{"id":939,"date":"2026-04-17T05:12:05","date_gmt":"2026-04-17T05:12:05","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/oracle-cloud-oracle-interconnect-for-azure-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-multicloud\/"},"modified":"2026-04-17T05:12:05","modified_gmt":"2026-04-17T05:12:05","slug":"oracle-cloud-oracle-interconnect-for-azure-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-multicloud","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/oracle-cloud-oracle-interconnect-for-azure-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-multicloud\/","title":{"rendered":"Oracle Cloud Oracle Interconnect for Azure Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for Multicloud"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>Multicloud<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What this service is<\/h3>\n\n\n\n<p>Oracle Interconnect for Azure is a multicloud networking service that provides private, high-bandwidth, low-latency connectivity between Oracle Cloud Infrastructure (OCI) and Microsoft Azure in supported paired regions.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">One-paragraph simple explanation<\/h3>\n\n\n\n<p>If you run some workloads in Azure and others in Oracle Cloud, Oracle Interconnect for Azure lets those networks talk to each other over a private connection instead of the public internet\u2014typically for better performance, more predictable latency, and simpler security controls than an internet VPN.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">One-paragraph technical explanation<\/h3>\n\n\n\n<p>Oracle Interconnect for Azure is built on dedicated interconnect capacity between OCI and Azure in specific colocated metros\/regions, and uses private routing (BGP) to exchange routes between an OCI Dynamic Routing Gateway (DRG) and an Azure ExpressRoute-connected virtual network (VNet). Operationally, it is commonly implemented using OCI FastConnect and Azure ExpressRoute primitives, with provider-managed physical connectivity and customer-managed logical networking (VCNs\/VNets, route tables, BGP parameters, and security rules).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What problem it solves<\/h3>\n\n\n\n<p>It solves the core multicloud problem of <strong>secure, high-performance, private network connectivity<\/strong> between Azure and Oracle Cloud so that applications can span both clouds without relying on public endpoints, brittle NAT patterns, or latency-sensitive internet tunnels.<\/p>\n\n\n\n<blockquote>\n<p>Naming note (verify in official docs): Oracle\u2019s official documentation often refers to this offering as <strong>Oracle Interconnect for Microsoft Azure<\/strong>. This tutorial uses <strong>Oracle Interconnect for Azure<\/strong> as the primary name, as requested, and aligns terminology to current OCI networking concepts. Always confirm the latest naming and console locations in the official docs linked later.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is Oracle Interconnect for Azure?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Official purpose<\/h3>\n\n\n\n<p>Oracle Interconnect for Azure is intended to provide <strong>private network connectivity<\/strong> between OCI and Azure, enabling customers to deploy distributed applications, data platforms, and shared services across both clouds with consistent routing and enterprise network controls.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Core capabilities<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Private L3 routing between OCI and Azure<\/strong> using BGP.<\/li>\n<li><strong>High bandwidth and lower latency<\/strong> than internet-based VPN for supported region pairs.<\/li>\n<li><strong>Redundancy<\/strong> through dual connections (design varies by region\/implementation; verify specifics per region).<\/li>\n<li><strong>Integration with OCI networking<\/strong> (VCN, DRG, route tables, security lists\/NSGs, Network Firewall) and Azure networking (VNet, ExpressRoute, Virtual Network Gateway, NSGs, Azure Firewall).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Major components (conceptual)<\/h3>\n\n\n\n<p><strong>On Oracle Cloud (OCI):<\/strong>\n&#8211; <strong>VCN (Virtual Cloud Network)<\/strong>: Your OCI network address space.\n&#8211; <strong>Subnets<\/strong>: Where OCI workloads run.\n&#8211; <strong>DRG (Dynamic Routing Gateway)<\/strong>: The edge router that connects your VCN to external networks (including interconnect).\n&#8211; <strong>FastConnect (commonly involved)<\/strong>: OCI\u2019s private connectivity service used as a building block for private circuits.<\/p>\n\n\n\n<p><strong>On Microsoft Azure:<\/strong>\n&#8211; <strong>VNet (Virtual Network)<\/strong>: Your Azure network address space.\n&#8211; <strong>Virtual Network Gateway<\/strong> (ExpressRoute gateway): Enables ExpressRoute connectivity to VNets.\n&#8211; <strong>ExpressRoute circuit<\/strong>: Azure\u2019s private circuit object used to connect to a provider.\n&#8211; <strong>Private peering<\/strong>: The routing configuration that enables VNet connectivity.<\/p>\n\n\n\n<p><strong>Provider-managed interconnect layer:<\/strong>\n&#8211; Dedicated connectivity between OCI and Azure in supported metros\/regions, with cross-cloud operational handshakes (service keys \/ authorization tokens depending on workflow).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Service type<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Networking \/ connectivity service<\/strong> (multicloud interconnect).<\/li>\n<li>Primarily <strong>regional and pair-specific<\/strong> (available only for certain OCI region \u2194 Azure region pairs). It is not a \u201cglobal any-to-any\u201d mesh by default.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scope model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI tenancy-scoped<\/strong> resources (VCNs, DRGs, FastConnect virtual circuits).<\/li>\n<li><strong>Azure subscription-scoped<\/strong> resources (ExpressRoute circuits, VNets, gateways).<\/li>\n<li>The interconnect is typically configured per <strong>region pair<\/strong>, then attached to specific VCNs\/VNets through routing.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How it fits into the Oracle Cloud ecosystem<\/h3>\n\n\n\n<p>Oracle Interconnect for Azure is one of OCI\u2019s key <strong>Multicloud<\/strong> building blocks alongside:\n&#8211; <strong>OCI FastConnect<\/strong> (private connectivity)\n&#8211; <strong>Site-to-Site VPN<\/strong> (encrypted tunnels over internet)\n&#8211; <strong>OCI Load Balancing<\/strong>, <strong>API Gateway<\/strong>, <strong>WAF<\/strong>, <strong>Network Firewall<\/strong>\n&#8211; <strong>DNS<\/strong> and <strong>Traffic Management<\/strong> patterns for multicloud name resolution\n&#8211; Reference architectures for running split-tier apps across clouds (for example: app tier in Azure, database tier in Oracle Cloud\u2014verify current official architectures)<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use Oracle Interconnect for Azure?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Adopt multicloud intentionally<\/strong>: keep existing Azure investments while using Oracle Cloud for workloads that benefit from OCI services, licensing, or performance characteristics.<\/li>\n<li><strong>Reduce integration friction<\/strong> for teams that need consistent connectivity between cloud environments.<\/li>\n<li><strong>Support M&amp;A \/ organizational boundaries<\/strong> where different business units standardize on different clouds.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Predictable connectivity<\/strong> compared to internet paths (lower jitter, better throughput).<\/li>\n<li><strong>Private routing<\/strong> reduces the need for public endpoints and complex NAT chains.<\/li>\n<li><strong>Supports hybrid architectures<\/strong> where services in one cloud call databases or APIs in the other.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Standard enterprise routing model (BGP route exchange).<\/li>\n<li>Clear separation of concerns:<\/li>\n<li>Cloud providers manage physical connectivity.<\/li>\n<li>You manage logical routing, segmentation, and security rules.<\/li>\n<li>Often easier to integrate into centralized network operations (NOC\/SRE) than a web of ad-hoc tunnels.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Keeps service-to-service traffic off the public internet.<\/li>\n<li>Enables better network segmentation and policy enforcement.<\/li>\n<li>Supports compliance narratives that require private connectivity patterns (always validate with your compliance team and provider documentation).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability\/performance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Interconnect bandwidth options (varies by region and offering details; verify in official docs).<\/li>\n<li>Reduced latency for supported paired regions (because they are typically colocated or metro-adjacent).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose it<\/h3>\n\n\n\n<p>Choose Oracle Interconnect for Azure when:\n&#8211; You need <strong>private, high-throughput<\/strong> connectivity between Azure and OCI.\n&#8211; Your workloads are in <strong>supported paired regions<\/strong>.\n&#8211; You can justify <strong>ExpressRoute\/FastConnect-related costs<\/strong> versus VPN.\n&#8211; You want <strong>enterprise-grade routing<\/strong> and the ability to scale traffic reliably.