Aviatrix Gateway to Oracle Drg

​

Deployment

​

Creating an IPsec Connection from DRG

1. Log in to your Oracle Cloud Console and create a route rule for the DRG. You need to modify the desired route table and create a route rule to take any traffic destined for the Aviatrix Gateway’s VPC/VNet CIDR and route it to the DRG.
   1. Under Core Infrastructure, go to Networking and click Virtual Cloud Networks.
   2. Click your VCN.
   3. Select the desired route table(s) for your VCN.
   4. Click Edit Route Rules.
   5. Create a new route rule as follows and save it.

      Field	Description
      Target Type	Dynamic Route Gateway
      Destination CIDR Block	Aviatrix GW’s VPC/VNet CIDR (172.19.0.0/16 in this example)
      Target Dynamic Routing Gateway	Select the desired existing DRG

      
2. Log in to your Oracle Cloud Console and create security rules. Edit the security list associated with your VCN subnets by adding two new rules: one ingress rule for traffic coming from the Aviatrix Gateway’s VPC/VNet and one egress rule for traffic going to the Aviatrix Gateway’s VPC/VNet.
   1. Under Core Infrastructure, go to Networking and click Virtual Cloud Networks.
   2. Click your VCN.
   3. Select the desired security list(s) associated with your subnets.
   4. Click Edit All Rules.
   5. In Allowed Rule for Ingress section, enter the following values to create a rule to allow incoming traffic from Aviatrix Gateway’s VPC/VNet.

      Field	Description
      Source Type	CIDR
      Source CIDR	Aviatrix GW’s VPC/VNet CIDR (172.19.0.0/16 in this example)
      IP Protocols	All Protocols

      
   6. In Allowed Rule for Egress section, enter the following values to create a rule to allow outgoing traffic to the Aviatrix Gateway’s VPC/VNet.

      Field	Description
      Destination Type	CIDR
      Destination CIDR	Aviatrix GW’s VPC/VNet CIDR (172.19.0.0/16 in this example)
      IP Protocols	All Protocols

      
3. Create a CPE object. In this task, you create the CPE object, which is a logical representation of the Aviatrix Gateway.
   1. Under Core Infrastructure, go to Networking and click Customer-Premises Equipment.
   2. Click Create Customer-Premises Equipment.
   3. Enter the following values and click Create.

      Field	Description
      Create in Compartment	Leave as is (the VCN’s compartment)
      Name	A descriptive name for the CPE object
      IP Address	Public IP address of Aviatrix Gateway
      Tags	Optional

      
4. From the DRG, create an IPsec connection to the CPE object.
   1. Under Core Infrastructure, go to Networking and click Dynamic Routing Gateways.
   2. Click the DRG created earlier.
   3. Click Create IPsec Connection.
   4. Enter the following values and click Create IPsec Connection.

      Field	Description
      Create in Compartment	Leave as is (the VCN’s compartment)
      Name	A descriptive name for the IPsec connection
      Customer-Premises Equipment Compartment	Leave as is (the VCN’s compartment)
      Customer-Premises Equipment	Select the CPE object created earlier
      Static Route CIDR	Aviatrix GW’s VPC/VNet CIDR (172.19.0.0/16 in this example)
      Tags	Optional

      
   5. Once the IPsec connection enters the Available state, click the Action icon (three dots), and then click Tunnel Information. Copy the IP Address of the VPN headend and the Shared Secret for configuring an external (S2C) connection in Aviatrix CoPilot.
5. Log into Aviatrix CoPilot.
6. Create a Transit Gateway.

7. Follow the steps in Site2Cloud Configuration Workflow.
8. Use one of these tables for specific field values (Unmapped):
   • Static Policy-Based (Unmapped) External Connection Using Terraform
   • Static Route-Based External Connection (Unmapped)
9. Replace the following values as noted:
   • Remote Device Type: Oracle
   • Remote Subnet CIDR(s): Oracle VCN CIDR (10.1.1.0/24 in this example).
   • Remote Device IP: IP address copied from the Oracle IPsec connection.
   • Pre-Shared Key: Shared Secret copied from the Oracle IPsec connection.

​

Test

1. In CoPilot, go to Diagnostics > Cloud Routes > External Connections.
2. Verify that the external (S2C) connection Tunnel Status is Up.

​

Troubleshoot

​

Creating a Second IPsec Connection Between the Same DRG and Aviatrix HA Gateway (Optional)

1. Create a new CPE at Oracle Cloud Console for the Aviatrix HA Gateway:

   Field	Description
   Create in Compartment	Leave as is (the VCN’s compartment)
   Name	A descriptive name for the second CPE object
   IP Address	Public IP address of Aviatrix HA Gateway
   Tags	Optional

2. Create a new IPsec connection at Oracle Cloud Console for the Aviatrix HA Gateway:

   Field	Description
   Create in Compartment	Leave as is (the VCN’s compartment)
   Name	A descriptive name for the second IPsec connection
   Customer-Premises Equipment Compartment	Leave as is (the VCN’s compartment)
   Customer-Premises Equipment	Select the second CPE object created earlier
   Static Route CIDR	Aviatrix GW’s VPC/VNet CIDR (172.19.0.0/16 in this example)
   Tags	Optional

3. Once the second IPsec connection enters the Available state, click the Action icon (three dots), and then click Tunnel Information. Please copy the IP Address of the VPN headend and the Shared Secret.

​

Related Topics

• About External Connection Settings