Skip to content

Commit 2018ec0

Browse files
prasanna-naik-oraclebriangustafson
prasanna-naik-oracle
authored and
briangustafson
committed
Adding a new template to connect VCNs using multiple VNICs (#552)
Add new solution to connect VCNs using multiple VNICs
1 parent 91c1261 commit 2018ec0

File tree

8 files changed

+560
-0
lines changed

8 files changed

+560
-0
lines changed

‎docs/solutions/connect_vcns_using_multiple_vnics/README.md‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# ___ ____ _ ____ _ _____
2+
# / _ \| _ \ / \ / ___| | | ____|
3+
# | | | | |_) | / _ \| | | | | _|
4+
# | |_| | _ < / ___ | |___| |___| |___
5+
# \___/|_| \_/_/ \_\____|_____|_____|
6+
***
7+
This example creates 2 VCNs with non-overlapping subnets and establishes connectivity between the 2 using attached VNICs.
8+
9+
Each VCN has a public subnet and a private subnet. Each subnet is created with a separate security list and route table.
10+
The template then launches a private instance in each one of the private subnets.
11+
12+
A public instance is created in the public subnet of the first VCN.
13+
The public instance is configured as a Bridge instance (by enabling and configuring firewall to do forwarding).
14+
15+
The first VCN's private subnet's route table is configured to use the Bridge instance's private IP address as the default route target. See [Using a Private IP as a Route Target](https://docs.us-phoenix-1.oraclecloud.com/Content/Network/Tasks/managingroutetables.htm#privateip) for more details on this feature.
16+
17+
A secondary VNIC is created and attached to the Bridge instance. See [Configuring and using Secondary VNIC](https://docs.cloud.oracle.com/iaas/Content/Network/Tasks/managingVNICs.htm) for more details on this feature. This secondary VNIC is attached to the public subnet of the second VCN. Now the Brdige instance has 2 VNICs, 1 is a default VNIC attached to the first VCN and other is the secondary VNIC attached to the second VCN.
18+
19+
The second VCN's private subnet's route table is configured to use the Bridge instance's secondary VNIC's private IP address as default route target.
20+
21+
![Architecture diagram](images/connect_vcns_using_multiple_vnics.png)
22+
23+
### Using this example
24+
* Update env-vars with the required information. Most examples use the same set of environment variables so you only need to do this once.
25+
* Source env-vars
26+
* `$ . env-vars`
27+
* Update variables in bridge.tf as applicable to your target environment.
28+
29+
Once the environment is built, both the private instances in the different VCNs should be connected. You can login to the public Bridge instance, from there login to the private instances and then ping/SSH the other private instance to verify conectivity between the private instances in different VCNs.
30+
31+
### How to validate this example
32+
Steps to validate this example will also be listed in the output when the terraform is deployed.
33+
1. Enable ssh forwarding from your machine by performing "ssh-add ~/.ssh/id_rsa"
34+
2. Login to Bridge instance using command "ssh -A Bridge-Instance-Public-IP-Address"
35+
3. After that, login to privateInstance-1 using "ssh PrivateInstance-1-IP-Address"
36+
4. Ping the other PrivateInstance-2 "ping PrivateInstance-2-IP-Address"
37+
5. Vice versa should work fine as well.
38+
39+
### Files in the configuration
40+
41+
#### `env-vars`
42+
Is used to export the environmental variables used in the configuration. These are usually authentication related, be sure to exclude this file from your version control system. It's typical to keep this file outside of the configuration.
43+
44+
Before you plan, apply, or destroy the configuration source the file -
45+
`$ . env-vars`
46+
47+
#### `user_data.tpl`
48+
Enabling and configuring firewall to do forwarding.
49+
50+
#### `bridge.tf`
51+
Defines the bridge instance resources.
52+
53+
#### vcn1.tf
54+
Defines VCN1 resources.
55+
56+
#### vcn2.tf
57+
Defines VCN2 resources.
58+
59+
#### output.tf
60+
Displays the output.