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When they should not choose it<\/h3>\n\n\n\n<p>Avoid (or reconsider) Oracle Interconnect for Azure when:\n&#8211; Your OCI region and Azure region are <strong>not supported as a pair<\/strong>.\n&#8211; Your traffic is low-volume and you can tolerate higher latency \u2192 <strong>Site-to-Site VPN<\/strong> may be cheaper.\n&#8211; You need encrypted transport by default and cannot add encryption at higher layers (interconnect provides private connectivity; encryption is usually handled at TLS\/IPsec layers\u2014verify your requirements).\n&#8211; You need quick, disposable dev\/test connectivity without procurement lead time.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is Oracle Interconnect for Azure used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Financial services (latency-sensitive services, risk controls)<\/li>\n<li>Retail\/e-commerce (distributed app stacks, analytics)<\/li>\n<li>Healthcare (regulated workloads with private networking requirements)<\/li>\n<li>Manufacturing\/IoT (data ingestion in one cloud, analytics in another)<\/li>\n<li>SaaS providers (tenant workloads distributed across clouds)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Platform engineering and cloud networking teams<\/li>\n<li>DevOps\/SRE teams operating cross-cloud application platforms<\/li>\n<li>Security engineering teams implementing segmentation and policy controls<\/li>\n<li>Data engineering teams moving data between clouds<\/li>\n<li>Enterprise architecture teams establishing multicloud guardrails<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Split-tier enterprise apps (web\/API tier in Azure, database tier in Oracle Cloud)<\/li>\n<li>Analytics platforms spanning clouds<\/li>\n<li>Shared services (identity, logging, monitoring collectors)<\/li>\n<li>Backup\/DR replication pipelines (when supported and architecturally appropriate)<\/li>\n<li>Service mesh and microservices calling cross-cloud dependencies (careful with latency)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Architectures<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Hub-and-spoke with centralized inspection (firewalls) on one or both clouds<\/li>\n<li>Dual-hub (each cloud has its own hub; interconnect connects hubs)<\/li>\n<li>\u201cApp in Azure, data in OCI\u201d with private connectivity<\/li>\n<li>Shared CI\/CD and artifact distribution across clouds<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Real-world deployment contexts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Production: common for latency-sensitive, high-throughput workloads.<\/li>\n<li>Dev\/test: used when dev\/test must mirror production routing and security controls; otherwise VPN is often simpler and cheaper.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are realistic scenarios where Oracle Interconnect for Azure is commonly a good fit.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Private app-to-database connectivity (Azure apps \u2192 OCI databases)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Application tier in Azure needs low-latency, private access to databases in Oracle Cloud.<\/li>\n<li><strong>Why this service fits:<\/strong> Provides private routing and predictable performance across clouds.<\/li>\n<li><strong>Example:<\/strong> AKS-hosted APIs in Azure call an Oracle DB system in OCI over private IPs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Data analytics split across clouds<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Data is generated\/ingested in Azure, but analytics tools or data warehouses run in OCI.<\/li>\n<li><strong>Why this service fits:<\/strong> High-throughput, consistent connectivity improves ETL\/ELT reliability.<\/li>\n<li><strong>Example:<\/strong> Azure Data Factory pipelines load data into OCI analytics services over private connectivity.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) Shared identity and directory services across clouds<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Centralized identity services must be reachable from both clouds without exposing endpoints publicly.<\/li>\n<li><strong>Why this service fits:<\/strong> Private connectivity reduces attack surface and simplifies network ACLing.<\/li>\n<li><strong>Example:<\/strong> Azure-hosted identity components connect to private services running in OCI.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) Centralized security inspection (east-west traffic inspection)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Need a consistent inspection point for cross-cloud traffic.<\/li>\n<li><strong>Why this service fits:<\/strong> Enables hub-and-spoke routing with firewall insertion.<\/li>\n<li><strong>Example:<\/strong> All Azure\u2192OCI traffic is routed through an OCI Network Firewall (or Azure Firewall) before reaching workloads.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Migration with minimal downtime (phased cutover)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Gradual migration requires both environments live and connected.<\/li>\n<li><strong>Why this service fits:<\/strong> Stable connectivity supports replication and dual-write patterns.<\/li>\n<li><strong>Example:<\/strong> Move app tier to Azure first while databases remain in OCI until final cutover.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Cross-cloud Kubernetes service dependencies<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Microservices in AKS need to call services in OCI (or vice versa).<\/li>\n<li><strong>Why this service fits:<\/strong> Private, routed connectivity enables service calls without public ingress.<\/li>\n<li><strong>Example:<\/strong> AKS services call an OCI-hosted internal API gateway privately.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Centralized logging\/monitoring collectors<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Log collectors in one cloud must receive telemetry from the other cloud privately.<\/li>\n<li><strong>Why this service fits:<\/strong> Predictable transport reduces dropped logs and improves MTTR.<\/li>\n<li><strong>Example:<\/strong> OCI-hosted SIEM collectors ingest Azure workload logs over private paths.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) Batch processing and compute burst<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Workloads mostly run in Azure but require periodic compute or specialized services in OCI.<\/li>\n<li><strong>Why this service fits:<\/strong> Private connectivity makes cross-cloud calls and data staging more reliable.<\/li>\n<li><strong>Example:<\/strong> Azure triggers OCI batch compute jobs, sending input data privately.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Private API consumption across clouds<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Internal APIs should not be publicly exposed, but must be consumed cross-cloud.<\/li>\n<li><strong>Why this service fits:<\/strong> Enables \u201cinternal-only\u201d APIs across clouds using private IP routing.<\/li>\n<li><strong>Example:<\/strong> Azure Functions call OCI internal APIs over interconnect.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) Business continuity \/ DR between clouds (select components)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Need cross-cloud DR connectivity for specific tiers (not necessarily full active-active).<\/li>\n<li><strong>Why this service fits:<\/strong> Private connectivity simplifies replication pipelines and failover testing.<\/li>\n<li><strong>Example:<\/strong> Replicate data from OCI to Azure storage for DR (ensure architecture and provider support; verify details).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<blockquote>\n<p>Feature availability and exact workflows can vary by region pair and by evolving provider integration. Confirm details in official docs before implementing in production.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Private connectivity between OCI and Azure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Provides private IP connectivity for cross-cloud traffic.<\/li>\n<li><strong>Why it matters:<\/strong> Reduces exposure to internet threats and avoids public IP management.<\/li>\n<li><strong>Practical benefit:<\/strong> You can keep services \u201cinternal-only\u201d and still communicate cross-cloud.<\/li>\n<li><strong>Caveat:<\/strong> \u201cPrivate\u201d does not automatically mean \u201cencrypted.\u201d Use TLS at the application layer; consider IPsec overlays if required.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">High bandwidth and lower latency (compared to internet VPN)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Supports higher throughput and typically more consistent latency.<\/li>\n<li><strong>Why it matters:<\/strong> Improves performance for database calls, replication, and service-to-service traffic.<\/li>\n<li><strong>Practical benefit:<\/strong> Better user experience and fewer timeout-related incidents.<\/li>\n<li><strong>Caveat:<\/strong> Actual performance depends on region pairing, bandwidth selection, and your architecture.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">BGP-based dynamic routing<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Exchanges routes dynamically between OCI and Azure.<\/li>\n<li><strong>Why it matters:<\/strong> Simplifies route management and failover compared to static routes.<\/li>\n<li><strong>Practical benefit:<\/strong> Easier scaling as networks grow.<\/li>\n<li><strong>Caveat:<\/strong> Requires careful route design to avoid overlaps and asymmetric routing.