FastConnect or VPN?
| Site-to-Site VPN | FastConnect | |
|---|---|---|
| Path | Internet, IPSec encrypted | Private connection via partner, provider or colocation |
| Bandwidth | Limited by tunnels and internet | Port speeds from 1 Gbps upward (by location) |
| Latency | Variable | Consistent |
| Lead time | Hours | Weeks |
| Cost model | Free service; internet egress applies | Port-hour charges; no per-GB charge on FastConnect itself |
| Encryption | Built in | Not by default; IPSec over FastConnect or MACsec (where supported) |
Typical: FastConnect primary for production, VPN as backup and for small sites.
Redundancy models
| Model | Design |
|---|---|
| Basic | One FastConnect virtual circuit, or one VPN connection (two tunnels) |
| Recommended for production | Two FastConnect connections via different locations/providers/edge devices |
| Cost-aware production | FastConnect primary + VPN backup (lower backup bandwidth) |
| Critical | Two FastConnect at diverse locations + VPN as a third path |
Each OCI VPN connection has two tunnels. Terminate them on two different on-prem devices if possible.
DRG and routing
On-prem ──FastConnect VC──┐
On-prem ──IPSec (backup)──┼── DRG ── VCN attachments (hub VCN with Network Firewall, spokes)
└── Remote peering connection ── DRG in DR region
- Use DRG route tables and import distributions to control which routes reach which attachments.
- BGP: prefer FastConnect over VPN (AS path prepend on the VPN routes from on-prem; OCI prefers more specific routes and has documented path preference rules). Document the expected path for each prefix.
- Summarise on-prem prefixes; avoid overlapping CIDRs with VCNs. Plan IP space before the first circuit.
Encryption
If compliance requires encryption across the provider network: IPSec over FastConnect (private IP) or MACsec on supported colocation ports. Keep TLS at the application layer regardless.
DNS
Hybrid DNS via private DNS resolver listeners/forwarders: on-prem forwards OCI zones to the resolver listening endpoint; OCI forwards on-prem zones to on-prem DNS.
Multicloud
For Azure or Google Cloud apps talking to OCI services, the Oracle Interconnect for Azure / Google Cloud (in supported region pairs) offers private, low-latency links. Database@Azure/AWS/Google avoid the interconnect for databases by running them inside the other cloud's data centres.
Monitoring and testing
- Metrics: FastConnect virtual circuit state and throughput, VPN tunnel state, BGP session state.
- Alarms on state changes and utilisation > 70%.
- Failover test at least yearly: shut a circuit's BGP session from on-prem during a maintenance window and measure convergence time and application impact.
Design review questions
- What's the business impact of losing hybrid connectivity for an hour?
- Do the two paths share any building, provider, device or power?
- Can the backup path carry production traffic, and what degrades if it can't?
- When was failover last tested?
Warning
Two virtual circuits on the same physical connection or provider edge are not redundant. Diversity at the physical layer is what protects you.
Checklist
- FastConnect vs VPN chosen
- Redundancy model matched to business impact
- DRG route tables and BGP preferences designed and documented
- Non-overlapping IP plan
- Encryption decision recorded
- Hybrid DNS, monitoring and failover tests in place