‎docs/solutions/connect_vcns_using_multiple_vnics/bridge.tf‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# Creating the Bridge Instance
2+
resource "oci_core_instance" "BridgeInstance" {
3+
availability_domain = "${lookup(data.oci_identity_availability_domains.ADs.availability_domains[var.AD - 1],"name")}"
4+
compartment_id = "${var.compartment_ocid}"
5+
display_name = "BridgeInstance"
6+
image = "${var.InstanceImageOCID[var.region]}"
7+
shape = "${var.InstanceShape}"
8+
9+
create_vnic_details {
10+
subnet_id = "${oci_core_subnet.MgmtSubnet.id}"
11+
skip_source_dest_check = true
12+
}
13+
14+
metadata {
15+
ssh_authorized_keys = "${var.ssh_public_key}"
16+
user_data = "${base64encode(file("user_data.tpl"))}"
17+
}
18+
19+
timeouts {
20+
create = "10m"
21+
}
22+
}
23+
24+
# Gets a list of VNIC attachments on the instance
25+
data "oci_core_vnic_attachments" "BridgeInstanceVnics" {
26+
compartment_id = "${var.compartment_ocid}"
27+
availability_domain = "${lookup(data.oci_identity_availability_domains.ADs.availability_domains[var.AD - 1],"name")}"
28+
instance_id = "${oci_core_instance.BridgeInstance.id}"
29+
}
30+
31+
# Create PrivateIP
32+
resource "oci_core_private_ip" "BridgeInstancePrivateIP" {
33+
vnic_id = "${lookup(data.oci_core_vnic_attachments.BridgeInstanceVnics.vnic_attachments[0],"vnic_id")}"
34+
display_name = "BridgeInstancePrivateIP"
35+
}
36+
37+
# Get the OCID of the first (default) VNIC
38+
data "oci_core_vnic" "BridgeInstanceVnic1" {
39+
vnic_id = "${lookup(data.oci_core_vnic_attachments.BridgeInstanceVnics.vnic_attachments[0],"vnic_id")}"
40+
}
41+
42+
# Creating secondary VNIC on BridgeInstance and attaching it to Second VCN Mgmt subnet
43+
resource "oci_core_vnic_attachment" "SecondaryVnicAttachment" {
44+
create_vnic_details {
45+
subnet_id = "${oci_core_subnet.MgmtSubnet2.id}"
46+
display_name = "SecondaryVNIC"
47+
skip_source_dest_check = true
48+
}
49+
50+
instance_id = "${oci_core_instance.BridgeInstance.id}"
51+
}
52+
53+
# Gets a list of VNIC attachments on the instance
54+
data "oci_core_vnic_attachments" "BridgeInstanceVnics2" {
55+
compartment_id = "${var.compartment_ocid}"
56+
availability_domain = "${lookup(data.oci_identity_availability_domains.ADs.availability_domains[var.AD - 1],"name")}"
57+
instance_id = "${oci_core_instance.BridgeInstance.id}"
58+
}
59+
60+
# Gets the OCID of the second VNIC
61+
data "oci_core_vnic" "BridgeInstanceVnic2" {
62+
vnic_id = "${oci_core_vnic_attachment.SecondaryVnicAttachment.vnic_id}"
63+
}
64+
65+
# Gets a list of private IPs on the second VNIC
66+
data "oci_core_private_ips" "BridgeInstancePrivateIP2" {
67+
vnic_id = "${data.oci_core_vnic.BridgeInstanceVnic2.id}"
68+
}
69+
70+
# Configurations for setting up the secondary VNIC
71+
resource "null_resource" "configure-secondary-vnic" {
72+
connection {
73+
type = "ssh"
74+
user = "opc"
75+
private_key = "${var.ssh_private_key}"
76+
host = "${data.oci_core_vnic.BridgeInstanceVnic1.public_ip_address}"
77+
timeout = "30m"
78+
}
79+
80+
provisioner "remote-exec" {
81+
inline = [
82+
"sudo wget https://docs.cloud.oracle.com/iaas/Content/Resources/Assets/secondary_vnic_all_configure.sh",
83+
"sudo chmod 777 secondary_vnic_all_configure.sh",
84+
"sudo ./secondary_vnic_all_configure.sh -c ${lookup(data.oci_core_private_ips.BridgeInstancePrivateIP2.private_ips[0],"id")}",
85+
"sudo ip route add ${var.vcn_cidr2} dev ens4 via ${oci_core_subnet.MgmtSubnet2.virtual_router_ip}",
86+
]
87+
}
88+
}