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Redundancy \/ resiliency design<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Typically provides redundant connectivity paths (implementation details vary).<\/li>\n<li><strong>Why it matters:<\/strong> Prevents single-link failures from taking down cross-cloud connectivity.<\/li>\n<li><strong>Practical benefit:<\/strong> Better uptime for multicloud architectures.<\/li>\n<li><strong>Caveat:<\/strong> You must also design redundancy in gateways, route tables, and security policy.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Integration with OCI DRG and VCN routing<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Allows VCN subnets to reach Azure VNets via DRG.<\/li>\n<li><strong>Why it matters:<\/strong> DRG is the routing hub for OCI connectivity patterns.<\/li>\n<li><strong>Practical benefit:<\/strong> Enables hub-and-spoke designs and shared services VCNs.<\/li>\n<li><strong>Caveat:<\/strong> DRG route tables and attachments must be configured correctly; misconfiguration is a common outage cause.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Integration with Azure ExpressRoute and VNet gateways<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Lets Azure VNets route to OCI via ExpressRoute connectivity.<\/li>\n<li><strong>Why it matters:<\/strong> ExpressRoute is the enterprise standard private connectivity primitive in Azure.<\/li>\n<li><strong>Practical benefit:<\/strong> Works with Azure network security controls, private DNS patterns, and enterprise VNets.<\/li>\n<li><strong>Caveat:<\/strong> ExpressRoute gateways have SKU, throughput, and zone redundancy considerations\u2014verify in Azure docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Route segmentation and policy control (with your network constructs)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Enables you to control which CIDRs are advertised\/accepted, and which subnets can reach cross-cloud destinations.<\/li>\n<li><strong>Why it matters:<\/strong> Prevents accidental overexposure across clouds.<\/li>\n<li><strong>Practical benefit:<\/strong> Principle of least privilege at the network layer.<\/li>\n<li><strong>Caveat:<\/strong> Overly broad route propagation can create \u201caccidental flat networks.\u201d<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Observability hooks via cloud-native monitoring<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> You can observe circuit health and throughput via OCI and Azure metrics\/logs.<\/li>\n<li><strong>Why it matters:<\/strong> Cross-cloud outages are hard; metrics shorten time to root cause.<\/li>\n<li><strong>Practical benefit:<\/strong> Alert on circuit down, BGP down, bandwidth saturation.<\/li>\n<li><strong>Caveat:<\/strong> You must build dashboards and alerts; they are not \u201cautomatic.\u201d<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">High-level service architecture<\/h3>\n\n\n\n<p>At a high level:\n1. You create OCI and Azure network domains (VCN\/VNet).\n2. You establish an interconnect connection using Oracle Interconnect for Azure (implemented through OCI FastConnect + Azure ExpressRoute patterns).\n3. You attach the interconnect to:\n   &#8211; <strong>OCI DRG<\/strong> (connected to one or more VCNs)\n   &#8211; <strong>Azure ExpressRoute gateway<\/strong> (connected to one or more VNets)\n4. BGP advertises routes in both directions.\n5. Workloads communicate using private IP addresses with security policies enforced by NSGs\/NSGs + firewalls.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Request\/data\/control flow<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control plane:<\/strong><\/li>\n<li>Provision interconnect resources (OCI console\/CLI + Azure portal\/ARM).<\/li>\n<li>Exchange authorization\/service keys as required.<\/li>\n<li>Configure BGP parameters, route filters\/policies, attachments.<\/li>\n<li><strong>Data plane:<\/strong><\/li>\n<li>Packets flow VCN subnet \u2192 OCI route table \u2192 DRG \u2192 interconnect \u2192 ExpressRoute \u2192 Azure gateway \u2192 VNet subnet.<\/li>\n<li>Reverse direction similarly.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Integrations with related services<\/h3>\n\n\n\n<p><strong>OCI-side:<\/strong>\n&#8211; <strong>VCN<\/strong>, <strong>Subnets<\/strong>, <strong>NSGs\/Security Lists<\/strong>\n&#8211; <strong>DRG<\/strong> route tables and route distribution\n&#8211; <strong>FastConnect<\/strong> (virtual circuits, where applicable)\n&#8211; <strong>OCI Network Firewall<\/strong> (optional inspection)\n&#8211; <strong>OCI Bastion<\/strong> (admin access without public IPs)\n&#8211; <strong>OCI DNS<\/strong> \/ private DNS resolvers (optional; verify capabilities)<\/p>\n\n\n\n<p><strong>Azure-side:<\/strong>\n&#8211; <strong>ExpressRoute<\/strong> circuit and peering\n&#8211; <strong>Virtual Network Gateway<\/strong> for ExpressRoute\n&#8211; <strong>NSGs<\/strong>, <strong>Azure Firewall<\/strong> (optional inspection)\n&#8211; <strong>Azure Private DNS<\/strong> (optional)\n&#8211; <strong>Azure Bastion<\/strong> (admin access without public IPs)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Dependency services (typical)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI IAM for permissions<\/li>\n<li>Azure Entra ID (Azure AD) and Azure RBAC for permissions<\/li>\n<li>Regional availability of the interconnect pairing<\/li>\n<li>VCN\/VNet gateway infrastructure (DRG and ExpressRoute gateway)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/authentication model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI IAM<\/strong> policies control who can create\/modify networking resources (VCN\/DRG\/FastConnect\/interconnect objects).<\/li>\n<li><strong>Azure RBAC<\/strong> controls ExpressRoute and VNet gateway changes.<\/li>\n<li>BGP session authentication (MD5) may be available depending on implementation (verify in official docs).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Networking model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Route-based, private IP connectivity.<\/li>\n<li>Requires:<\/li>\n<li><strong>Non-overlapping CIDR ranges<\/strong> between OCI and Azure (strongly recommended; overlapping can break routing).<\/li>\n<li>Correct route table entries (OCI VCN route tables toward DRG; Azure route propagation via gateway).<\/li>\n<li>Correct security rules (allow traffic between CIDRs, required ports).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Monitoring\/logging\/governance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Track:<\/li>\n<li>Circuit state (provisioning, active)<\/li>\n<li>BGP status (up\/down)<\/li>\n<li>Throughput (bps), packets, drops<\/li>\n<li>Route changes (audited changes)<\/li>\n<li>Governance:<\/li>\n<li>Tag resources (OCI defined\/freeform tags; Azure tags)<\/li>\n<li>Apply naming conventions<\/li>\n<li>Use change management for route updates<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Simple architecture diagram (Mermaid)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  subgraph Azure[\"Microsoft Azure (Region A)\"]\n    VNet[\"VNet (10.20.0.0\/16)\"]\n    GW[\"ExpressRoute Gateway\"]\n    VM_AZ[\"VM \/ App\"]\n    VM_AZ --- VNet\n    VNet --- GW\n  end\n\n  subgraph Interconnect[\"Oracle Interconnect for Azure (Private Connectivity)\"]\n    LINK[\"Provider-managed private links\"]\n  end\n\n  subgraph OCI[\"Oracle Cloud (OCI Region A)\"]\n    VCN[\"VCN (10.10.0.0\/16)\"]\n    DRG[\"Dynamic Routing Gateway (DRG)\"]\n    VM_OCI[\"VM \/ DB \/ Service\"]\n    VM_OCI --- VCN\n    VCN --- DRG\n  end\n\n  GW --- LINK --- DRG\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Production-style architecture diagram (Mermaid)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  subgraph Azure[\"Azure (Paired Region)\"]\n    subgraph AZ_Hub[\"Hub VNet\"]\n      AZ_FW[\"Azure Firewall (optional)\"]\n      AZ_ER_GW[\"ExpressRoute Gateway (zone-redundant if available)\"]\n      AZ_DNS[\"Private DNS (optional)\"]\n    end\n\n    subgraph AZ_Spoke1[\"Spoke VNet: App\"]\n      AZ_APP[\"App Subnet (AKS\/VMSS\/VMs)\"]\n      AZ_NSG[\"NSGs\"]\n    end\n\n    AZ_APP --- AZ_NSG\n    AZ_Spoke1 --&gt;|VNet Peering| AZ_Hub\n    AZ_Hub --&gt; AZ_ER_GW\n    AZ_Hub --&gt; AZ_FW\n  end\n\n  subgraph Interconnect[\"Oracle Interconnect for Azure\"]\n    LINK1[\"Primary link\"]\n    LINK2[\"Secondary link\"]\n  end\n\n  subgraph OCI[\"OCI (Paired Region)\"]\n    subgraph OCI_Hub[\"Hub VCN\"]\n      DRG[\"DRG (route tables + distributions)\"]\n      OCI_FW[\"OCI Network Firewall (optional)\"]\n      OCI_DNS[\"Private DNS resolver (optional)\"]\n    end\n\n    subgraph OCI_Spoke1[\"Spoke VCN: Data\"]\n      OCI_DB[\"DB \/ Data Subnet\"]\n      OCI_NSG[\"NSGs\"]\n    end\n\n    OCI_DB --- OCI_NSG\n    OCI_Spoke1 --&gt;|LPG\/DRG attachments (pattern-dependent)| OCI_Hub\n    DRG --&gt; OCI_FW\n  end\n\n  AZ_ER_GW --- LINK1 --- DRG\n  AZ_ER_GW --- LINK2 --- DRG\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Accounts\/tenancies\/subscriptions<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An <strong>OCI tenancy<\/strong> with permissions to create\/modify:<\/li>\n<li>VCNs, subnets, route tables, security lists\/NSGs<\/li>\n<li>DRGs and attachments<\/li>\n<li>FastConnect \/ interconnect-related resources (where applicable)<\/li>\n<li>An <strong>Azure subscription<\/strong> with permissions to create\/modify:<\/li>\n<li>ExpressRoute circuits and peerings<\/li>\n<li>Virtual Network Gateway (ExpressRoute)<\/li>\n<li>VNets, subnets, NSGs<\/li>\n<li>Billing enabled in both clouds.