6.

Networking - IP Management

Module Overview

Welcome to this module on IP management. In this module, our focus will be on IP addressing. We will discu
ss the two types of IP address, public IP address and private IP address, and we will also understand how to
use these IP addresses with respect to a virtual cloud network. I will also help you understand the difference
s between these two types of IP addresses.

Next, I will talk about Bring Your Own IP, that lets you bring the public IP addresses that you own into OCI. W
e'll conclude the discussion of this module with the discussion of IP pools. So let's get started.

===

Overview of IP Management - Part 1

Welcome to this lesson on Overview of IP management. So now we are starting the discussion on IP manage
ment. And this is an overview lesson. So let's first talk about the two different types of IP addresses.

The first is private IP address. And then there is public IP address. Let's first focus on private IP. So what is th
e use case of a private IP address? Let's say this is a VCN. Inside the VCN, we have a private subnet. Inside th
e private subnet, we have a virtual machine.

And this virtual machine has got a VNIC which has private IP address assigned to it. We were talking about t
he use cases of private IP address. The first use case is this particular instance, this instance can talk to other
instances in the same VCN.

There might be let's say 7, 8, 10, whatever the number of instances in the same VCN might be in a different s
ubnet, but the condition is the instances should be in the same VCN. So the communication can happen thro
ugh private IP address.

The second scenario is that of peering. Peering happens when you connect two different Virtual Cloud netw
orks. So this peered VCN, they can exist in the same region. They can also exist in different regions.

So in case of a peering, the instances talk to each other using private IP addresses. So that's the second use c
ase. The third use case is this particular instance, it can also talk to other hosts in on-premises network.

This typically happens with the help of either site-to-site VPN connection or you also have another service w
hich is known as FastConnect. There also the communication happens using private IP addresses.

So these are some of the use cases of private IP addresses. Now let's talk about some specifics. Now I am dr
awing an instance. Now this instance can have a primary VNIC, virtual network interface card. It can also hav
e secondary VNIC. So instances can have primary NIC and secondary NIC.

Now this primary VNIC is going to have a primary private IP address. You can have one primary private addre
ss in a primary VNIC. Similarly, the secondary VNIC, it can also have a primary private IP address. So one den
otes the number of primary private IP address. There can be only one primary private IP address both for pri
mary VNIC and secondary VNIC.
Now comes the interesting part. You can also have secondary private IP address. And that can be 32. So you
can have 32 secondary private IP addresses. Similarly, you can have 32 secondary private IP addresses in a se
condary VNIC.

So the point to be noted here is that if there is a secondary VNIC, it also receives a primary private IP addres
s. And whatever IP addresses we are talking about, all these private IP addresses, they can have a public IP a
ddress assigned to it at our discretion.

So in a way, a VNIC, it can have a maximum of 33 private IP addresses. And I'm talking about IPv4 addresses
here. Out of 33, one is primary and 32 is secondary. So total of 33 private IPv4 addresses in one VNIC.

So now let's talk about public IP address. So what is the use case of public IP address? Basically, it is reachabl
e from internet. It is reachable from internet. And in OCI, there are some resources, for example NAT gatewa
y.

This resource is designed to be directly reachable from internet. And we have seen that in previous demonst
rations. And hence, this NAT gateway, it actually comes with a public IP address. Now there are two types of
public IP addresses in OCI.

The first type is ephemeral. The second type is reserved. Let's do a bit of discussion on these two types of pu
blic IP addresses. So on one side, I will write ephemeral public IP reserved public IP.

Let's do a comparison of these two types of IP addresses. First, let's try to understand what is what. Epheme
ral, the word ephemeral means something that is not permanent. So it is basically a temporary, temporary p
ublic IP.

And this reserved public IP is something that is persistent. We have an instance. This instance, let's say is ass
ociated with a public IP address, which is ephemeral. So what happens if we delete the instance or terminat
e the instance? This public IP address goes away.

So what it also means is that this ephemeral public IP address exists for the lifetime of the instance. Wherea
s in case of a reserved public IP, let's say this VM instance is now associated with a reserved public IP.

Now in this case, even if the instance gets terminated, this reserved public IP address is going to exist beyon
d the lifetime of the instance. What it means is you can reassign this public IP address to another instance, w
henever you like it. So this is the difference between ephemeral public IP versus reserved public IP.

One more difference that you should understand here is that this ephemeral public IP, these can only be assi
gned to a VNIC's primary private IP. We had a discussion on this a few minutes back. What is primary private
IP and what is secondary private IP?