‎docs/solutions/connect_vcns_using_multiple_vnics/env-vars‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
### Provider credentials
2+
export TF_VAR_tenancy_ocid=""
3+
export TF_VAR_user_ocid=""
4+
export TF_VAR_fingerprint=""
5+
export TF_VAR_private_key_path=""
6+
7+
### Instance credentials
8+
export TF_VAR_ssh_public_key=$(cat .../id_rsa.pub)
9+
export TF_VAR_ssh_private_key=$(cat .../id_rsa)
10+
11+
### Region
12+
export TF_VAR_region=""
13+
14+
### AD
15+
# Possible values are 1, 2, 3
16+
export TF_VAR_AD=""
17+
18+
### Compartment
19+
export TF_VAR_compartment_ocid=""
20+
21+
######
22+
# Optional Variables
23+
######
24+
25+
### VCN-1 configuration
26+
#export TF_VAR_vcn_cidr=""
27+
#export TF_VAR_mgmt_subnet_cidr=""
28+
#export TF_VAR_private_subnet_cidr=""
29+
30+
### VCN-2 configuration
31+
#export TF_VAR_vcn_cidr2=""
32+
#export TF_VAR_mgmt_subnet_cidr2=""
33+
#export TF_VAR_private_subnet_cidr2=""
34+
35+
### Instance configuration
36+
#export TF_VAR_InstanceShape=""
37+
#export TF_VAR_InstanceOS=""
38+
#export TF_VAR_InstanceOSVersion=""

‎docs/solutions/connect_vcns_using_multiple_vnics/images/connect_vcns_using_multiple_vnics.png‎

112 KB
Loading

‎docs/solutions/connect_vcns_using_multiple_vnics/output.tf‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Outputing required info for users
2+
output "Bridge Instance Public IP" {
3+
value = "${data.oci_core_vnic.BridgeInstanceVnic1.public_ip_address}"
4+
}
5+
6+
output "PrivateInstance1 Private IP" {
7+
value = "${oci_core_instance.PrivateInstance.private_ip}"
8+
}
9+
10+
output "PrivateInstance2 Private IP" {
11+
value = "${oci_core_instance.PrivateInstance2.private_ip}"
12+
}
13+
14+
output "SSH login to the Bridge Instance" {
15+
value = "ssh -A opc@${data.oci_core_vnic.BridgeInstanceVnic1.public_ip_address}"
16+
}
17+
18+
output "SSH login to the Private Instance-1 after logging into Bridge Instance as shown above" {
19+
value = "ssh -A opc@${oci_core_instance.PrivateInstance.private_ip}"
20+
}
21+
22+
output "SSH login to the Private Instance-2 after logging into Bridge Instance as shown above" {
23+
value = "ssh -A opc@${oci_core_instance.PrivateInstance2.private_ip}"
24+
}
25+
26+
output "Ping from PrivateInstance-1 to PrivateInstance-2" {
27+
value = "ping ${oci_core_instance.PrivateInstance2.private_ip} "
28+
}

‎docs/solutions/connect_vcns_using_multiple_vnics/user_data.tpl‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#cloud-config
2+
3+
write_files:
4+
# Create file to be used when enabling ip forwarding
5+
- path: /etc/sysctl.d/98-ip-forward.conf
6+
content: |
7+
net.ipv4.ip_forward = 1
8+
9+
runcmd:
10+
# Run firewall commands to enable masquerading and port forwarding
11+
# Enable ip forwarding by setting sysctl kernel parameter
12+
- firewall-offline-cmd --direct --add-rule ipv4 filter FORWARD 0 -i ens3 -j ACCEPT
13+
- firewall-offline-cmd --direct --add-rule ipv4 filter FORWARD 0 -i ens4 -j ACCEPT
14+
- /bin/systemctl restart firewalld
15+
- sysctl -p /etc/sysctl.d/98-ip-forward.conf
16+

0 commit comments

Comments
 (0)