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Permissions \/ IAM roles<\/h3>\n\n\n\n<p><strong>OCI IAM (examples; adapt to your compartment model):<\/strong>\n&#8211; Permissions to manage networking in the target compartment(s).\n&#8211; Permissions to manage DRG and FastConnect\/interconnect resources.<\/p>\n\n\n\n<p><strong>Azure RBAC:<\/strong>\n&#8211; Network Contributor (or more restricted custom role) on:\n  &#8211; Resource group containing VNets\/gateways\n  &#8211; ExpressRoute resources<\/p>\n\n\n\n<blockquote>\n<p>Verify exact OCI policy statements and Azure roles with your org\u2019s security team and the latest OCI\/Azure documentation.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Tools<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI Console and Azure Portal access<\/li>\n<li>Optional but strongly recommended:<\/li>\n<li>OCI CLI: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/API\/SDKDocs\/cliinstall.htm<\/li>\n<li>Azure CLI: https:\/\/learn.microsoft.com\/cli\/azure\/install-azure-cli<\/li>\n<li>SSH client for Linux VM access<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Region availability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Oracle Interconnect for Azure is available only in <strong>specific paired OCI and Azure regions<\/strong> (often same metro).<\/li>\n<li>Confirm supported region pairs in official docs before designing your network.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas\/limits (examples to check)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Azure: ExpressRoute gateway limits, ExpressRoute circuits per subscription, gateway throughput\/SKU constraints<\/li>\n<li>OCI: DRG attachment limits, FastConnect virtual circuit limits, route rule limits<\/li>\n<li>Some limits are soft and can be increased via support request.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisite services<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI: VCN + DRG<\/li>\n<li>Azure: VNet + ExpressRoute gateway (requires a <strong>GatewaySubnet<\/strong>)<\/li>\n<li>A plan for IP address management (non-overlapping CIDRs)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<p>Oracle Interconnect for Azure is a multicloud connectivity pattern where costs typically come from <strong>both<\/strong> providers and from data transfer.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing dimensions (high-level)<\/h3>\n\n\n\n<p><strong>On Oracle Cloud (OCI), costs may include:<\/strong>\n&#8211; <strong>FastConnect port \/ virtual circuit charges<\/strong> (depending on how the interconnect is billed and implemented in your region pair)\n&#8211; <strong>Data egress<\/strong> from OCI (network outbound)\n&#8211; Any optional network services you add:\n  &#8211; Network Firewall\n  &#8211; Load Balancer\n  &#8211; NAT Gateway (if used)\n  &#8211; Compute instances for routing\/inspection (if you self-manage appliances)<\/p>\n\n\n\n<p><strong>On Microsoft Azure, costs may include:<\/strong>\n&#8211; <strong>ExpressRoute circuit charges<\/strong> (bandwidth tier, metered\/unmetered plan\u2014Azure pricing model varies)\n&#8211; <strong>ExpressRoute gateway<\/strong> costs (SKU-based)\n&#8211; <strong>Data transfer<\/strong> depending on ExpressRoute plan and direction\n&#8211; Optional: Azure Firewall, NAT Gateway, etc.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Free tier<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Oracle Interconnect for Azure itself is not typically \u201cfree tier friendly,\u201d because ExpressRoute\/FastConnect-style connectivity usually incurs charges.<\/li>\n<li>Some dependent resources (small compute VMs) may have free-tier options, but the interconnect component generally does not.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost drivers<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Provisioned bandwidth<\/strong> for the private circuit(s)<\/li>\n<li><strong>Hours in service<\/strong> (monthly recurring charges are common)<\/li>\n<li><strong>Data egress<\/strong> (especially OCI \u2192 Azure or Azure \u2192 OCI depending on provider billing)<\/li>\n<li><strong>Gateway SKUs<\/strong> and redundancy options (Azure ExpressRoute gateway)<\/li>\n<li><strong>Network security appliances<\/strong> (managed firewall services or BYO appliances)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Hidden\/indirect costs<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cross-cloud DNS design (private resolvers, forwarding VMs)<\/li>\n<li>Logging\/monitoring retention costs (Azure Monitor, OCI Logging)<\/li>\n<li>Additional routing\/inspection infrastructure (hub VNets\/VCNs)<\/li>\n<li>Operations time (change management, troubleshooting BGP)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network\/data transfer implications<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Treat this as a <strong>private path<\/strong>, not a \u201cfree path.\u201d<\/li>\n<li>Even when traffic is private, <strong>egress charges can still apply<\/strong>.<\/li>\n<li>Always model:<\/li>\n<li>expected steady-state throughput (Mbps\/Gbps)<\/li>\n<li>monthly data volume (TB)<\/li>\n<li>peak patterns (batch windows)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How to optimize cost<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Prefer <strong>regional locality<\/strong>: keep chatty dependencies in the same cloud when possible.<\/li>\n<li>Minimize cross-cloud calls in latency-sensitive microservices.<\/li>\n<li>Use caching and async messaging patterns.<\/li>\n<li>Right-size bandwidth and review utilization monthly.<\/li>\n<li>Use route segmentation to ensure only required subnets send traffic across interconnect.<\/li>\n<li>Consider VPN for low-volume environments (dev\/test), and reserve interconnect for prod.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Example low-cost starter estimate (no fabricated numbers)<\/h3>\n\n\n\n<p>A \u201cstarter\u201d lab still commonly requires:\n&#8211; 1 small OCI VM + 1 small Azure VM (compute hourly)\n&#8211; ExpressRoute gateway (Azure SKU cost)\n&#8211; ExpressRoute circuit (bandwidth + plan)\n&#8211; OCI FastConnect\/interconnect charges (if applicable)\n&#8211; Data transfer (small if you only do ping\/curl tests)<\/p>\n\n\n\n<p>Because exact pricing varies by region, SKU, and agreement, <strong>use official calculators<\/strong>:\n&#8211; OCI Pricing: https:\/\/www.oracle.com\/cloud\/pricing\/\n&#8211; OCI Networking pricing (FastConnect and data transfer): https:\/\/www.oracle.com\/cloud\/networking\/pricing\/ (verify current page structure)\n&#8211; Azure ExpressRoute pricing: https:\/\/azure.microsoft.com\/pricing\/details\/expressroute\/\n&#8211; Azure Pricing Calculator: https:\/\/azure.microsoft.com\/pricing\/calculator\/\n&#8211; OCI Cost Estimator: https:\/\/www.oracle.com\/cloud\/costestimator.html (verify availability\/URL)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example production cost considerations<\/h3>\n\n\n\n<p>In production, the biggest cost contributors are usually:\n&#8211; ExpressRoute circuit(s) and gateway(s)\n&#8211; OCI FastConnect\/interconnect-related costs\n&#8211; Egress data transfer (especially if large analytics data flows cross-cloud)\n&#8211; Redundancy (dual circuits\/links, zone-redundant gateways)\n&#8211; Firewall\/inspection services and log retention<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<p>This lab builds a minimal but realistic cross-cloud private routing setup so an OCI VM can reach an Azure VM over Oracle Interconnect for Azure.<\/p>\n\n\n\n<blockquote>\n<p>Important constraints:\n&#8211; Provisioning Oracle Interconnect for Azure \/ ExpressRoute connectivity can require <strong>supported paired regions<\/strong>, specific SKUs, and sometimes operational lead time.\n&#8211; Console workflows can change. Use this tutorial as a validated <strong>conceptual and configuration guide<\/strong>, and follow the latest official docs for exact UI fields and ordering.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<p>Create private, routed connectivity between:\n&#8211; <strong>OCI VCN (10.10.0.0\/16)<\/strong> with a test VM\n&#8211; <strong>Azure VNet (10.20.0.0\/16)<\/strong> with a test VM<br\/>\nusing <strong>Oracle Interconnect for Azure<\/strong>, then validate ICMP and TCP connectivity.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<p>You will:\n1. Create OCI network: VCN, subnet, DRG, test VM.\n2. Create Azure network: VNet, subnets (including GatewaySubnet), test VM, ExpressRoute gateway.\n3. Provision Oracle Interconnect for Azure connectivity (interconnect + routing\/BGP parameters).\n4. Configure routing\/security on both sides.\n5. Validate connectivity (ping, SSH, simple HTTP).\n6. Clean up resources to stop billing.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Plan IP addressing and regions<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Choose a <strong>supported paired region<\/strong>:\n   &#8211; OCI region: <code>OCI_REGION_A<\/code>\n   &#8211; Azure region: <code>AZURE_REGION_A<\/code><\/li>\n<li>Ensure CIDR ranges do <strong>not overlap<\/strong>:\n   &#8211; OCI VCN: <code>10.10.0.0\/16<\/code>\n   &#8211; Azure VNet: <code>10.20.0.0\/16<\/code><\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; You have selected a region pair and non-overlapping CIDRs.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; Confirm the region pair is supported in official docs (links in section 17).