FastConnect: With an Oracle Partner

If you haven't already, start the process of ordering the connection from the Oracle partner, setting it up, and then testing it with the partner. It can take some time, depending on the partner.

Summary: Create one or more virtual circuits for a connection in the Oracle Console. If the network design includes more than one virtual circuit, complete the following steps for each one.

When you create a virtual circuit using an Oracle Partner, OCI metering starts when the virtual circuit is established.

Instructions:

Repeat the following steps for each virtual circuit you want to create.

1. In the Console, confirm you're viewing the compartment  that you want to work in. If you're not sure which one, use the compartment that contains the DRG that you connect to (for a private virtual circuit). The choice of compartment, along with a corresponding IAM policy, controls who has access to the virtual circuit you're about to create.
2. Open the navigation menu  and select Networking. Under Customer connectivity, select FastConnect.

   This FastConnect page lists existing connections and is where you create a new connection. You can also return to this page later to manage the connection.

3. Select Create FastConnect.
4. Select either Single virtual circuit (the default) or Redundant virtual circuits to configure virtual circuits that use different physical devices in the same FastConnect location. See FastConnect Redundancy Best Practices for more about redundancy. If you select Single virtual circuit you can return later to add a redundant virtual circuit.
5. Select Next.

6. Enter the following for the virtual circuit (Virtual circuit 1 if you selected Redundant virtual circuits):

   • Name: A descriptive name for the virtual circuits. The value doesn't need to be unique across virtual circuits, and you can change it later. Avoid entering confidential information.
   • Create in Compartment: Leave as is (the compartment you're working in).
   • Select Partner and select the partner from the list.
     Note
     
     If you select Megaport as the partner, you can provision the partner side of the circuit using the optional steps mentioned.

7. Select the virtual circuit type (private or public). A private virtual circuit is for private peering (where the on-premises network receives routes for the available private IP addresses). A public virtual circuit is for public peering (where the on-premises network receives routes for the Oracle Cloud Infrastructure public IP addresses). Redundant virtual circuits must both be private, or both public, so this setting is matched on the other virtual circuit. Also see Uses for FastConnect.

   • For a private virtual circuit, enter the following:

     • Select either All traffic or IPSec over FastConnect traffic only. The virtual circuit can be used for IPSec over FastConnect with either choice, but you can select to only allow encrypted traffic on the virtual circuit. Redundant virtual circuits must have the same setting, so this is matched on the other virtual circuit.
     • Dynamic Routing Gateway: Select the DRG to route the FastConnect traffic to. IPSec over FastConnect requires an upgraded DRG. This DRG could be attached to several VCNs or to other DRGs with attached VCNs.
     • Provisioned Bandwidth: Select a value. If the bandwidth needs increase later, you can update the virtual circuit to use a different value (see To edit a virtual circuit).
     • Partner Service Key (Optional): Enter the service key provided by the Oracle partner. You can enter this key now or edit the circuit later. If the partner chosen is AT&T Netbond, you can add a placeholder service key or leave the field blank in the virtual circuit creation phase. See OCI FastConnect for AT&T Partner - simplified procedure for more details.

     If the BGP session goes to Oracle (see Basic Network Diagrams), the dialog box includes other fields for the BGP session:

     • Customer BGP IP Address: The BGP peering IP address for the edge device (the CPE), with a subnet mask from /28 to /31.
     • Oracle BGP IP Address: The BGP peering IP address you want to use for the Oracle edge (the DRG), with a subnet mask from /28 to /31.
     • Enable IPv6 Address Assignment: IPv6 addressing is supported for all commercial and government regions. See FastConnect and IPv6.
     • Customer BGP ASN: The public or private ASN for the network.
     • Use a BGP MD5 Authentication Key (optional): Select this checkbox and provide a key if the system requires MD5 authentication. Oracle supports up to 128-bit MD5 authentication.
     • Enable Bidirectional Forwarding Detection (optional): Select this checkbox to enable Bidirectional Forwarding Detection.
       Note
       
       When you use Bidirectional Forwarding Detection, a paired device must be configured to use a 300 ms minimum interval and a multiplier of 3.

