You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/oracle/oracle-db/oracle-database-network-plan.md
+75-38Lines changed: 75 additions & 38 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,59 +8,96 @@ ms.service: oracle-on-azure
8
8
ms.custom: engagement-fy23
9
9
ms.date: 12/12/2023
10
10
---
11
-
12
11
# Network planning for Oracle Database@Azure
13
-
14
12
In this article, learn about network topologies and constraints in Oracle Database@Azure.
15
-
16
13
After you purchase an offer through Azure Marketplace and provision the Oracle Exadata infrastructure, the next step is to create your virtual machine cluster to host your instance of Oracle Exadata Database@Azure. The Oracle database clusters are connected to your Azure virtual network via a virtual network interface card (virtual NIC) from your delegated subnet (delegated to `Oracle.Database/networkAttachment`).
14
+
## Network features
15
+
There are two types of network features: default and advance.
17
16
17
+
### Default network features
18
+
Default network features enable basic network connectivity for both new and existing Oracle Database@Azure deployments. These features are available across all supported Oracle Database@Azure regions and provide the foundational networking required for your deployment
19
+
### Advanced network features
20
+
Advanced network features enhance the virtual networking experience, offering improved security, performance, and control—similar to standard Azure VMs. These features are currently in public preview and available in the following regions:
21
+
* Australia East
22
+
* Central US
23
+
* East US
24
+
* East US2
25
+
* US West
26
+
* UK South
27
+
* UK West
28
+
>[!NOTE]
29
+
>Advanced network features are currently supported only for new Oracle Database@Azure deployments.
30
+
> Existing virtual networks with previously created Oracle Database@Azure delegated subnets will not support these features at this time. Support for existing deployments is planned for later this year.
31
+
>Registration Required:
32
+
> To use advanced network features, you must first register using the commands below before creating your virtual network for the Oracle Database@Azure deployment.
The following table describes the network topologies that are supported by each configuration of network features for Oracle Database@Azure:
21
-
22
-
|Topology |Supported |
23
-
| :------------------- |:---------------:|
24
-
|Connectivity to an Oracle database cluster in a local virtual network| Yes |
25
-
|Connectivity to an Oracle database cluster in a peered virtual network (in the same region)|Yes |
26
-
|Connectivity to an Oracle database cluster in a spoke virtual network in a different region with a virtual wide area network (virtual WAN) |Yes |
27
-
|Connectivity to an Oracle database cluster in a peered virtual network (cross-region or global peering) without a virtual WAN\*| No|
28
-
|On-premises connectivity to an Oracle database cluster via global and local Azure ExpressRoute |Yes|
29
-
|Azure ExpressRoute FastPath |No |
30
-
|Connectivity from on-premises to an Oracle database cluster in a spoke virtual network over an ExpressRoute gateway and virtual network peering with a gateway transit|Yes |
31
-
|On-premises connectivity to a delegated subnet via a virtual private network (VPN) gateway | Yes |
32
-
|Connectivity from on-premises to an Oracle database in a spoke virtual network over a VPN gateway and virtual network peering with gateway transit| Yes |
33
-
|Connectivity over active/passive VPN gateways| Yes |
34
-
|Connectivity over active/active VPN gateways| No |
35
-
|Connectivity over active/active zone-redundant gateways| Yes |
36
-
|Transit connectivity via a virtual WAN for an Oracle database cluster provisioned in a spoke virtual network| Yes |
37
-
|On-premises connectivity to an Oracle database cluster via a virtual WAN and attached software-defined wide area network (SD-WAN)|No|
38
-
|On-premises connectivity via a secured hub (a firewall network virtual appliance) |Yes|
39
-
|Connectivity from an Oracle database cluster on Oracle Database@Azure nodes to Azure resources|Yes|
40
-
42
+
|Topology |Default Network Features | Advanced Network Features |
|Connectivity to an Oracle database cluster in a local virtual network| Yes | Yes |
45
+
|Connectivity to an Oracle database cluster in a peered virtual network (in the same region)|Yes |Yes |
46
+
|Connectivity to an Oracle database cluster in a spoke virtual network in a different region with a virtual wide area network (virtual WAN) |Yes | Yes |
47
+
|Connectivity to an Oracle database cluster in a peered virtual network in different region (Global Peering) | No| Yes |
48
+
|On-premises connectivity to an Oracle database cluster via global and local Azure ExpressRoute |Yes| Yes|
49
+
|Azure ExpressRoute FastPath |No | Yes|
50
+
|Connectivity from on-premises to an Oracle database cluster in a spoke virtual network over an ExpressRoute gateway and virtual network peering with a gateway transit|Yes | Yes|
51
+
|On-premises connectivity to a delegated subnet via a virtual private network (VPN) gateway | Yes | Yes|
52
+
|Connectivity from on-premises to an Oracle database in a spoke virtual network over a VPN gateway and virtual network peering with gateway transit| Yes | Yes|
53
+
|Connectivity over active/passive VPN gateways| Yes |Yes|
54
+
|Connectivity over active/active VPN gateways| No | Yes|
55
+
|Connectivity over zone-redundant, zonal ExpressRoute gateways | Yes | Yes|
56
+
|Transit connectivity via a virtual WAN for an Oracle database cluster provisioned in a spoke virtual network| Yes |Yes|
57
+
|On-premises connectivity to an Oracle database cluster via a virtual WAN and attached software-defined wide area network (SD-WAN)|No|Yes|
58
+
|On-premises connectivity via a secured hub (a firewall network virtual appliance) |Yes|Yes|
59
+
|Connectivity from an Oracle database cluster on Oracle Database@Azure nodes to Azure resources|Yes|Yes|
41
60
\* You can overcome this limitation by using a site-to-site VPN.