In case of reserved public IP address, it can be assigned to either a primary private IP or a secondary private I
P. So this is another difference. This marks the end of this lesson. And in the next lesson, we will discuss the
deck for IP management overview. Thanks for watching.

===

Overview of IP Management - Part 2

So first, let's look at private IP address. As I mentioned, every instance that you are going to have will have a
t least one primary private IP address. And that private IP address can have an optional public IP assigned to
it. So in case of a public subnet, if there is an instance, it will have both private IP address as well as a public
IP address.

Now every VNIC, I mentioned can have one primary private IP address and 32 secondary private IP addresse
s. And this is what you see in this diagram. So this is an instance. You have primary VNIC. If you just have pri
mary VNIC, there is going to be a primary private IP address 1. And then you can also have up to 32 secondar
y private IP addresses.

If you have another secondary VNIC, then it is, again, going to have a primary private IP address and up to 32
secondary private IP address. So this is what we actually discussed. Now looking at public IP address, I menti
oned that it's an IP address that is reachable from the internet. And it is always assigned to a private IP objec
t on the resource.

There are some conditions in order for the public IP to be reachable over the internet. The first condition is t
here must be internet gateway created in the VCN. Apart from the internet gateway, the public subnet shoul
d have the route tables correctly configured. That means there should be a route out to the internet through
the internet gateway. And then you should also have correctly configured security lists.

And as we have seen in the whiteboarding, each resource can have multiple public IP addresses, because the
re can be one VNIC, or there can be more than one VNIC. Every VNIC is going to have one primary private IP
address and up to 32 secondary private IP addresses. And each of these private IP addresses can have a publ
ic IP address.

We also discussed the different types of public IP addresses. The first one is ephemeral, which I mentioned is
temporary, and it goes away when you terminate the instance. The second one is reserved, that exists beyon
d the lifetime of the instance. So even if you terminate the instance, you can still have that IP address assign
ed to another resource.

And the best part about this is there is no charge for using public IP address. Even if you have a reserved pub
lic IP address, which is unassociated with any resource, still you are not going to be charged for it. So this ma
rks the end of this lesson on IP management overview. Thanks for watching.

===

Reserved Public IP

Welcome to this lesson on reserved public IP addresses. In the previous lesson, we had a discussion on the t
wo types of public IP addresses-- ephemeral and reserved. So let's talk about reserved public IP addresses in
some detail.
So let me talk about reserved public IP address. As the name suggests and we have already discussed that th
is is going to be a persistent IP address. That means even if you terminate the instance, this IP address is goin
g to exist beyond the lifetime of the instance. Now we'll talk about some details.

The first detail is with respect to creation. So you can create reserved public IP address one at a time. So crea
tion is one at a time. And then after it is created, you can perform the assignment. There is also a limit associ
ated with reserved public IP address. You can have 50 reserved public IP addresses in a region.

So we talked about assignment, what about an assignment? So if there is this reserved public IP, let's say thi
s is the object, in case you would like to unassign it at any time, then that particular IP address is going to ret
urn to the tenancy's pool of reserved public IPs. So there is no concept of automatic deletion. It is actually n
ever automatically deleted. It is going to exist until you delete it.

Another important thing is the scope for reserved public IP address is regional, which means it can be assign
ed to a private IP in any availability domain in the region. Let's say there is an instance. This instance has a V
NIC, and we have discussed this VNIC can have one primary private IP address and up to 32 secondary privat
e IP addresses.

Now there can be multiple VNICs associated with the instance. If we are moving any of the private IP addres
ses, let's say one of these secondary private IP addresses, we are moving from VNIC 1 to let's say VNIC 2.

Now the reserved IP address will also move along with the private IP address. Please also make a note of thi
s, this is also an important point. All right. Now let's move on to the deck and quickly revisit what we have di
scussed.

So as you can see in this screenshot, when you create a reserved public IP, you need to provide a name, then
you need to select the compartment and the IP address source. In this case, the IP address source is Oracle.

So it is persistent, meaning it is not ephemeral. Even if you terminate the instance, this reserved public IP ad
dress is going to persist. You have the ability to unassign and reassign to any other resource whenever you li
ke.

So that flexibility is there in reserved public IP address. And as we discussed, there is no concept of automati
c deletion in reserved public IP address. It is going to exist until you delete it. And then this reserved public a
ddress also gives you the flexibility of assigning it to the compute instance or assigning the public IP address
to any resource whenever needed, and thereby it reduces the security risk. This marks the end of this lesson
. Thanks for watching.

