|
| 1 | +--- |
| 2 | +pcx_content_type: integration-guide |
| 3 | +title: Oracle Cloud |
| 4 | +--- |
| 5 | + |
| 6 | +This tutorial provides information and examples of how to configure IPsec between Cloudflare Magic WAN and an Oracle Cloud Site-to-site VPN. |
| 7 | + |
| 8 | +## Prerequisites |
| 9 | + |
| 10 | +You need a pre-shared key to establish the IPsec tunnel. You can use Workers to create a random key. Refer to [this example](https://workers.cloudflare.com/playground#LYVwNgLglgDghgJwgegGYHsHALQBM4RwDcABAEbogB2+CAngLzbPYDqApmQNJQQBimYACFKNRHSoBzAB4ArAEoBBANYR5AEVYAJAOJCAagA0AXCxYduvAVhHVaEmQpVrNug4YCwAKADC6KhDsAdjqUADOMOhhvFD+xiQYWHgExCRUcMDsDABEUDTs0gB0smHZpKhQYEEZWbn5RSXZ3n4BQRDYACp0MOzxcDAwYFAAxgSxVMiycABucGHDCLAQANTA6Ljg7N7eBZFIJLjsqHDgECQA3l4AkHMSwwnsEMMAFgAUAJQXXtdXw-5hZzgJAYaXYAHcSABVPIQAAcigQCDgdFeABZYe8iD8Ft0IOhCpJHvI4DR0MB9HAwCB2GFXnBMT8qmcyHN2AA2VEAZQgiykwPIeLgr25vMkhVQCDJPmeiD8h0K-UGKKo4DAABoSPSGT8WWF2VyeXlJPzdfqRUbCgh2IM4MN2K9kAAdZbISQagDk7vePyuvr9JADlutYFt9qdyFdHq9Pr9voDJCDNrtDoYkZInu1vr+VABCTylPNfJBpo5hbFYRAZABoteAAYNQBmABMmauVogIAQVFBEPkNMiOftFXSYDLGsufue7DghwQYXiE792WzgWCEG67Gy8WygWkKGeEGAYGyap9AF9T76zwyrhevGesd4zMwLDx+IJbGJ6FI5EpVBptD0Ixmn8Vd2lCCIohiOIEkEZJCFIdJMhyTJCHwQgyjzKokNqMgwHQMgml8UC2k6Dc+gGIZRmgfxJjCfxti8c5lzJeBoDISpeDoAB9dDN2MbIm1rJtUWwWsGzEgB2E8WOANioA4oZ1241AQ0kUpjAAbWyKh1nYEpuL+OSCGyABdNVsmAOA8m4tYNiqLc6kOBpSjPJ9n1fKwP1Eewfycf9XCAwxmG8IA) to generate one. |
| 11 | + |
| 12 | +## Oracle Cloud |
| 13 | + |
| 14 | +### 1. Create Oracle Cloud customer-premises equipment |
| 15 | + |
| 16 | +1. Go to **Networking** > **Customer connectivity**, and select **Customer-premises equipment**. |
| 17 | +2. Select **Create CPE**. |
| 18 | +3. Select the following settings (you can leave settings not mentioned here with their default values): |
| 19 | + - **Name**: Enter a name. |
| 20 | + - **IP Address**: Enter your Cloudflare anycast IP address. |
| 21 | + - **CPE vendor information**: Select **Other**. |
| 22 | +4. Select **Create CPE**. |
| 23 | + |
| 24 | +### 2. Create Oracle Cloud dynamic routing gateways |
| 25 | + |
| 26 | +1. Go to **Networking** > **Customer connectivity**, and select **Dynamic routing gateways**. |
| 27 | +2. Select **Create Dynamic routing gateways**. |
| 28 | +3. Select the following settings (you can leave settings not mentioned here with their default values): |
| 29 | + - **Name**: Enter a name. |
| 30 | +4. Select **Create Dynamic routing gateways**. |
| 31 | + |
| 32 | +### 3. Create an IPsec connection |
| 33 | + |
| 34 | +1. Go to **Networking** > **Customer connectivity**, and select **Site-to-Site VPN**. |
| 35 | +2. Select **Create IPsec connection**. |
| 36 | +3. Select the following settings (you can leave settings not mentioned here with their default values): |
| 37 | + - **Name**: Enter a name. |
| 38 | + - **Customer-premises equipment**: Select the CPE you have created in step 1. |
| 39 | + - **Dynamic routing gateways**: Select the DRG you have created in step 2. |
| 40 | + - **Routes to your on-premises network**: Enter a CIDR range you want to route to Magic WAN. |
| 41 | + - **Tunnel 1** |
| 42 | + - **Name**: Enter a name. |
| 43 | + - Select **Provide custom shared secret**. |
| 44 | + - Enter the **pre-shared key** you created in the Prerequisites section. |
| 45 | + - **IKE version**: **IKEv2** |
| 46 | + - **Routing type**: **Static routing** |
| 47 | + - **IPv4 inside tunnel interface - CPE**: Enter the internal tunnel IP on the Cloudflare side of the IPsec tunnel. In this example, it is `10.200.1.0/31`. |
