> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Aviatrix Gateway to Oracle Drg

> This document describes how to configure an IPsec tunnel between an Aviatrix Gateway and an Oracle Dynamic Routing Gateway (DRG).

This document describes how to configure an IPsec tunnel between an Aviatrix
Gateway and an Oracle Dynamic Routing Gateway (DRG).

<img src="https://mintcdn.com/aviatrix-14b37c43/Gre8pdluiL7JmlpL/images/guides/connectivity/vpn/gw2drg.png?fit=max&auto=format&n=Gre8pdluiL7JmlpL&q=85&s=e09376d6914f5300e7da1d670a48968c" alt="gw2drg" width="1263" height="340" data-path="images/guides/connectivity/vpn/gw2drg.png" />

## Deployment

For this use case, you will create an IPsec connection from DRG first and then
configure a Site2Cloud connection in Aviatrix CoPilot.

### Creating an IPsec Connection from DRG

<Note>
  **Prerequisites**

  1. You have a DRG created and attached to a VCN.
  2. You have an Aviatrix Gateway provisioned in a VPC/VNet. You will need this
     gateway's public IP address and its VPC/VNet CIDR for the steps below.
</Note>

3. Log in to your Oracle Cloud Console and create a route rule for the DRG.

   You need to modify the desired route table and create a route rule to take
   any traffic destined for the Aviatrix Gateway's VPC/VNet CIDR and route it to
   the DRG.

   1. Under *Core Infrastructure*, go to *Networking* and click *Virtual Cloud
      Networks*.
   2. Click your VCN.
   3. Select the desired route table(s) for your VCN.
   4. Click *Edit Route Rules*.
   5. Create a new route rule as follows and save it.

      | Field                          | Description                                                 |
      | ------------------------------ | ----------------------------------------------------------- |
      | Target Type                    | Dynamic Route Gateway                                       |
      | Destination CIDR Block         | Aviatrix GW's VPC/VNet CIDR (172.19.0.0/16 in this example) |
      | Target Dynamic Routing Gateway | Select the desired existing DRG                             |

      <img src="https://mintcdn.com/aviatrix-14b37c43/Gre8pdluiL7JmlpL/images/guides/connectivity/vpn/vcn-route-table.png?fit=max&auto=format&n=Gre8pdluiL7JmlpL&q=85&s=abbd0b6858dd6b5e884a27be0ee1cc60" alt="vcn_route_table" width="1350" height="574" data-path="images/guides/connectivity/vpn/vcn-route-table.png" />

4. Log in to your Oracle Cloud Console and create security rules. Edit the
   security list associated with your VCN subnets by adding two new rules: one
   ingress rule for traffic coming from the Aviatrix Gateway's VPC/VNet and one
   egress rule for traffic going to the Aviatrix Gateway's VPC/VNet.
   1. Under *Core Infrastructure*, go to *Networking* and click *Virtual Cloud
      Networks*.

   2. Click your VCN.

   3. Select the desired security list(s) associated with your subnets.

   4. Click *Edit All Rules*.

   5. In *Allowed Rule for Ingress* section, enter the following values to
      create a rule to allow incoming traffic from Aviatrix Gateway's VPC/VNet.

      | Field        | Description                                                 |
      | ------------ | ----------------------------------------------------------- |
      | Source Type  | CIDR                                                        |
      | Source CIDR  | Aviatrix GW's VPC/VNet CIDR (172.19.0.0/16 in this example) |
      | IP Protocols | All Protocols                                               |

      <img src="https://mintcdn.com/aviatrix-14b37c43/Gre8pdluiL7JmlpL/images/guides/connectivity/vpn/vcn-security-rule-ingress.png?fit=max&auto=format&n=Gre8pdluiL7JmlpL&q=85&s=77be928d0203f7eb924e3fe9f8b38426" alt="vcn-security-rule-ingress" width="885" height="210" data-path="images/guides/connectivity/vpn/vcn-security-rule-ingress.png" />