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Create OCI VCN, subnet, and DRG<\/h3>\n\n\n\n<p>You can do this via OCI Console or OCI CLI. Below is a CLI-driven approach for repeatability.<\/p>\n\n\n\n<blockquote>\n<p>You must already have OCI CLI configured (<code>oci setup config<\/code>) and a compartment OCID.<\/p>\n<\/blockquote>\n\n\n\n<h4 class=\"wp-block-heading\">2.1 Create VCN<\/h4>\n\n\n\n<pre><code class=\"language-bash\">export COMPARTMENT_OCID=\"ocid1.compartment.oc1..exampleuniqueID\"\nexport OCI_REGION=\"us-ashburn-1\"   # example; use your paired region\nexport VCN_CIDR=\"10.10.0.0\/16\"\n\noci network vcn create \\\n  --compartment-id \"$COMPARTMENT_OCID\" \\\n  --cidr-block \"$VCN_CIDR\" \\\n  --display-name \"lab-oci-vcn-azure-interconnect\" \\\n  --dns-label \"labocivcn\"\n<\/code><\/pre>\n\n\n\n<p>Capture the <code>id<\/code> as <code>VCN_OCID<\/code>.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">2.2 Create a subnet<\/h4>\n\n\n\n<p>Use a \/24 for the lab subnet.<\/p>\n\n\n\n<pre><code class=\"language-bash\">export VCN_OCID=\"ocid1.vcn.oc1..exampleuniqueID\"\nexport SUBNET_CIDR=\"10.10.10.0\/24\"\n\noci network subnet create \\\n  --compartment-id \"$COMPARTMENT_OCID\" \\\n  --vcn-id \"$VCN_OCID\" \\\n  --cidr-block \"$SUBNET_CIDR\" \\\n  --display-name \"lab-oci-subnet\" \\\n  --dns-label \"subnet10\" \\\n  --prohibit-public-ip-on-vnic true\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">2.3 Create a DRG<\/h4>\n\n\n\n<pre><code class=\"language-bash\">oci network drg create \\\n  --compartment-id \"$COMPARTMENT_OCID\" \\\n  --display-name \"lab-drg-azure-interconnect\"\n<\/code><\/pre>\n\n\n\n<p>Capture <code>DRG_OCID<\/code>.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">2.4 Attach DRG to the VCN<\/h4>\n\n\n\n<pre><code class=\"language-bash\">export DRG_OCID=\"ocid1.drg.oc1..exampleuniqueID\"\n\noci network drg-attachment create \\\n  --drg-id \"$DRG_OCID\" \\\n  --vcn-id \"$VCN_OCID\" \\\n  --display-name \"lab-drg-attach-vcn\"\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; OCI has a VCN, a private subnet, a DRG, and a DRG attachment to the VCN.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; In OCI Console, check <strong>Networking \u2192 Virtual Cloud Networks<\/strong> and <strong>Dynamic Routing Gateways<\/strong>.\n&#8211; Ensure the DRG attachment state is <strong>Attached<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Create an OCI test VM (no public IP)<\/h3>\n\n\n\n<p>Use OCI Bastion or an existing admin network for access. For simplicity, you can temporarily use a public IP and lock it down, but the more secure pattern is: <strong>no public IP + OCI Bastion<\/strong>.<\/p>\n\n\n\n<p><strong>Recommended (secure) approach:<\/strong> OCI Bastion<br\/>\nDocs: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Bastion\/home.htm<\/p>\n\n\n\n<p>High-level steps (console-driven):\n1. Create a compute instance in <code>lab-oci-subnet<\/code> with <strong>no public IP<\/strong>.\n2. Create an OCI Bastion in the VCN.\n3. Start a managed SSH session to the instance.<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; You can SSH into the OCI VM privately.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; On the OCI VM, confirm its IP (example: <code>10.10.10.10<\/code>) and that it can reach its default gateway.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Create Azure VNet, subnets, and ExpressRoute gateway<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">4.1 Create Azure VNet and subnets<\/h4>\n\n\n\n<p>You need at minimum:\n&#8211; A workload subnet (e.g., <code>10.20.10.0\/24<\/code>)\n&#8211; A <strong>GatewaySubnet<\/strong> (required by Azure) (e.g., <code>10.20.255.0\/27<\/code> or larger as required; verify Azure requirements)<\/p>\n\n\n\n<p>Using Azure CLI (example):<\/p>\n\n\n\n<pre><code class=\"language-bash\">az group create --name rg-azure-oci-interconnect --location \"eastus\"\n\naz network vnet create \\\n  --resource-group rg-azure-oci-interconnect \\\n  --name vnet-azure-lab \\\n  --address-prefixes 10.20.0.0\/16 \\\n  --subnet-name subnet-workload \\\n  --subnet-prefixes 10.20.10.0\/24\n\naz network vnet subnet create \\\n  --resource-group rg-azure-oci-interconnect \\\n  --vnet-name vnet-azure-lab \\\n  --name GatewaySubnet \\\n  --address-prefixes 10.20.255.0\/27\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">4.2 Create an Azure test VM (private IP)<\/h4>\n\n\n\n<p>Create a VM in <code>subnet-workload<\/code>. For a strict private lab, avoid public IP and use <strong>Azure Bastion<\/strong>. If you must use a public IP, restrict inbound rules to your IP only.<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; An Azure VM exists with a private IP in <code>10.20.10.0\/24<\/code>.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; In Azure Portal, confirm the VM NIC private IP (example: <code>10.20.10.10<\/code>).<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">4.3 Create ExpressRoute gateway (Virtual Network Gateway)<\/h4>\n\n\n\n<p>ExpressRoute requires a Virtual Network Gateway. Exact command parameters depend on SKU and zone redundancy availability.<\/p>\n\n\n\n<p>Azure docs (authoritative): https:\/\/learn.microsoft.com\/azure\/expressroute\/expressroute-howto-add-gateway<\/p>\n\n\n\n<p>High-level (CLI outline; verify exact SKUs\/flags):\n1. Create a public IP for the gateway.\n2. Create the virtual network gateway of type <strong>ExpressRoute<\/strong>.<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; Azure ExpressRoute gateway exists and is associated with <code>vnet-azure-lab<\/code>.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; Azure Portal shows Virtual network gateway provisioning succeeded.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Provision Oracle Interconnect for Azure connectivity<\/h3>\n\n\n\n<p>This is the step where region-pair support and the latest workflow matter most.<\/p>\n\n\n\n<p>Use the official OCI guide for Oracle Interconnect for Azure:\n&#8211; OCI docs (verify current): https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Network\/Concepts\/azure.htm<\/p>\n\n\n\n<p>Typical high-level flow (verify exact order):\n1. In OCI, navigate to the Oracle Interconnect for Azure workflow (may be under Networking).\n2. Create an interconnect connection for your region pair.\n3. Obtain required <strong>service key \/ authorization<\/strong> details for Azure ExpressRoute.\n4. In Azure, create or associate an <strong>ExpressRoute circuit<\/strong> using the provided authorization\/service key (or generate a key in Azure to input into OCI\u2014depends on current workflow).\n5. Configure <strong>private peering<\/strong> and BGP parameters as required.\n6. Ensure the circuit and BGP peerings are in <strong>Provisioned<\/strong> \/ <strong>Enabled<\/strong> \/ <strong>Up<\/strong> state.<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; OCI and Azure show the interconnect connection as provisioned\/active.\n&#8211; BGP sessions are established (or the provider-managed routing is active, depending on model).<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; OCI: interconnect\/virtual circuit status is <strong>Up<\/strong> or equivalent.\n&#8211; Azure: ExpressRoute circuit shows <strong>Provisioned<\/strong>, peering <strong>Enabled<\/strong>, and gateway connection <strong>Connected<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Configure routing (OCI side)<\/h3>\n\n\n\n<p>You must ensure OCI subnets route Azure CIDRs to the DRG.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">6.1 Update OCI VCN route table<\/h4>\n\n\n\n<p>Add a route rule:\n&#8211; Destination: <code>10.20.0.0\/16<\/code>\n&#8211; Target: <code>DRG<\/code><\/p>\n\n\n\n<p>Using OCI CLI (route table OCID needed):<\/p>\n\n\n\n<pre><code class=\"language-bash\">export ROUTE_TABLE_OCID=\"ocid1.routetable.oc1..exampleuniqueID\"\nexport AZURE_VNET_CIDR=\"10.20.0.0\/16\"\n\noci network route-table update \\\n  --rt-id \"$ROUTE_TABLE_OCID\" \\\n  --route-rules \"[\n    {\n      \\\"destination\\\": \\\"$AZURE_VNET_CIDR\\\",\n      \\\"destinationType\\\": \\\"CIDR_BLOCK\\\",\n      \\\"networkEntityId\\\": \\\"$DRG_OCID\\\"\n    }\n  ]\"\n<\/code><\/pre>\n\n\n\n<blockquote>\n<p>Note: If your route table already has rules, you must include them all in the update payload. Many teams prefer editing in the OCI Console to avoid accidental overwrites.<\/p>\n<\/blockquote>\n\n\n\n<h4 class=\"wp-block-heading\">6.2 Ensure DRG route tables\/distributions allow Azure routes<\/h4>\n\n\n\n<p>Modern OCI DRG uses route tables and route distributions. You may need to:\n&#8211; Import Azure routes into the DRG route table associated with the VCN attachment.\n&#8211; Export OCI VCN routes to the interconnect attachment.<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; OCI knows that <code>10.20.0.0\/16<\/code> is reachable via DRG and the DRG knows how to reach Azure via the interconnect attachment.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; Check DRG route table \u201ceffective routes\u201d in OCI console (if available).\n&#8211; If OCI shows learned routes from Azure, confirm <code>10.20.0.0\/16<\/code> appears.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Configure routing (Azure side)<\/h3>\n\n\n\n<p>In Azure, ExpressRoute + VNet gateway typically handles route propagation automatically for connected VNets, but you must ensure:\n&#8211; The VNet is connected to the ExpressRoute circuit via the gateway connection.\n&#8211; Routes to OCI CIDRs (<code>10.10.0.0\/16<\/code>) are being learned\/propagated.