   • For a public virtual circuit, enter the following:

     • Provisioned Bandwidth: Select a value. If the bandwidth needs increase later, you can update the virtual circuit to use a different value (see To edit a virtual circuit).
     • Public IP Prefixes: The public IP prefixes that you want Oracle to receive over the connection. All prefix sizes are allowed. You can enter a comma-separated list of prefixes, or one per line.
     • Route Filtering: Select a Route Filtering option. This selects the routes included in BGP advertisements to an on-premises network.
     • BGP ASN: The public ASN for the network. Present only if the BGP session goes to Oracle (see Basic Network Diagrams). Oracle specifies the BGP IP addresses for a public virtual circuit.
     • Use a BGP MD5 Authentication Key (optional): Select this checkbox and provide a key if the system requires MD5 authentication. Oracle supports up to 128-bit MD5 authentication.
     • Enable Bidirectional Forwarding Detection (optional): Select this checkbox to enable Bidirectional Forwarding Detection.
8. If you're creating a redundant virtual circuit, enter the necessary information for the other virtual circuit (Virtual circuit 2). If you selected Redundant virtual circuits, remember that the virtual circuit type (private or public) and All traffic or IPSec over FastConnect traffic only settings for Virtual circuit 2 are already set to match Virtual circuit 1 and if you change them the settings on the other circuit automatically change to match. If you have service agreements with more than one Oracle Partner, you can select different partners for Virtual circuit 1 and Virtual circuit 2 as long as you select the same Dynamic Routing Gateway. You can also select a different Dynamic Routing Gateway and Provisioned Bandwidth, but this requires configuring peering between the two DRGs and doesn't improve the redundancy posture.
   Note
   
   Creating a redundant virtual circuit is optional if you selected Redundant virtual circuits and the partner you selected creates a Layer 3 connection to OCI, but a redundant virtual circuit is required if the partner you selected creates a Layer 2 connection. See FastConnect Redundancy Best Practices for more about Layer 2 and Layer 3 connections.

9. Select Create.

   The virtual circuit is created and displays a status page. Select Close to return to the list of virtual circuits.

10. Select the name of the virtual circuit you created. While the virtual circuit is in the PENDING PARTNER state, its OCID and a link to the partner's portal are displayed in the "Connection created" confirmation box at the top of the page. The virtual circuit's OCID is also available with the other virtual circuit details. Copy and paste the OCID to another location. You give it to the Oracle partner in the next task. Also copy the OCID for the redundant circuit if you created one.

Until you complete the next task and the partner does their provisioning work, the virtual circuit's Lifecycle State is PENDING PARTNER and the BGP state is DOWN. After the partner does their work, the Lifecycle State switches to PROVISIONED. When the BGP session is established and working, the BGP state changes to UP.

Also see the diagram in To get the status of a virtual circuit.

Contact the partner and give the OCID of each virtual circuit that you created, along with any other information the partner requests. Depending on the partner, you might do this in the partner's online portal, or over the phone. The partner then configures each virtual circuit on their end to complete the connectivity.

If your partner is either Megaport or Colt, you can also connect the OCI Console to the partner and complete the connection yourself from within the OCI Console as described in the following sections.

If your partner is AT&T NetBond:  To expedite virtual circuit activation, update the details for the virtual circuit with the service key after completing AT&T console setup steps. See OCI FastConnect for AT&T Partner - simplified procedure for more details.

If the BGP session goes to Oracle: (see Basic Network Diagrams), configure the edge device (your CPE) to use the BGP peering information (see General Requirements). Oracle's BGP ASN for the commercial cloud is 31898, except the Serbia Central (Jovanovac) region which is 14544. For the Government Cloud, see Oracle's BGP ASN. If you need fast BGP convergence, you can use any value in these supported ranges: 6 to 60 seconds for keep-alive, and 18 to 180 seconds for hold-time. BGP timers are negotiated between the two BGP peers to the lower value used by one of the two sides. Also configure the router for redundancy according to the network design you decided on earlier (see FastConnect Redundancy Best Practices). After you successfully configure the BGP session, the virtual circuit's BGP session state changes to UP.

If the BGP session instead goes to the Oracle partner: You still need to configure the router if you haven't already. You might need to contact the partner to get the required BGP peering information. This BGP session must be up and running for FastConnect to work. Also configure the edge router for redundancy according to the network design you decided on earlier (see FastConnect Redundancy Best Practices).

