCN route table created earlier (`VCN_HUB_RT_DRG_TRANSIT`).
3. Click Save Changes.

1. Note that a new DRG route table is active on the hub VCN attachment.
2. Note that a new VCN route table is active on the hub VCN attachment.

- The following image illustrates the visual representation of what you have created so far.

Error creating thumbnail: File with dimensions greater than 12.5 MP

Attach the VCN Route Tables:

Now, we are going to attach the VCN route tables even though we already started doing this for one of the VCN route tables in the previous task.

Attach VCN Routing Tables to the Hub VCN Public Subnet

Attach the (`VCN_RT_HUB_PUBLIC_SUBNET`) VCN route table to the the public subnet in the hub VCN.

Routing Information: (`VCN_RT_HUB_PUBLIC_SUBNET`) This VCN route table will route traffic that is destined for the spokes to the firewall. Traffic that is destined to the internet (all traffic other than spoke networks) to the internet gateway will also be routed by this route table.

- Go to the OCI Console.

1. Click the hamburger menu (≡) from the upper left corner.
2. Click Networking.
3. Click Virtual cloud networks.

- Click the hub VCN.

1. Click Subnets.
2. Click Public hub Subnet.

1. Notice the public hub subnet has the default VCN table associated. We need to change this.
2. Click Edit.

1. Select the VCN route table created earlier (`VCN_RT_HUB_PUBLIC_SUBNET`).
2. Click Save Changes.

1. Notice that a new VCN route table is active on the hub public subnet.
2. Click Hub VCN to return to the Hub VCN details page.

- The following image illustrates the visual representation of what you have created so far.

Error creating thumbnail: File with dimensions greater than 12.5 MP

Attach VCN Routing Tables to the Hub VCN Private Subnet

Next, we are going to attach the (`VCN_RT_HUB_PRIVATE_SUBNET`) VCN route table to the private subnet in the hub VCN.

Routing Information: (`VCN_RT_HUB_PRIVATE_SUBNET`) This VCN route table will route traffic that is destined for the spokes to the firewall. Traffic that is destined to the internet (all traffic other than spoke networks) to the NAT gateway will also be routed by this route table.

- Go to the hub VCN.

1. Click Private hub Subnet.

1. Notice the private hub subnet has the VCN route table associated already. If you still have the default VCN table associated then change this. To change, click Edit and change this to `VCN_RT_HUB_PRIVATE_SUBNET`.
2. Scroll down.

- The following image illustrates the visual representation of what you have created so far.

Error creating thumbnail: File with dimensions greater than 12.5 MP

Attach VCN Routing Tables to the Hub VCN NAT Gateway

Attach the (`VCN_HUB_RT_NAT_TRANSIT`) VCN route table to the NAT gateway in the hub VCN.

Routing Information: (`VCN_HUB_RT_NAT_TRANSIT`) This VCN route table will route traffic that is destined for the spokes to the firewall.

- Go to the OCI Console.

1. Click NAT Gateways.
2. Notice that the NAT gateway does not have any route table associated.
3. Click the three dots.
4. Click Associate Route Table.

1. Select the VCN route table created earlier (`VCN_HUB_RT_NAT_TRANSIT`).
2. Click Associate Route Table.

- Note that a new VCN route table is active on the hub NAT gateway.

- The following image illustrates the visual representation of what you have created so far.

Error creating thumbnail: File with dimensions greater than 12.5 MP

Attach VCN Routing Tables to the Spoke VCN Private Subnets

We already configured the default spoke VCN routing tables in one of the previous tasks. The spoke (A, B, and C) private subnets will automatically use the default VCN route table and there is no need to change this. We can do a quick check.

Go to the OCI Console, navigate to Networking and Virtual cloud Networks.

- Click spoke VCN A.

- Click spoke A Private Subnet.

1. Note that the Default Route table for Spoke VCN A is used.
2. Click Virtual Cloud Networks to return to the VCN page.

- Click spoke VCN B.

- Click spoke B Private Subnet.

1. Note that the Default Route table for Spoke VCN B is used.
2. Click Virtual Cloud Networks to return to the VCN page.

- Click spoke VCN C.

- Click spoke C Private Subnet.

- Note that the Default Route table for Spoke VCN C is used.