<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; Azure workload subnet can route to OCI CIDRs via the ExpressRoute gateway.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; Check Effective routes on the Azure VM NIC:\n  &#8211; Azure Portal \u2192 VM \u2192 Networking \u2192 NIC \u2192 <strong>Effective routes<\/strong>\n&#8211; Confirm <code>10.10.0.0\/16<\/code> (or more specific OCI prefixes) appears with next hop as Virtual network gateway.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 8: Configure security rules (both sides)<\/h3>\n\n\n\n<p>Connectivity often fails not because of routing, but because of security rules.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">8.1 OCI: NSGs \/ Security Lists<\/h4>\n\n\n\n<p>Allow inbound from Azure CIDR to the OCI VM on required ports:\n&#8211; ICMP (for ping) if you want it\n&#8211; SSH (22) from Azure CIDR\n&#8211; Any app ports (e.g., 80\/443)<\/p>\n\n\n\n<p>Example security list rules (conceptual; apply via console or API):\n&#8211; Ingress: Source <code>10.20.0.0\/16<\/code>, Protocol TCP, Destination port 22\n&#8211; Ingress: Source <code>10.20.0.0\/16<\/code>, Protocol ICMP (type 8)<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">8.2 Azure: NSG rules<\/h4>\n\n\n\n<p>Allow inbound from OCI CIDR to Azure VM:\n&#8211; ICMP may be blocked by OS firewall even if NSG allows it.\n&#8211; Allow SSH\/RDP depending on OS.\n&#8211; Allow app ports.<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; Security policies allow the intended cross-cloud traffic.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; Confirm no \u201cdeny\u201d rules override your allow rules.\n&#8211; Check OS firewalls (Linux <code>ufw<\/code>\/<code>firewalld<\/code>, Windows Defender Firewall).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 9: Validate connectivity<\/h3>\n\n\n\n<p>Perform tests from OCI VM to Azure VM and vice versa.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">9.1 Ping test (if allowed)<\/h4>\n\n\n\n<p>From OCI VM:<\/p>\n\n\n\n<pre><code class=\"language-bash\">ping -c 4 10.20.10.10\n<\/code><\/pre>\n\n\n\n<p>From Azure VM:<\/p>\n\n\n\n<pre><code class=\"language-bash\">ping -c 4 10.10.10.10\n<\/code><\/pre>\n\n\n\n<blockquote>\n<p>Many Linux images block ICMP by default at the OS firewall or cloud policy; failure here doesn\u2019t always mean routing is broken.<\/p>\n<\/blockquote>\n\n\n\n<h4 class=\"wp-block-heading\">9.2 TCP connectivity test<\/h4>\n\n\n\n<p>From OCI VM to Azure VM SSH port (example):<\/p>\n\n\n\n<pre><code class=\"language-bash\">nc -vz 10.20.10.10 22\n<\/code><\/pre>\n\n\n\n<p>From Azure VM to OCI VM SSH port:<\/p>\n\n\n\n<pre><code class=\"language-bash\">nc -vz 10.10.10.10 22\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">9.3 Application test (optional)<\/h4>\n\n\n\n<p>Run a simple HTTP server on one VM:<\/p>\n\n\n\n<pre><code class=\"language-bash\">python3 -m http.server 8080 --bind 0.0.0.0\n<\/code><\/pre>\n\n\n\n<p>From the other VM:<\/p>\n\n\n\n<pre><code class=\"language-bash\">curl -I http:\/\/&lt;peer-private-ip&gt;:8080\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; Packets traverse privately between OCI and Azure.\n&#8211; TCP connectivity succeeds for allowed ports.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>Use this checklist:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Validation item<\/th>\n<th>How to check<\/th>\n<th>Success looks like<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Interconnect\/circuit state<\/td>\n<td>OCI console + Azure portal<\/td>\n<td>Provisioned\/Up\/Connected<\/td>\n<\/tr>\n<tr>\n<td>BGP status<\/td>\n<td>ExpressRoute peering + OCI interconnect status<\/td>\n<td>Established\/Up<\/td>\n<\/tr>\n<tr>\n<td>Effective routes (Azure)<\/td>\n<td>NIC effective routes<\/td>\n<td>OCI CIDRs present<\/td>\n<\/tr>\n<tr>\n<td>Effective routes (OCI)<\/td>\n<td>DRG route tables \/ learned routes<\/td>\n<td>Azure CIDRs present<\/td>\n<\/tr>\n<tr>\n<td>Security rules<\/td>\n<td>NSG\/NSG + OS firewall<\/td>\n<td>No unintended denies<\/td>\n<\/tr>\n<tr>\n<td>End-to-end TCP test<\/td>\n<td><code>nc<\/code>, <code>curl<\/code>, app logs<\/td>\n<td>Successful connections<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<p>Common problems and fixes:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Overlapping CIDRs<\/strong>\n   &#8211; Symptom: Routes don\u2019t propagate or traffic blackholes.\n   &#8211; Fix: Re-IP one side (best) or introduce NAT (complex; avoid if possible).<\/p>\n<\/li>\n<li>\n<p><strong>Missing OCI route table entry<\/strong>\n   &#8211; Symptom: OCI VM can\u2019t reach Azure CIDR.\n   &#8211; Fix: Add route <code>10.20.0.0\/16 \u2192 DRG<\/code> to the subnet route table.<\/p>\n<\/li>\n<li>\n<p><strong>DRG route distribution misconfiguration (OCI)<\/strong>\n   &#8211; Symptom: OCI DRG doesn\u2019t learn\/advertise expected prefixes.\n   &#8211; Fix: Check DRG route tables and route distributions for each attachment. Verify import\/export rules.<\/p>\n<\/li>\n<li>\n<p><strong>Azure gateway not connected to ExpressRoute circuit<\/strong>\n   &#8211; Symptom: Azure effective routes don\u2019t show OCI prefixes.\n   &#8211; Fix: Confirm VNet gateway connection to the circuit is created and connected.<\/p>\n<\/li>\n<li>\n<p><strong>NSG\/security list blocks traffic<\/strong>\n   &#8211; Symptom: Routes look correct but TCP\/ICMP fails.\n   &#8211; Fix: Add explicit allow rules and verify OS firewall settings.<\/p>\n<\/li>\n<li>\n<p><strong>Asymmetric routing through firewalls<\/strong>\n   &#8211; Symptom: One direction works; return traffic is dropped.\n   &#8211; Fix: Ensure both directions follow the same inspection path or stateful device configuration supports it.<\/p>\n<\/li>\n<li>\n<p><strong>DNS resolution fails<\/strong>\n   &#8211; Symptom: IP connectivity works, but service names fail.\n   &#8211; Fix: Implement cross-cloud DNS forwarding (OCI DNS \u2194 Azure Private DNS) or use conditional forwarders.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<p>To stop billing, remove resources in reverse order:<\/p>\n\n\n\n<p><strong>Azure:<\/strong>\n1. Delete test VMs (and associated NICs\/public IPs\/disks if not auto-deleted).\n2. Delete ExpressRoute gateway (Virtual Network Gateway).\n3. Delete ExpressRoute circuit (if created for the lab).\n4. Delete VNets if created only for lab.\n5. Delete resource group <code>rg-azure-oci-interconnect<\/code> (fastest if all resources are inside it).<\/p>\n\n\n\n<p><strong>OCI:<\/strong>\n1. Terminate test compute instances.\n2. Delete Bastion (if created).\n3. Detach and delete interconnect\/virtual circuit resources (per official procedure).\n4. Detach DRG from VCN and delete DRG.\n5. Delete subnet(s) and VCN.<\/p>\n\n\n\n<blockquote>\n<p>Always verify interconnect and circuit deletion steps; some resources have dependencies and required ordering.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>hub-and-spoke<\/strong> in each cloud for scaling and centralized controls.<\/li>\n<li>Keep cross-cloud traffic to <strong>well-defined interfaces<\/strong> (API layer) rather than chatty east-west microservice calls.<\/li>\n<li>Prefer <strong>asynchronous integration<\/strong> (queues\/events) where latency matters.<\/li>\n<li>Design for <strong>failure domains<\/strong>: region outage, circuit impairment, gateway failure.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use least-privilege:<\/li>\n<li>Separate roles for network engineers vs operators vs auditors.<\/li>\n<li>Require change management for:<\/li>\n<li>Route table changes<\/li>\n<li>BGP configuration changes<\/li>\n<li>Security rules changes<\/li>\n<li>Use resource tagging for ownership and cost center tracking.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Right-size bandwidth and review utilization monthly.<\/li>\n<li>Use VPN for dev\/test unless the environment must exactly mirror production.<\/li>\n<li>Minimize egress-heavy flows; consider data locality and compression.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Place latency-sensitive dependencies in paired regions.<\/li>\n<li>Avoid unnecessary hairpinning through multiple firewalls unless required.<\/li>\n<li>Use connection pooling and retries with sane timeouts across clouds.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Implement redundancy per provider guidance:<\/li>\n<li>Redundant links\/circuits where applicable<\/li>\n<li>Zone-redundant gateways when supported<\/li>\n<li>Test failover scenarios quarterly:<\/li>\n<li>Circuit down<\/li>\n<li>Route withdrawal<\/li>\n<li>Gateway replacement<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Build dashboards:<\/li>\n<li>Circuit state<\/li>\n<li>BGP status<\/li>\n<li>Throughput saturation<\/li>\n<li>Packet drops<\/li>\n<li>Alert on:<\/li>\n<li>BGP down<\/li>\n<li>Sudden route changes<\/li>\n<li>Sustained &gt;70\u201380% bandwidth utilization<\/li>\n<li>Runbooks:<\/li>\n<li>\u201cNo route to host\u201d<\/li>\n<li>\u201cBGP down\u201d<\/li>\n<li>\u201cOnly one direction works\u201d<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Standardize names:<\/li>\n<li><code>env-region-app-purpose<\/code><\/li>\n<li>Tag both OCI and Azure resources:<\/li>\n<li><code>Owner<\/code>, <code>CostCenter<\/code>, <code>Environment<\/code>, <code>DataClassification<\/code><\/li>\n<li>Document CIDR allocations centrally.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI:<\/li>\n<li>Use IAM policies scoped to compartments.<\/li>\n<li>Restrict who can manage DRG, route tables, and interconnect resources.