3.1 Virtual Cloud Network (VCN) Architecture & Subnets

3.1 Virtual Cloud Network (VCN) Architecture & Subnets

[!NOTE] Exam Blueprint Scope: In the OCI Foundations Associate (1Z0-1085-26) curriculum, core networking represents one of the most heavily tested areas within Domain 2 (Core OCI Services). Candidates must demonstrate an exact understanding of Virtual Cloud Network (VCN) boundaries, CIDR block sizing, regional versus Availability Domain-specific subnets, public versus private subnet isolation, and Virtual Network Interface Card (VNIC) IP assignment.

Every cloud workload deployed in Oracle Cloud Infrastructure (OCI)—from autonomous databases and bare metal compute clusters to containerized microservices and serverless functions—relies on a secure, robust software-defined networking fabric. In OCI, that foundational network layer is the Virtual Cloud Network (VCN).

---

Fundamentals of the Virtual Cloud Network (VCN)

A Virtual Cloud Network (VCN) is a customizable, software-defined private network that an organization configures in an OCI region. A VCN closely resembles a traditional on-premises datacenter network, complete with subnets, route tables, security lists, and network gateways, but it benefits from the high scalability, elasticity, and multi-tenant isolation of Oracle's physical cloud infrastructure.

Core Characteristics of a VCN

• Regional Scope: A VCN resides in a single, specific OCI region (such as us-ashburn-1 or eu-frankfurt-1). It cannot span across multiple regions. However, within that assigned region, the VCN naturally spans all Availability Domains (ADs) and Fault Domains (FDs).
• Classless Inter-Domain Routing (CIDR) Prefix Sizes: An OCI VCN is defined by one or more IPv4 CIDR blocks. The allowed prefix length ranges strictly from /16 to /30:
  • A /16 network provides the maximum supported size for a single block, yielding 65,536 contiguous IPv4 addresses (e.g., 10.0.0.0/16).
  • A /30 network provides the minimum supported size, yielding 4 IPv4 addresses (e.g., 192.168.1.0/30).
  • Prefix lengths broader than /16 (such as /8) or narrower than /30 (such as /31 or /32) are not permitted when defining VCN CIDR blocks.
• Multiple CIDR Blocks: Modern OCI VCNs are not limited to a single address space. An administrator can assign up to 5 IPv4 CIDR blocks per VCN. These blocks can be contiguous or completely non-contiguous (for instance, combining 10.0.0.0/16 and 172.16.0.0/20 in the same VCN). Furthermore, CIDR blocks can be added, expanded, or removed dynamically after VCN creation without causing downtime.
• Private Addressing (RFC 1918): Oracle recommends choosing IP address spaces from standard RFC 1918 private address ranges:
  • 10.0.0.0/8 (e.g., 10.0.0.0/16 to 10.255.0.0/16)
  • 172.16.0.0/12 (e.g., 172.16.0.0/16 to 172.31.0.0/16)
  • 192.168.0.0/16 (e.g., 192.168.0.0/24 to 192.168.255.0/24)
• Overlapping Address Space Warning: Although OCI permits arbitrary RFC 1918 CIDR blocks, you must ensure that your VCN CIDR does not overlap with your on-premises datacenter networks or with other peered VCNs. Overlapping CIDRs prevent network peering and hybrid cloud routing.
• IPv6 Capabilities: OCI supports dual-stack networking. When IPv6 is enabled, Oracle allocates a fixed /56 global unicast address prefix to the VCN, from which administrators assign /64 prefixes to individual subnets.

---

Subnets: Logical Segmentation of the VCN

A Subnet is a contiguous subdivision of a VCN's CIDR block (for example, 10.0.1.0/24 carved out of a 10.0.0.0/16 VCN). Compute instances, load balancers, database systems, and file storage mount targets are never placed directly into a raw VCN; they are always attached to a specific subnet within that VCN.

Subnet Rules and Reserved Addresses

1. No Overlap: Subnets within the same VCN cannot have overlapping CIDR ranges.
2. Oracle Reserved IP Addresses: In every subnet, regardless of its size, Oracle automatically reserves three IP addresses for internal infrastructure operation:
   • The First IP Address (.0): The Network identifier address (e.g., 10.0.1.0 in a /24).
   • The Second IP Address (.1): The Subnet Default Gateway address (e.g., 10.0.1.1 in a /24), used by instances to route traffic off the local subnet.
   • The Last IP Address (.255 in a /24): The Subnet Broadcast address (e.g., 10.0.1.255). Although broadcast traffic is not forwarded across OCI's virtual network fabric, this address remains strictly reserved and unassignable.
   • Formula for Usable IPs: In an IPv4 subnet of prefix length $n$, the total number of usable host IP addresses is $2^{(32 - n)} - 3$.

---

Regional Subnets vs. Availability Domain (AD)-Specific Subnets

When creating a subnet in OCI, you must choose its geographic scope within the region:

+--------------------------------------------------------------------------------+
|                       OCI Regional Subnet Architecture                         |
|                                                                                |
|  +--------------------------------------------------------------------------+  |
|  | OCI Region (e.g., us-ashburn-1)                                          |  |
|  |                                                                          |  |
|  |   Regional Subnet: 10.0.1.0/24 (Spans all Availability Domains)          |  |
|  |   +-------------------+  +-------------------+  +-------------------+   |  |
|  |   |    AD 1           |  |    AD 2           |  |    AD 3           |  |  |
|  |   |  Compute VM-1     |  |  Compute VM-2     |  |  Compute VM-3     |  |  |
|  |   |  (10.0.1.15)      |  |  (10.0.1.26)      |  |  (10.0.1.42)      |  |  |
|  |   +-------------------+  +-------------------+  +-------------------+   |  |
|  +--------------------------------------------------------------------------+  |
+--------------------------------------------------------------------------------+

1. Regional Subnets (Modern OCI Best Practice)

• A Regional Subnet spans every Availability Domain in the entire region.
• Instances provisioned in AD 1, AD 2, or AD 3 can all reside within the exact same regional subnet and share identical routing and security policies.
• Architectural Advantage: Regional subnets simplify high availability (HA) and disaster recovery configurations. If an instance in AD 1 fails, a replacement instance or secondary node can be spun up in AD 2 inside the same subnet without changing route tables, security lists, or subnet network configurations.
• Oracle Recommendation: Always choose Regional Subnets when designing new OCI environments.