===

BYOIP

Hello, and welcome to this lesson on Bring Your Own IP Address. Let's get started. Let's say I am working wit
h a public IP address in Oracle Cloud Infrastructure. So can you tell me who is the owner of that public IP add
ress? It's basically owned by Oracle. Now, let's say this is your on-premises environment, and let's say this is
OCI.
In the on-
premises environment, you have an IPv4 CIDR or an IPv6 prefix that you would like to move to Oracle Cloud I
nfrastructure. Why? Because you might have an application where you have hard coded IP address. And wh
en you plan a migration to Oracle Cloud Infrastructure, you would like to use that IP address. Basically, if you
want to have a smooth migration to OCI, you need to have a solution that provides solution continuity. And t
hat is where this bring your own IP comes into action.

So what is the process of bringing your own IP to Oracle Cloud Infrastructure? I will describe the process in d
etail. But at a very high level, when you specify to Oracle that I need these CIDR blocks or these prefixes to b
e brought to OCI, Oracle is going to perform a validation. And what is the validation all about? The validation
is regarding whether you are the owner of IPv4 CIDR block or IPv6 prefix that you want to import into OCI.

And this ownership, ownership of these IP addresses, it must be registered with a supported regional intern
et registry. So in a nutshell, Oracle validates the ownership of your addresses before it can bring those addre
sses to OCI. Now, there are some limitations, of course. For example, when it comes to IPv4 CIDR block, the
minimum is slash 24, and the maximum is slash 8. When it comes to IPv6, the imported IPv6 prefix must be s
lash 48 or larger.

Let's have a look at the bring your own IP process overview. So what is bring your own IP process? And how
does it look like? First of all, you as a customer, you will request. So, first of all, you will request to import a p
ublic IPv4 CIDR block or IPv6 prefix. And remember, this is something that you own. So you request to impor
t into OCI. Now, when you do that, Oracle is going to issue you a verification token.

This verification token will be used by you. Basically, you will be adding the verification token to the informa
tion about your IP addresses that is kept by RIR. And RIR, I already mentioned it stands for Regional Internet
Registry. So let me mention it. It is basically add verification token to the info that's already there regarding y
our IP addresses in the RIR. After that, you also need to create something that is known as ROA. And ROA st
ands for Route Origin Authorization.

What is the significance of this route origin authorization? If you don't create a route origin authorization, w
hat can happen? As a part of route origin authorisation, you provide the Oracle BGP ASN for the commercial
cloud to the regional internet registry. And this ROA allows Oracle to advertise the bring your own IP CIDR bl
ock. So this is a pretty important step.

After that, you request that Oracle finish the import process or the import request. And this typically takes a
round-- remember I talked about the verification token, adding the verification token. This takes around one
day. So after this, Oracle is going to communicate with the RIR. And it is going to verify that you own the IP a
ddress. So that's the validation process.

So after that, Oracle is going to provision the bring your own IP addresses to your compartment within your
tenancy. At this point of time, you have the bring your own IP IPv4 CIDR block or IPv6 prefix. So that is basica
lly yours to manage in your compartment. What you can also do is you can also advertise this CIDR block or t
he prefix to the internet. So this is how this process works.

So let's now move to the deck and discuss about bring your own IP. So as I mentioned in the whiteboarding,
you have the ability to bring your own IP address space to Oracle Cloud Infrastructure so that you can use th
em with your resources in Oracle Cloud Infrastructure. I also mentioned that Oracle is going to perform a vali
dation process on the imported IPv4 CIDR blocks or prefixes. And after validation, you will be notified that th
ey are available for advertisement.

I also talked about RIR, which is Regional Internet Registry. So the IP addresses that you plan to bring to Orac
le Cloud Infrastructure must be registered with a supported regional internet registry. And Oracle is going to
validate the ownership of your addresses at the regional internet registry. As far as the limits are concerned,
I mentioned that you can use bring your own IP with an IPv4 CIDR block that is minimum of slash 24 and ma
ximum of slash 8. And when it comes to importing IPv6 prefix, it must be slash 48 or larger.

And after the process is successful, you can manage IP addresses through IP pools. And remember this is just
for IPv4 addresses. So let's talk about the benefits of bring your own IP. The first benefit is if you have IP add
ress hard
coded in devices or built architectural dependencies on specific IP addresses, using bring your own IP, you ha
ve a smooth migration to Oracle Cloud Infrastructure. So in a way, it brings solution continuity.

It also provides the ability to summarize groups of IPv4 addresses into pools and to create resources for depl
oyment, such as load balancers. Some internet services also rely on a contiguous IP address space, and henc
e, it also provides benefits like IP reputation. Now, let's look at the workflow. Although I have explained you
in the whiteboarding, let's quickly go through it one more time. The first step is you request to import a publ
ic IPv4 CIDR block or IPv6 prefix that you own.