<\/li>\n<li>Azure:<\/li>\n<li>Use RBAC and Privileged Identity Management (PIM) where possible.<\/li>\n<li>Restrict ExpressRoute circuit modifications.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The interconnect provides a <strong>private<\/strong> path; encryption is typically achieved by:<\/li>\n<li><strong>TLS<\/strong> (HTTPS, mTLS) for application traffic<\/li>\n<li><strong>Database native encryption<\/strong> (where applicable)<\/li>\n<li>Optional <strong>IPsec overlay<\/strong> if your security policy requires network-layer encryption (verify feasibility and performance impact)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Prefer <strong>no public IPs<\/strong> for workloads.<\/li>\n<li>Use bastion services (OCI Bastion, Azure Bastion).<\/li>\n<li>Avoid broad CIDR advertisements; only advertise what you must.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Store secrets in:<\/li>\n<li>OCI Vault: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/KeyManagement\/home.htm<\/li>\n<li>Azure Key Vault: https:\/\/learn.microsoft.com\/azure\/key-vault\/<\/li>\n<li>Never embed credentials in VM images or user data scripts.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI Audit logs:<\/li>\n<li>Track networking and IAM changes.<\/li>\n<li>Azure Activity Log:<\/li>\n<li>Track ExpressRoute and gateway changes.<\/li>\n<li>Centralize logs to a SIEM and retain per policy.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Maintain evidence:<\/li>\n<li>Route and security policy definitions<\/li>\n<li>Change approvals<\/li>\n<li>Access reviews<\/li>\n<li>Validate whether \u201cprivate connectivity\u201d satisfies regulatory requirements for data in transit.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Common security mistakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Treating private circuits as \u201ctrusted\u201d and allowing overly broad access.<\/li>\n<li>Advertising default routes cross-cloud without careful segmentation.<\/li>\n<li>Overlapping CIDRs and using NAT as a band-aid without threat modeling.<\/li>\n<li>Lack of monitoring for route changes and BGP flaps.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enforce segmentation:<\/li>\n<li>Separate app, data, and admin networks.<\/li>\n<li>Add inspection where required:<\/li>\n<li>Azure Firewall \/ OCI Network Firewall<\/li>\n<li>Use deny-by-default security groups and explicitly allow required ports.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<blockquote>\n<p>Confirm the latest constraints in official docs for your target region pair.<\/p>\n<\/blockquote>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Region pair constraints:<\/strong> Available only in specific OCI \u2194 Azure region pairs.<\/li>\n<li><strong>Lead time:<\/strong> Provisioning may not be instantaneous; enterprise connectivity can require coordination.<\/li>\n<li><strong>Cost surprises:<\/strong> ExpressRoute and private connectivity can be significantly more expensive than VPN for low-traffic environments.<\/li>\n<li><strong>Overlapping CIDRs:<\/strong> A frequent blocker; avoid at design time.<\/li>\n<li><strong>Route propagation complexity:<\/strong> OCI DRG route tables\/distributions can be misconfigured; Azure effective routes can be misinterpreted.<\/li>\n<li><strong>Asymmetric routing with inspection:<\/strong> Stateful firewalls require symmetric flows; multicloud routing can break symmetry.<\/li>\n<li><strong>DNS is not automatic:<\/strong> Name resolution across clouds needs explicit design.<\/li>\n<li><strong>Throughput limits:<\/strong> Azure gateway SKU and circuit bandwidth can cap performance; OCI limits may also apply.<\/li>\n<li><strong>Change blast radius:<\/strong> A route change can affect many networks; implement guardrails.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Alternatives to consider<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI Site-to-Site VPN + Azure VPN Gateway<\/strong> (internet-based IPsec)<\/li>\n<li><strong>Third-party interconnect providers<\/strong> (Megaport, Equinix, etc.) using FastConnect\/ExpressRoute (depending on your colo strategy)<\/li>\n<li><strong>Application-layer integration<\/strong> (public APIs with mTLS, WAF, private endpoints\u2014where appropriate)<\/li>\n<li><strong>Self-managed SD-WAN\/NVA appliances<\/strong> (complex, but sometimes required)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Comparison table<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Oracle Interconnect for Azure<\/td>\n<td>Production-grade OCI\u2194Azure private connectivity in supported region pairs<\/td>\n<td>Private, high throughput, lower latency, enterprise routing<\/td>\n<td>Region-pair limits, cost, provisioning complexity<\/td>\n<td>When you need predictable private connectivity for prod workloads<\/td>\n<\/tr>\n<tr>\n<td>OCI Site-to-Site VPN + Azure VPN Gateway<\/td>\n<td>Dev\/test, smaller workloads, quick setup<\/td>\n<td>Fast to deploy, encrypted by default (IPsec), lower entry cost<\/td>\n<td>Internet variability, lower throughput, more tunnel ops<\/td>\n<td>When budgets are tight or region pairs aren\u2019t supported<\/td>\n<\/tr>\n<tr>\n<td>ExpressRoute + FastConnect via third-party provider<\/td>\n<td>Enterprises with existing colocation\/interconnect contracts<\/td>\n<td>Flexibility across many regions, multi-provider options<\/td>\n<td>More vendor coordination, more moving parts<\/td>\n<td>When you need broader geographic reach than the native interconnect pairing<\/td>\n<\/tr>\n<tr>\n<td>Public internet with strong security (TLS\/mTLS, WAF)<\/td>\n<td>Public-facing APIs, low-risk integrations<\/td>\n<td>Simple architecture, minimal network dependencies<\/td>\n<td>Public exposure, egress costs, latency variability<\/td>\n<td>When workloads are designed for internet and don\u2019t require private routing<\/td>\n<\/tr>\n<tr>\n<td>Self-managed NVAs\/SD-WAN overlay<\/td>\n<td>Highly customized routing\/security, multi-site<\/td>\n<td>Deep control, consistent policy<\/td>\n<td>Operational burden, licensing, HA complexity<\/td>\n<td>When you already run SD-WAN and must extend it to clouds<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example: Retail platform with Azure app tier and OCI data tier<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A retailer runs customer-facing apps in Azure but uses Oracle Cloud for a data platform. They need low-latency, private access from Azure services to OCI-hosted data services without exposing databases publicly.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>Azure hub-and-spoke VNets with Azure Firewall.<\/li>\n<li>ExpressRoute gateway in hub VNet.<\/li>\n<li>OCI hub VCN with DRG and OCI Network Firewall.<\/li>\n<li>Oracle Interconnect for Azure connects Azure hub to OCI hub.<\/li>\n<li>Only specific OCI subnets are advertised to Azure; only app subnets can reach data subnets.<\/li>\n<li><strong>Why this service was chosen:<\/strong><\/li>\n<li>Stable performance for high-traffic internal API calls and data access.<\/li>\n<li>Reduced public exposure and simpler compliance story than public endpoints.<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Fewer timeouts, improved performance consistency.<\/li>\n<li>Reduced attack surface (no public DB endpoints).<\/li>\n<li>Clear operational ownership with monitoring and change control.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example: SaaS with phased multicloud adoption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A startup is Azure-first but wants to adopt an OCI service for a specific backend capability. They need secure connectivity without redesigning their network around public endpoints.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>Single Azure VNet with an ExpressRoute gateway.<\/li>\n<li>Single OCI VCN with DRG.<\/li>\n<li>Oracle Interconnect for Azure for production; VPN for dev\/test.<\/li>\n<li>Minimal routing: only <code>10.20.10.0\/24<\/code> \u2194 <code>10.10.10.0\/24<\/code>.<\/li>\n<li><strong>Why this service was chosen:<\/strong><\/li>\n<li>Production needs predictable, private connectivity.<\/li>\n<li>Keeps architecture simple: a narrow, controlled cross-cloud path.<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Faster delivery than rewriting services for public exposure.<\/li>\n<li>Lower security risk by keeping services private.<\/li>\n<li>A migration path to more advanced hub-and-spoke later.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Is Oracle Interconnect for Azure the same as FastConnect or ExpressRoute?<\/strong><br\/>\n   No. Oracle Interconnect for Azure is the cross-cloud interconnect offering\/pattern. It is typically implemented using OCI FastConnect and Azure ExpressRoute building blocks, plus provider-managed connectivity between the two clouds.<\/p>\n<\/li>\n<li>\n<p><strong>Do I need non-overlapping CIDRs?<\/strong><br\/>\n   Yes, strongly recommended. Overlapping address spaces are one of the most common causes of failed routing and complex NAT workarounds.<\/p>\n<\/li>\n<li>\n<p><strong>Is traffic encrypted over Oracle Interconnect for Azure?<\/strong><br\/>\n   The connectivity is private, but encryption is generally your responsibility (TLS\/mTLS, or IPsec overlay if required). Verify encryption guarantees in official docs and your compliance requirements.<\/p>\n<\/li>\n<li>\n<p><strong>Which regions are supported?<\/strong><br\/>\n   Only specific OCI \u2194 Azure region pairs. Check the official Oracle documentation for the current list.<\/p>\n<\/li>\n<li>\n<p><strong>How long does provisioning take?