The Dynamic Routing Gateway is the OCI network hub for connecting multiple VCNs and on-premises environments. For organizations with VCNs for production, development, and shared services, a hub-and-spoke DRG topology centralizes routing, forces all inter-spoke traffic through the hub for security inspection, and lets you add new spokes without reconfiguring existing ones. This post covers designing the full topology with Terraform.

Step 1: DRG and VCN Attachments

resource "oci_core_drg" "hub_drg" {
  compartment_id = var.compartment_id
  display_name   = "hub-drg"
  defined_tags   = { "Operations.ManagedBy" = "terraform" }
}

resource "oci_core_drg_attachment" "hub_vcn" {
  drg_id             = oci_core_drg.hub_drg.id
  display_name       = "hub-vcn-attachment"
  vcn_id             = var.hub_vcn_id
  drg_route_table_id = oci_core_drg_route_table.hub_imports_all.id
}

resource "oci_core_drg_attachment" "prod_spoke" {
  drg_id             = oci_core_drg.hub_drg.id
  display_name       = "prod-spoke-attachment"
  vcn_id             = var.prod_vcn_id
  drg_route_table_id = oci_core_drg_route_table.spoke_hub_only.id
}

resource "oci_core_drg_attachment" "dev_spoke" {
  drg_id             = oci_core_drg.hub_drg.id
  display_name       = "dev-spoke-attachment"
  vcn_id             = var.dev_vcn_id
  drg_route_table_id = oci_core_drg_route_table.spoke_hub_only.id
}

output "drg_id" { value = oci_core_drg.hub_drg.id }

Step 2: DRG Route Tables and Import Distributions

resource "oci_core_drg_route_distribution" "import_all" {
  drg_id            = oci_core_drg.hub_drg.id
  display_name      = "import-all-attachments"
  distribution_type = "IMPORT"

  statements {
    action   = "ACCEPT"
    priority = 1
    match_criteria { match_type = "DRG_ATTACHMENT_TYPE"; attachment_type = "VCN" }
  }

  statements {
    action   = "ACCEPT"
    priority = 2
    match_criteria { match_type = "DRG_ATTACHMENT_TYPE"; attachment_type = "VIRTUAL_CIRCUIT" }
  }
}

resource "oci_core_drg_route_distribution" "import_hub_only" {
  drg_id            = oci_core_drg.hub_drg.id
  display_name      = "import-hub-vcn-only"
  distribution_type = "IMPORT"

  statements {
    action   = "ACCEPT"
    priority = 1
    match_criteria {
      match_type        = "DRG_ATTACHMENT_ID"
      drg_attachment_id = oci_core_drg_attachment.hub_vcn.id
    }
  }
}

resource "oci_core_drg_route_table" "hub_imports_all" {
  drg_id                            = oci_core_drg.hub_drg.id
  display_name                      = "hub-vcn-route-table"
  import_drg_route_distribution_id  = oci_core_drg_route_distribution.import_all.id
}

resource "oci_core_drg_route_table" "spoke_hub_only" {
  drg_id                            = oci_core_drg.hub_drg.id
  display_name                      = "spoke-to-hub-only"
  import_drg_route_distribution_id  = oci_core_drg_route_distribution.import_hub_only.id
}

Step 3: Spoke VCN Route Table

resource "oci_core_route_table" "prod_spoke_default" {
  compartment_id = var.compartment_id
  vcn_id         = var.prod_vcn_id
  display_name   = "prod-spoke-default-rt"

  route_rules {
    destination       = "10.0.0.0/8"
    destination_type  = "CIDR_BLOCK"
    network_entity_id = oci_core_drg.hub_drg.id
    description       = "All private RFC1918 traffic to hub DRG"
  }

  route_rules {
    destination       = "0.0.0.0/0"
    destination_type  = "CIDR_BLOCK"
    network_entity_id = oci_core_drg.hub_drg.id
    description       = "Internet traffic transits hub for NAT and inspection"
  }
}

Operational Notes

The import route distribution on a spoke’s DRG route table controls which attachments that spoke can reach. Setting spokes to import only from the hub VCN means a packet from production destined for development must transit the hub. The hub can apply security controls (OCI Network Firewall, WAF inspection, VCN route manipulation) to that traffic. Spokes with no direct route to each other cannot communicate directly regardless of any NSG or security list rules.

Adding a new spoke requires one DRG attachment, one route table assignment using the existing spoke-to-hub distribution, and route table updates in the new spoke VCN only. No changes are needed to the hub, existing spokes, or any on-premises configuration. This is the operational scalability advantage of hub-and-spoke over full-mesh VCN local peering, which requires changes to every existing VCN for each new VCN added.

Regards,
Osama

#OCI #OracleCloud #VCN #Networking #DRG #Terraform #IaC #TechBlog #Oracle #PlatformEngineering #HubSpoke #TransitRouting #OracleCloudInfrastructure #NetworkDesign #ZeroTrust #FastConnect #CloudArchitecture #CloudNetworking #RoutingTable #NetworkSecurity