   6. In *Allowed Rule for Egress* section, enter the following values to create
      a rule to allow outgoing traffic to the Aviatrix Gateway's VPC/VNet.

      | Field            | Description                                                 |
      | ---------------- | ----------------------------------------------------------- |
      | Destination Type | CIDR                                                        |
      | Destination CIDR | Aviatrix GW's VPC/VNet CIDR (172.19.0.0/16 in this example) |
      | IP Protocols     | All Protocols                                               |

      <img src="https://mintcdn.com/aviatrix-14b37c43/Gre8pdluiL7JmlpL/images/guides/connectivity/vpn/vcn-security-rule-egress.png?fit=max&auto=format&n=Gre8pdluiL7JmlpL&q=85&s=47ff287cf6b25155ff6946d1d656aac0" alt="vcn-security-rule-egress" width="914" height="233" data-path="images/guides/connectivity/vpn/vcn-security-rule-egress.png" />

5. Create a CPE object.

   In this task, you create the CPE object, which is a logical representation of
   the Aviatrix Gateway.

   1. Under *Core Infrastructure*, go to *Networking* and click
      *Customer-Premises Equipment*.
   2. Click *Create Customer-Premises Equipment*.
   3. Enter the following values and click *Create*.

      | Field                 | Description                           |
      | --------------------- | ------------------------------------- |
      | Create in Compartment | Leave as is (the VCN's compartment)   |
      | Name                  | A descriptive name for the CPE object |
      | IP Address            | Public IP address of Aviatrix Gateway |
      | Tags                  | Optional                              |

      <img src="https://mintcdn.com/aviatrix-14b37c43/1zOMu4WXCFpEtXhJ/images/guides/connectivity/vpn/cpe.png?fit=max&auto=format&n=1zOMu4WXCFpEtXhJ&q=85&s=cae3ca5f0a2b43964aedb1d345665c8a" alt="cpe" width="680" height="578" data-path="images/guides/connectivity/vpn/cpe.png" />

6. From the DRG, create an IPsec connection to the CPE object.
   1. Under *Core Infrastructure*, go to *Networking* and click *Dynamic Routing
      Gateways*.

   2. Click the DRG created earlier.

   3. Click *Create IPsec Connection*.

   4. Enter the following values and click *Create IPsec Connection*.

      | Field                                   | Description                                                 |
      | --------------------------------------- | ----------------------------------------------------------- |
      | Create in Compartment                   | Leave as is (the VCN's compartment)                         |
      | Name                                    | A descriptive name for the IPsec connection                 |
      | Customer-Premises Equipment Compartment | Leave as is (the VCN's compartment)                         |
      | Customer-Premises Equipment             | Select the CPE object created earlier                       |
      | Static Route CIDR                       | Aviatrix GW's VPC/VNet CIDR (172.19.0.0/16 in this example) |
      | Tags                                    | Optional                                                    |

      <img src="https://mintcdn.com/aviatrix-14b37c43/Gre8pdluiL7JmlpL/images/guides/connectivity/vpn/ipsec-connection.png?fit=max&auto=format&n=Gre8pdluiL7JmlpL&q=85&s=3052c4ce1ea5902be1d7451457054eb8" alt="ipsec-connection" width="679" height="567" data-path="images/guides/connectivity/vpn/ipsec-connection.png" />

   5. Once the IPsec connection enters the *Available* state, click the *Action*
      icon (three dots), and then click *Tunnel Information*. Copy the *IP
      Address* of the VPN headend and the *Shared Secret* for configuring an
      external (S2C) connection in Aviatrix CoPilot.

      <img src="https://mintcdn.com/aviatrix-14b37c43/Gre8pdluiL7JmlpL/images/guides/connectivity/vpn/ipsec-info.png?fit=max&auto=format&n=Gre8pdluiL7JmlpL&q=85&s=4bc95a3ecb3d86fcb40894316f0823dd" alt="ipsec-info" width="678" height="467" data-path="images/guides/connectivity/vpn/ipsec-info.png" />

7. Log into Aviatrix CoPilot.

8. Create a
   [Transit Gateway](https://legacy.docs.aviatrix.com/documentation/latest/network/transit-gateway-about.html?expand=true).