2. Availability Domain-Specific Subnets (Legacy)

• An AD-Specific Subnet is confined strictly to a single Availability Domain.
• Resources in AD 2 cannot attach to an AD-specific subnet that was created in AD 1.
• In the earliest releases of OCI, all subnets were AD-specific. While still supported for backward compatibility and specialized legacy clustering designs, AD-specific subnets introduce substantial administrative overhead because separate subnets, route tables, and security lists must be duplicated across each AD.

---

Public Subnets vs. Private Subnets

Every subnet in OCI is explicitly designated as either Public or Private at creation time:

1. Public Subnets

• In a Public Subnet, resources (specifically their Virtual Network Interface Cards, or VNICs) can be assigned public IP addresses.
• When coupled with an attached Internet Gateway (IGW) and an appropriate default route (0.0.0.0/0 -> IGW), instances in a public subnet can both initiate outbound connections to the internet and receive unsolicited incoming traffic from the internet (subject to firewall rules).
• Typical Workloads: Public-facing web servers, external API gateways, DMZ bastion jump hosts, and internet-facing public load balancers.

2. Private Subnets

• In a Private Subnet, resources are strictly prohibited from receiving public IP addresses.
• Instances attached to a private subnet have only private IP addresses (drawn from the subnet's RFC 1918 CIDR range). It is physically impossible for an external internet user to initiate a direct inbound connection to a private subnet instance.
• If an instance in a private subnet requires outbound internet access (for example, to download operating system security patches or software updates), it must route through a NAT Gateway.
• If it requires access to Oracle platform services (like OCI Object Storage), it routes through a Service Gateway.
• Typical Workloads: Production databases (Oracle Autonomous Database, MySQL Database Service), backend enterprise application servers, internal microservices, and private load balancers.

---

Virtual Network Interface Cards (VNICs) & IP Allocation

Compute instances do not connect to a subnet through a physical cable; they connect via software-defined Virtual Network Interface Cards (VNICs).

Primary VNIC vs. Secondary VNICs

• Primary VNIC: Created automatically when a compute instance is launched. It resides in the subnet specified during creation and cannot be detached from the instance. Its lifecycle is bound directly to the compute instance.
• Secondary VNICs: Can be created and attached to an existing compute instance dynamically after launch. Secondary VNICs can reside in the same subnet as the primary VNIC or in an entirely different subnet (even in a different VCN, provided both VCNs reside in the same availability domain). Secondary VNICs can be detached and deleted at will.

IP Address Types in OCI

Every VNIC must have at least one private IP address and may optionally have a public IP address (if in a public subnet):

1. Private IP Address:
   • Assigned from the subnet's CIDR block.
   • Used for routing traffic within the VCN, across peered VCNs, and across hybrid connections (VPN/FastConnect).
   • Mandatory for all VNICs. Can be dynamically assigned by OCI DHCP or statically assigned during VNIC creation.
   • VNICs can also have Secondary Private IPs for virtual hosting or IP-failover clustering.
2. Ephemeral Public IP Address:
   • A temporary, dynamic public IPv4 address assigned to a VNIC in a public subnet.
   • Exists only for the lifetime of the instance. If the instance is stopped or terminated, the ephemeral public IP is released back into Oracle's public address pool.
   • Ideal for non-persistent development or temporary test instances.
3. Reserved Public IP Address:
   • A persistent public IPv4 address allocated from Oracle's regional public IP inventory or from a customer's Bring Your Own IP (BYOIP) range.
   • Exists independently of any instance. It persists across instance restarts, stops, and terminations.
   • Can be unassigned from one VNIC and reassigned to another VNIC in the same region, facilitating zero-downtime maintenance and failover.

---

Default VCN Components Created Upon Setup

When a VCN is created in the OCI Console using the "Create VCN with Internet Connectivity" quick-start wizard, OCI automatically provisions and configures several default networking components:

1. Default Route Table: Contains pre-configured routing rules (e.g., directing outbound internet traffic 0.0.0.0/0 to the generated Internet Gateway).
2. Default Security List: Contains baseline ingress rules permitting inbound SSH (port 22 for Linux) and RDP (port 3389 for Windows), along with essential ICMP path-MTU error messages, and an egress rule permitting all outbound traffic (0.0.0.0/0).
3. Default DHCP Options: Configures DNS resolution for instances. By default, it sets the DNS type to the Internet and VCN Resolver, which automatically resolves both private hostnames within the VCN (instance.subnet.vcn.oraclevcn.com) and external internet domain names.

[!TIP] Exam Trap Alert: If you create a VCN using the manual "Create VCN Only" option instead of the wizard, OCI creates the Default Route Table, Default Security List, and Default DHCP Options, but the Default Route Table contains zero route rules, and no gateways are created. You must manually provision the gateways and add the appropriate route rules to enable internet or hybrid traffic.