Confirm that the light levels are good for each of the physical network connections to the partner. Don't proceed until they are.

Confirm your side of the interfaces for the connections to the partner are up. Don't proceed until they are.

For each virtual circuit, ping the Oracle BGP IP address assigned to the virtual circuit. Check the error counters and look for any dropped packets. Don't proceed until you can successfully ping this IP address without errors.

Confirm that each virtual circuit's BGP session is in an established state and therefore ready to test (see Task 11: Test the connection).

For each virtual circuit, ping the partner's edge. Check the error counters and look for any dropped packets. Don't proceed until you can successfully ping the partner's edge without errors.

Confirm the BGP session you have with the partner is in an established state. Don't proceed until it is.

For each virtual circuit, ping the Oracle BGP IP address (which you can get from the partner). Check the error counters and look for any dropped packets. When you can successfully ping this IP address without errors, the connection is ready to test.

For a private virtual circuit: Tu run this test, you must create an instance in a VCN and access it (for example, with SSH) from a host in an existing private network. See Creating an Instance. If you can, the FastConnect private virtual circuit is ready to use.

For a public virtual circuit:

1. Open the navigation menu  and select Networking. Under Customer connectivity, select FastConnect.
2. Select the virtual circuit you're interested in to view its details.

The following diagram shows the different states of the virtual circuit when you're setting it up.

You can change these items for a virtual circuit:

• The name
• The bandwidth
• The service key provided by an Oracle partner (for a private virtual circuit)
• Which DRG it uses (for a private virtual circuit)
• The public IP prefixes (for a public virtual circuit)
• Enable or disable Bidirectional Forwarding Detection
• Configure the virtual circuit to only allow traffic using IPSec over FastConnect. By default any traffic is allowed.
• Depending on the situation, you might also have access to the BGP session information for the virtual circuit and thus can change it.

1. Open the navigation menu  and select Networking. Under Customer connectivity, select FastConnect.
2. Select the compartment where the connection resides, and then select the connection to view its details.
3. Select Edit and make changes. Avoid entering confidential information.
4. Select Save Changes.
5. (Optional) To temporarily deactivate a virtual circuit, select Deactivate. To reactivate the circuit, select Activate. Deactivating the virtual circuit suspends the BGP session and traffic flow without otherwise changing the settings for the virtual circuit.

1. Open the navigation menu  and select Networking. Under Customer connectivity, select FastConnect.
2. Select the compartment where the connection resides, and then select the connection to view its details.
3. Select Delete.
4. Confirm when prompted.

The virtual circuit's Lifecycle State changes to TERMINATING and then to TERMINATED.

For general information about the prefixes, see Basic Network Diagrams.

You can specify public IP prefixes when you create the virtual circuit. See Task 3: Set up virtual circuits.

You can add or remove public IP prefixes later after creating the virtual circuit. See To edit a virtual circuit. If you add a new prefix, Oracle first verifies ownership before advertising it across the connection. If you remove a prefix, Oracle stops advertising the prefix within a few minutes of editing the virtual circuit.

You can view the state of Oracle's verification of a particular public prefix by viewing the virtual circuit's details in the Console. Here are the possible values:

• In progress: Oracle is in the process of verifying ownership of the prefix.
• Failed: Oracle couldn't verify ownership. Oracle doesn't advertise the prefix over the virtual circuit.
• Completed: Oracle successfully verified ownership. Oracle is advertising the prefix over the virtual circuit.

You can move a connection from one compartment to another. After you move the connection to the new compartment, inherent policies apply immediately and affect access to the connection through the Console. Moving the connection to a different compartment doesn't affect the connection between a data center and Oracle Cloud Infrastructure. For more information, see Moving a Compartment to a Different Parent Compartment.

1. Open the navigation menu  and select Networking. Under Customer connectivity, select FastConnect.
2. Find the connection in the list, select the Actions menu (), and then select Move Resource.
3. Select the destination compartment from the list.
4. Select Move Resource.
5. If alarms are monitoring the connection, update the alarms to reference the new compartment. See Updating an Alarm After Moving a Resource for more information.