<a id="adding-ha" />

If you want to add HA to the Transit Gateway, you must
[do it when you initially create the Transit Gateway](https://legacy.docs.aviatrix.com/documentation/latest/network/transit-gateway-about.html?expand=true#ha-transit-gateway).
You must also
[follow the steps here](#creating-a-second-ipsec-connection-between-the-same-drg-and-aviatrix-ha-gateway-optional)
to add a new IPsec connection in Oracle.

7. Follow the steps in <a href={"/docs/enterprise/" + "10.1" +
   "/guides/connectivity/vpn/s2c-configuration-workflow"}>Site2Cloud
   Configuration Workflow</a>.

8. Use one of these tables for specific field values (Unmapped):
   * [Static Policy-Based (Unmapped) External Connection Using Terraform](https://legacy.docs.aviatrix.com/documentation/latest/network/external-connection-create-static-policy-based-unmapped.html)
   * [Static Route-Based External Connection (Unmapped)](https://legacy.docs.aviatrix.com/documentation/latest/network/external-connection-create-static-route-based-unmapped.html)

9. Replace the following values as noted:
   * Remote Device Type: Oracle
   * Remote Subnet CIDR(s): Oracle VCN CIDR (10.1.1.0/24 in this example).
   * Remote Device IP: IP address copied from the Oracle IPsec connection.
   * Pre-Shared Key: Shared Secret copied from the Oracle IPsec connection.

## Test

Once complete, test the communication using the tunnel by sending traffic
between instances in the Aviatrix Gateway's VPC/VNet and Oracle VCN.

1. In CoPilot, go to Diagnostics > Cloud Routes > External Connections.
2. Verify that the external (S2C) connection Tunnel Status is Up.

## Troubleshoot

Wait 2-3 minutes for the tunnel to come up. If it does not come up within that
time, check the IP addresses to confirm they are accurate. Additional
troubleshooting is available from Diagnostics > Diagnostic Tools.

<a id="create-second-ipsec-connection" />

## Creating a Second IPsec Connection Between the Same DRG and Aviatrix HA Gateway (Optional)

From the Oracle Cloud console, create a second IPsec connection between the same
DRG and the Aviatrix HA Gateway created [here](#deployment).

1. Create a new CPE at Oracle Cloud Console for the Aviatrix HA Gateway:

   | Field                 | Description                                  |
   | --------------------- | -------------------------------------------- |
   | Create in Compartment | Leave as is (the VCN's compartment)          |
   | Name                  | A descriptive name for the second CPE object |
   | IP Address            | Public IP address of Aviatrix HA Gateway     |
   | Tags                  | Optional                                     |

2. Create a new IPsec connection at Oracle Cloud Console for the Aviatrix HA
   Gateway:

   | Field                                   | Description                                                 |
   | --------------------------------------- | ----------------------------------------------------------- |
   | Create in Compartment                   | Leave as is (the VCN's compartment)                         |
   | Name                                    | A descriptive name for the second IPsec connection          |
   | Customer-Premises Equipment Compartment | Leave as is (the VCN's compartment)                         |
   | Customer-Premises Equipment             | Select the second CPE object created earlier                |
   | Static Route CIDR                       | Aviatrix GW's VPC/VNet CIDR (172.19.0.0/16 in this example) |
   | Tags                                    | Optional                                                    |

3. Once the second IPsec connection enters the *Available* state, click the
   *Action* icon (three dots), and then click *Tunnel Information*. Please copy
   the *IP Address* of the VPN headend and the *Shared Secret*.

## Related Topics

* [About External Connection Settings](https://legacy.docs.aviatrix.com/documentation/latest/network/externaldevice-settings.html)