| 48 | + - **IPv4 inside tunnel interface - Oracle**: Enter the internal tunnel IP on the Oracle side of the IPsec tunnel. In this example, it is `10.200.1.1/31`. This matches with the Cloudflare side for this tunnel. |
| 49 | + 1. Select **Show advanced options** |
| 50 | + 2. Select **Phase one (ISAKMP) configuration** |
| 51 | + - Select **Set custom configurations** |
| 52 | + - **Custom encryption algorithm**: **AES_256_CBC** |
| 53 | + - **Custom authentication algorithm**: **SHA2_256** |
| 54 | + - **Custom Diffie-Hellman group**: **GROUP14** |
| 55 | + - **IKE session key lifetime in seconds**: **28800** |
| 56 | + 3. Select **Phase two (IPsec) configuration** |
| 57 | + - Select **Set custom configurations** |
| 58 | + - **Custom encryption algorithm**: **AES_256_CBC** |
| 59 | + - **HMAC_SHA2_256_128**: **HMAC_SHA2_256_128** |
| 60 | + - **IPsec session key lifetime in seconds**: **14400** |
| 61 | + - **Perfect forward secrecy Diffie-Hellman group**: **GROUP14** |
| 62 | + - **Tunnel 2** |
| 63 | + - Repeat the above steps for Tunnel 2. Select the right IP for **IPv4 inside tunnel interface - CPE**: `10.200.2.0/31` and **IPv4 inside tunnel interface - Oracle**: `10.200.2.1/31` |
| 64 | +4. Select **Create IPsec connection** |
| 65 | + |
| 66 | +## Magic WAN |
| 67 | + |
| 68 | +After configuring the Oracle Site-to-site VPN connection and the tunnels as mentioned above, go to the Cloudflare dashboard and create the corresponding IPsec tunnel and static routes on the Magic WAN side. |
| 69 | + |
| 70 | +### IPsec tunnels |
| 71 | + |
| 72 | +1. Refer to [Add tunnels](/magic-wan/configuration/manually/how-to/configure-tunnels/#add-tunnels) to learn how to add an IPsec tunnel. When creating your IPsec tunnel, make sure you define the following settings: |
| 73 | + - **Tunnel name**: Enter a name. |
| 74 | + - **Interface address**: Enter the internal tunnel IP on the Cloudflare side of the IPsec tunnel. In this example, it is `10.200.1.0/31`. |
| 75 | + - **Customer endpoint**: The Oracle VPN public IP address. |
| 76 | + - **Cloudflare endpoint**: Enter your Cloudflare anycast IP address. |
| 77 | + - **Health check type**: **Request** |
| 78 | + - **Health check direction**: **Unidirectional** |
| 79 | + - **Health check target**: **Default** |
| 80 | + - **Pre-shared key**: Choose **Use my own pre-shared key**, and enter the pre-shared key you created in the Prerequisites section. |
| 81 | + - **Replay protection**: **Enabled**. |
| 82 | +2. Select **Add tunnels**. |
| 83 | +3. Repeat the above steps for Tunnel 2. Chose the same Cloudflare anycast IP address and select the right IP for **Interface address**: `10.200.2.0/31` |
| 84 | + |
| 85 | +### Static routes |
| 86 | + |
| 87 | +The static route in Magic WAN should point to the appropriate virtual machine (VM) subnet you created inside your Oracle Virtual Cloud Network (VCN). For example, if your VM has a subnet of `192.168.192.0/26`, you should use it as the prefix for your static route. |
| 88 | + |
| 89 | +To create a static route: |
| 90 | + |
| 91 | +1. Refer to [Create a static route](/magic-wan/configuration/manually/how-to/configure-static-routes/#create-a-static-route) to learn how to create one. |
| 92 | +2. In **Prefix**, enter the subnet for your VM. For example, `192.xx.xx.xx/24`. |
| 93 | +3. For the **Tunnel/Next hop**, choose the IPsec tunnel you created in the previous step. |
| 94 | +4. Repeat the steps above for the second IPsec tunnel you created. |
![hyperlint-ai[bot]](https://avatars.githubusercontent.com/in/718456?v=4&size=40){kind=avatar}
0 commit comments