42
-
43
61
## Constraints
44
-
45
62
The following table describes required configurations of supported network features:
63
+
|Features |Default network features | Advanced Network Features |
|[Network security groups](../../virtual-network/network-security-groups-overview.md) on Oracle Database@Azure delegated subnets|No| Yes |
67
+
|[User-defined routes (UDRs)](../../virtual-network/virtual-networks-udr-overview.md#user-defined) on Oracle Database@Azure delegated subnets|Yes| Yes|
68
+
|Connectivity from an Oracle database cluster to a [private endpoint](../../private-link/private-endpoint-overview.md) in the same virtual network on Azure-delegated subnets|No| Yes|
69
+
|Connectivity from an Oracle database cluster to a [private endpoint](../../private-link/private-endpoint-overview.md) in a different spoke virtual network connected to a virtual WAN|Yes| Yes|
70
+
|NSG support on the Private link | No| Yes|
71
+
| Connectivity to serverless Apps like azure functions via private endpoints | No| Yes|
72
+
|Support for DNS Private resolver | No | Yes|
73
+
|Load balancers for Oracle database cluster traffic|No| Yes|
74
+
|Dual stack (IPv4 and IPv6) virtual network|Only IPv4 is supported| Only IPv4 is supported|
46
75
47
-
|Features |Basic network features |
48
-
| :------------------- | -------------------: |
49
-
|Delegated subnet per virtual network |1|
50
-
|[Network security groups](../../virtual-network/network-security-groups-overview.md) on Oracle Database@Azure delegated subnets|No|
51
-
|[User-defined routes (UDRs)](../../virtual-network/virtual-networks-udr-overview.md#user-defined) on Oracle Database@Azure delegated subnets|Yes|
52
-
|Connectivity from an Oracle database cluster to a [private endpoint](../../private-link/private-endpoint-overview.md) in the same virtual network on Azure-delegated subnets|No|
53
-
|Connectivity from an Oracle database cluster to a [private endpoint](../../private-link/private-endpoint-overview.md) in a different spoke virtual network connected to a virtual WAN|Yes|
54
-
|Load balancers for Oracle database cluster traffic|No|
55
-
|Dual stack (IPv4 and IPv6) virtual network|Only IPv4 is supported|
76
+
> [!NOTE]
77
+
> When using NSGs (Network Security Groups) on the Azure side, please ensure that any security rules configured on the Oracle (OCI) side are reviewed to avoid conflicts. While applying security policies on > both Azure and OCI can enhance the overall security posture, it also introduces additional complexity in terms of management and requires careful manual synchronization between the two environments. > Misalignment between these policies could lead to unintended access issues or operational disruptions.
56
78
57
79
> [!NOTE]
58
-
> If you want to configure a route table (UDR route) to control the routing of packets through a network virtual appliance or firewall destined to an Oracle Database@Azure instance from a source in the same VNet or a peered VNet, the UDR prefix must be more specific or equal to the delegated subnet size of the Oracle Database@Azure instance. If the UDR prefix is less specific than the delegated subnet size, it isn't effective.
80
+
> For Traffic Destined to Oracle Database@Azure
81
+
>When routing traffic through a Network Virtual Appliance (NVA) or firewall to Oracle Database@Azure, the UDR prefix must be at least as specific as the delegated subnet of the instance.
59
82
>
60
-
> For example, if your delegated subnet is `x.x.x.x/24`, you must configure your UDR to `x.x.x.x/24` (equal) or `x.x.x.x/32` (more specific). If you configure the UDR route to be `x.x.x.x/16`, undefined behaviors such as asymmetric routing can cause a network drop at the firewall.
83
+
> If the delegated subnet for your instance is x.x.x.x/27, configure the UDR on the Gateway Subnet as:
84
+
> x.x.x.x/27 (same as the subnet) ✅
85
+
> x.x.x.x/32 (more specific) ✅
86
+
> x.x.x.x/24 (too broad) ❌
87
+
88
+
89
+
## FAQ:
90
+
### What are advanced network features?
91
+
Advanced network features enhance your virtual networking experience by providing better security, performance, and control—similar to standard Azure virtual machines. With this feature, customers can use native VNet integrations like Network Security Groups (NSG), User-Defined Routes (UDR), Private Link, Global VNet Peering, and ExpressRoute FastPath without needing any workarounds.
92
+
### Will advanced network features work for existing deployments?
93
+
Not at the moment. Support for existing deployments is on our roadmap, and we’re actively working to enable it. Stay tuned for updates in the near future.
94
+
### Do I need to self-register to enable advanced network features for new deployments?
95
+
Yes. To take advantage of advanced network features for new deployments, you must complete a registration process. Please run the registration commands before creating a new VNet and delegated subnet for your Oracle Database@Azure deployments.
96
+
### How can I check if my deployment supports advanced network features?
97
+
Currently, there’s no direct way to verify whether a VNet supports advanced network features. We recommend tracking your feature registration timeline and associating it with the VNets created afterward. You can also use the Activity Log blade under the VNet to review creation details—but note, logs are only available for the past 90 days by default.
61
98
62
-
## Related content
63
99
100
+
## Related content
64
101
* [Overview of Oracle Database@Azure](database-overview.md)
0 commit comments