In the second step, Oracle is going to issue a verification token. Now, you need to add the verification token t
o the information about the public IPv4 CIDR block or IPv6 prefix that is kept by your regional internet regist
ry service. And this process can take up to one day. You also need to create a route origin authorization, whic
h is also known as ROA, with your Regional Internet Registry or RIR.

As a part of the ROA, you need to provide the Oracle BGP ASN, and the ROA allows Oracle to advertise the b
ring your own IP CIDR block. Now you have to request that Oracle finish the import request. And this workfl
ow can take up to 10 business days to complete. And Oracle is going to communicate with the RIR, and it is g
oing to verify that you own the IP address. After that, Oracle is going to provision the bring your own IP addr
esses to your compartment within your tenancy.

At this point, the bring your own IP IPv4 CIDR block and IPv6 prefix is yours to manage in your compartment.
You can also advertise the IP address blocks or prefixes to the internet. So this is the workflow for bring your
own IP. I hope you understood the workflow for bringing your own IP to Oracle Cloud Infrastructure. Thanks
for your time.

===

Public IP Pools

Welcome to this lesson on public IP pools. Let's get started. Let's say this is your "bring your own IP" CIDR bl
ock. Now, what you want to do, you want to create a public IP pool. So what is a public IP pool?
It is nothing but it is a set of IPv4 CIDR blocks. And what is so special about this public IP pool? Because it is a
llocated to a tenancy. So it is allocated to a tenancy.

And it can be a part "bring your own IP" CIDR block. Or it might be the entire "bring your own IP" CIDR block
. When I say "allocated to a tenancy," it basically means that it is available only for your tenancy.

In case you want to use public IP pool, the first thing that you need to do is you need to import your address
es. And what is the benefit of adding IP CIDR blocks to a public IP pool? The benefit is you can create a reser
vation. So you can create a reserved public IP.

And what will you do with this reserved public IP? You can attach it to your resources-- so resources like NAT
gateway. It can be load balancer. Or it can be compute instances. So you can create a reserved IP.

The second option you have is you can enable direct launch from pool. So instead of reserving IP for a partic
ular resource like NAT gateway, you can launch resources with an IP. And that is going to be directly allocate
d from a public IP pool. So that is also possible. So you can create a reserved IP and then attach to your reso
urces. Or you can directly launch from the pool.

So let's look at the deck. And one thing to note here is that currently, it is a set of IPv4 CIDR blocks that is all
ocated to a tenancy and IPv6 addresses that do not use the IP pools functionality. So it's a set of IPv4 CIDR bl
ocks that is allocated to a tenancy. And when I say "allocated to a tenancy," it means that it is available for y
our tenancy only.

So first of all, you need to bring your own IP address. And then you can create a public IP pool. You can make
the entire "bring your own IP" CIDR block the part of the public IP pool, or it can be even a part of it.

The best part about this, just to reinforce, it is only available for your tenancy. And then I mentioned there ar
e two choices. The first choice is you can create a reserved IP from your public IP pool. And then that reserve
d IP can be attached to your resources.

The second option is you can directly launch from the pool. That means you don't need to create any reserve
d IP. Directly launch resources. And the IP is going to be directly allocated from a public IP pool. And that is
what I mentioned.

There are some limits and quotas, as you can see in the slide. When you create a public IP pool, it can have z
ero or more IP CIDR ranges. And the minimum size range is going to be /28. And the maximum size is going t
o be /24. So with this, we wrap up this lesson on public IP pools. Thanks for watching.

===

Demo: IP Management

Hello, and welcome to this demonstration on IP management. So let's get started. I'll take you to the OCI conso
le. And first, I'll take you to the compute service to compute instances. I already have a VM that is running.
You can see that OCI-AA instance. So I'll click on it. If you scroll down, under primary VNIC, you will see that thi
s has a public IPv4 address and a private IPv4 address. So I'll scroll down. And under Resources, I'll go to attach
ed VNICs. And here you see that there is the primary VNIC that we discussed in the lesson.

This is the primary VNIC and the state is attached. So I'll click on the primary VNIC that will take me to the prim
ary VNIC page. So here you will have all the information related to VNIC. If I scroll down under Resources, click
on IPv4 addresses, here what you see is the primary private IP address for this VNIC.

You also have the option to assign secondary private IP addresses. So if I click here, here you can specify the IP
address. Even if you don't specify, then Oracle is going to assign one for you. And this is where you do the map
ping of the private IP and the public IP.

So if I don't specify anything and click on Assign, let's see what happens. You see, this is the secondary private I
P address that has been created for this primary VNIC. This is the primary VNIC. And you see that the public ad
dress corresponding to this private address is currently not assigned. For the primary IP, there is a public IP add
ress, which is ephemeral in nature.

So if I click here, I can edit it. And if I want to have a public IP type, I can just click on reserved and I can create a
new reserved IP address. And we can specify the type as Oracle and I can give it a name. I can update it.

So this way, now you see that, first of all, we are inside the primary VNIC. In the primary VNIC, there is one pri
mary private IP address, and then there is one secondary private IP address. And you also see that this public a
ddress is ephemeral. This one is reserved.

So now I will take you to this navigation menu. Click on Networking. And you see there is something called IP m
anagement. So click on IP Management. Under IP management, you will be able to see all the services that we
covered in the lesson. For example, the concept of reserved public IP address, and how is it different from eph
emeral IP addresses.

So if I click on reserved public IP. So this is the same IP that we reserved a couple of minutes back. How do we r
eserve public IP address? So let me call it test reserve public. And you need to define an IP address source. As o
f now, we have just one source, which is Oracle. So I'll click on Oracle and I'll click on reserve public IP address.

So now you see that this reservation is done, and this is the public IP address. Now what can we do with this p
ublic IP address? Let's say I want to create an ad gateway. So I'll go to the VCN, I'll go to demo VCN. If I go to NA
T gateway, create NAT gateway.

Here there is an option to select ephemeral or reserved public IP address. So I'll click on reserved public IP addr
ess and I will select existing reserved IP address. And this is what I will select. Test result public IP. Click on Crea
te NAT gateway. All right. So I have shown you how you can create a reserved public IP address and use it while
creating NAT gateway.

Now returning back to the IP management, so I've shown you this reserved public address. And you see the sta
te as assigned. If you click and create another reserved public IP, you select Oracle as the IP address source. An
d you can also see the difference in the state.
This says available. But these two say it's assigned. Assigned means it is associated with a resource. This one is
associated with the VNIC or the instance. And this one is associated with the NAT gateway. So this is how you c
an work with your reserved public IPs.

Now there is another concept of bring your own IP that we discussed and we also talked about the flow. Just to
show you how it looks like. Click on Import bring your own IP CIDR block or prefix. Here, you need to give it a n
ame.

This is the compartment. And this is where you need to provide your CIDR block. Just as a sake of demonstratio
n, I am not the owner of this public address. But just to show you the process. I provide the IP CIDR IPv4 CIDR b
lock and I click on Import bring your own IP CIDR block.

Now what happens next is it would go to a state of creating? If I click here, you will be able to see the validatio
n token as I mentioned in the lesson. And you need to register this token with your RIR, which is Regional Inter
net Registry.

So after you register your token with the RIR, then need to do is you need to click on Finish Import. So after yo
u register your token, and you can also follow the steps in this particular documentation. Let me quickly show y
ou.

So this documentation talks about the entire process. For example, import bring your own IP CIDR block. You e
nter the IPv4 CIDR block, and then it basically generates you with a token. And then you also need to create a r
oute origin authorization object that authorizes Oracle to advertise your CIDR block.

What are the steps to create the route origin authorization, depending on the RIR? So you can have a look at th
at. After completing all these steps, you have to click on Finish Import. You see there is an option finish import.
But this should be completed only after you complete these previous steps.

After the validation is done, you have an option to advertise the CIDR ranges. So this is how bring your own IP l
ooks like. And returning back to the IP management, there is one thing that I have not shown you till now, whic
h is public IP pools. So let me click on Public IP Pool. Let me click on Create Public Pool.

This is a feature that will work only after you bring your own IP. So after you bring your own IP, you need to cre
ate a public IP pool. Let me click on Create public IP pool. If I go inside the public IP pool, as I don't have a bring
your own IP CIDR block, so it is showing empty.

Once you have the CIDR block, then you can go ahead and you can reserve public IP addresses. So this gives yo
u a message that this public IP pool does not have an associated CIDR block. And from where will the CIDR bloc
k come? When you bring your own IP. You can use the portion of it or you can use the entire CIDR block to crea
te the public IP pool.

One last thing that I will show you is if I go back to reserved public IP address. Now here under IP address sourc
e, you should be able to see two because we created a public IP pool as well, right? As of now, it is not associat
ed with a CIDR. But as you bring your own IP CIDR, then you can basically select this IP address source and you
can reserve a public IP address. All right, this marks the end of this demonstration. Thanks for watching.