<\/strong><br\/>\n   It varies by region and workflow. Some steps can be fast, but enterprise circuits\/gateways may have lead times. Verify with provider docs and your account team.<\/p>\n<\/li>\n<li>\n<p><strong>Can I use it for dev\/test environments?<\/strong><br\/>\n   You can, but it may be cost-inefficient compared to VPN. Many teams use VPN for dev\/test and interconnect for production.<\/p>\n<\/li>\n<li>\n<p><strong>Does it support redundancy?<\/strong><br\/>\n   Redundancy is typically part of the design (dual links\/paths), but the exact model depends on the region and configuration. You must still design redundancy in gateways and routing.<\/p>\n<\/li>\n<li>\n<p><strong>Can I connect multiple VNets to OCI over the same interconnect?<\/strong><br\/>\n   Commonly yes by connecting multiple VNets to ExpressRoute and controlling route propagation, but details depend on your Azure and OCI routing design. Verify limits and patterns.<\/p>\n<\/li>\n<li>\n<p><strong>Can I connect multiple VCNs to Azure over the same DRG?<\/strong><br\/>\n   Yes, DRG is designed to connect multiple VCN attachments and manage routing between them and external networks.<\/p>\n<\/li>\n<li>\n<p><strong>Do I need an Azure ExpressRoute gateway even if I only have one VNet?<\/strong><br\/>\n   Typically yes, VNets require an ExpressRoute gateway to use ExpressRoute connectivity. Confirm with Azure ExpressRoute documentation.<\/p>\n<\/li>\n<li>\n<p><strong>Will my OCI private DNS automatically resolve Azure private hostnames (and vice versa)?<\/strong><br\/>\n   No. You must design DNS forwarding\/conditional resolvers across clouds if you need name resolution.<\/p>\n<\/li>\n<li>\n<p><strong>How do I restrict which networks are reachable across the interconnect?<\/strong><br\/>\n   Use route advertisement controls (BGP prefixes), OCI DRG route tables\/distributions, Azure route filters\/propagation controls where applicable, and security groups.<\/p>\n<\/li>\n<li>\n<p><strong>What monitoring should I set up?<\/strong><br\/>\n   Monitor circuit health, BGP status, throughput, and drops in both OCI and Azure. Alert on BGP down and sustained high utilization.<\/p>\n<\/li>\n<li>\n<p><strong>Can I run a firewall between the clouds?<\/strong><br\/>\n   Yes. Many production architectures insert Azure Firewall or OCI Network Firewall (or NVAs). Ensure symmetric routing for stateful inspection.<\/p>\n<\/li>\n<li>\n<p><strong>Is Oracle Interconnect for Azure suitable for active-active architectures?<\/strong><br\/>\n   It can be part of an active-active design, but active-active requires careful data consistency, latency planning, and failure handling. Evaluate application architecture first.<\/p>\n<\/li>\n<li>\n<p><strong>What\u2019s the simplest first deployment?<\/strong><br\/>\n   A single VCN and single VNet connected through the interconnect, advertising only one subnet each, with basic TCP validation tests and strict security rules.<\/p>\n<\/li>\n<li>\n<p><strong>How do I estimate costs without surprises?<\/strong><br\/>\n   Model bandwidth + gateway SKUs + expected monthly data transfer. Use both OCI and Azure pricing pages and calculators, and include log\/firewall costs.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn Oracle Interconnect for Azure<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI: Oracle Interconnect for Microsoft Azure (verify current) \u2014 https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Network\/Concepts\/azure.htm<\/td>\n<td>Primary reference for region support, workflow, and OCI-side configuration<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI FastConnect \u2014 https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Network\/Concepts\/fastconnect.htm<\/td>\n<td>Explains FastConnect concepts often used as part of interconnect implementations<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI DRG (Dynamic Routing Gateway) \u2014 https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Network\/Tasks\/managingDRGs.htm (verify exact URL)<\/td>\n<td>DRG routing, attachments, route distributions\u2014critical for correct routing<\/td>\n<\/tr>\n<tr>\n<td>Official pricing<\/td>\n<td>OCI Networking pricing \u2014 https:\/\/www.oracle.com\/cloud\/networking\/pricing\/<\/td>\n<td>Understand OCI networking charges (egress, connectivity services)<\/td>\n<\/tr>\n<tr>\n<td>Official pricing<\/td>\n<td>OCI Pricing overview \u2014 https:\/\/www.oracle.com\/cloud\/pricing\/<\/td>\n<td>Entry point for OCI pricing documentation<\/td>\n<\/tr>\n<tr>\n<td>Pricing calculator<\/td>\n<td>OCI Cost Estimator \u2014 https:\/\/www.oracle.com\/cloud\/costestimator.html<\/td>\n<td>Estimate OCI-side costs (verify current tool availability)<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>Azure ExpressRoute overview \u2014 https:\/\/learn.microsoft.com\/azure\/expressroute\/expressroute-introduction<\/td>\n<td>Understand ExpressRoute components and design requirements<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>Azure ExpressRoute gateway setup \u2014 https:\/\/learn.microsoft.com\/azure\/expressroute\/expressroute-howto-add-gateway<\/td>\n<td>Gateway requirements and steps<\/td>\n<\/tr>\n<tr>\n<td>Official pricing<\/td>\n<td>Azure ExpressRoute pricing \u2014 https:\/\/azure.microsoft.com\/pricing\/details\/expressroute\/<\/td>\n<td>ExpressRoute circuit and plan pricing model<\/td>\n<\/tr>\n<tr>\n<td>Pricing calculator<\/td>\n<td>Azure Pricing Calculator \u2014 https:\/\/azure.microsoft.com\/pricing\/calculator\/<\/td>\n<td>Model Azure-side costs including gateway SKUs<\/td>\n<\/tr>\n<tr>\n<td>Architecture center<\/td>\n<td>Oracle Architecture Center \u2014 https:\/\/docs.oracle.com\/solutions\/<\/td>\n<td>Reference architectures; search for multicloud and Azure interconnect patterns<\/td>\n<\/tr>\n<tr>\n<td>Community (high-quality)<\/td>\n<td>Microsoft Learn (ExpressRoute learning paths) \u2014 https:\/\/learn.microsoft.com\/training\/<\/td>\n<td>Structured learning for ExpressRoute\/networking fundamentals<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Institute<\/th>\n<th>Suitable Audience<\/th>\n<th>Likely Learning Focus<\/th>\n<th>Mode<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps engineers, SREs, cloud engineers<\/td>\n<td>Multicloud DevOps, automation, cloud networking fundamentals<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>ScmGalaxy.com<\/td>\n<td>Beginners to intermediate engineers<\/td>\n<td>SCM\/DevOps foundations, CI\/CD practices relevant to multicloud ops<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.scmgalaxy.com\/<\/td>\n<\/tr>\n<tr>\n<td>CLoudOpsNow.in<\/td>\n<td>Cloud operations teams<\/td>\n<td>Cloud operations, monitoring, reliability practices<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.cloudopsnow.in\/<\/td>\n<\/tr>\n<tr>\n<td>SreSchool.com<\/td>\n<td>SREs, platform teams<\/td>\n<td>SRE principles, incident response, observability for cloud networks<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.sreschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>AiOpsSchool.com<\/td>\n<td>Ops and platform engineers<\/td>\n<td>AIOps concepts, automation, operational analytics<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.aiopsschool.com\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Platform\/Site<\/th>\n<th>Likely Specialization<\/th>\n<th>Suitable Audience<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>RajeshKumar.xyz<\/td>\n<td>DevOps\/cloud coaching and guidance (verify offerings)<\/td>\n<td>Engineers seeking hands-on mentoring<\/td>\n<td>https:\/\/rajeshkumar.xyz\/<\/td>\n<\/tr>\n<tr>\n<td>devopstrainer.in<\/td>\n<td>DevOps training and workshops (verify offerings)<\/td>\n<td>Beginners to working professionals<\/td>\n<td>https:\/\/www.devopstrainer.in\/<\/td>\n<\/tr>\n<tr>\n<td>devopsfreelancer.com<\/td>\n<td>Freelance DevOps consulting\/training platform (verify offerings)<\/td>\n<td>Teams wanting short-term help or coaching<\/td>\n<td>https:\/\/www.devopsfreelancer.com\/<\/td>\n<\/tr>\n<tr>\n<td>devopssupport.in<\/td>\n<td>DevOps support and training resources (verify offerings)<\/td>\n<td>Ops\/DevOps teams needing practical support<\/td>\n<td>https:\/\/www.devopssupport.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Company<\/th>\n<th>Likely Service Area<\/th>\n<th>Where They May Help<\/th>\n<th>Consulting Use Case Examples<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>cotocus.com<\/td>\n<td>Cloud\/DevOps consulting (verify exact services)<\/td>\n<td>Multicloud architecture, automation, operations<\/td>\n<td>Designing OCI\u2194Azure connectivity patterns; building runbooks and monitoring<\/td>\n<td>https:\/\/cotocus.com\/<\/td>\n<\/tr>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps and cloud consulting\/training<\/td>\n<td>Delivery enablement, platform engineering practices<\/td>\n<td>Multicloud landing zones; IaC pipelines for network provisioning<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>DEVOPSCONSULTING.IN<\/td>\n<td>DevOps consulting (verify exact services)<\/td>\n<td>Implementation support and operational best practices<\/td>\n<td>CI\/CD integration, monitoring setup for cross-cloud platforms<\/td>\n<td>https:\/\/www.devopsconsulting.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before this service<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Networking fundamentals:<\/li>\n<li>CIDR, routing tables, NAT, DNS, TCP\/IP<\/li>\n<li>BGP basics (ASNs, route advertisement, failover)<\/li>\n<li>OCI basics:<\/li>\n<li>Compartments, IAM policies<\/li>\n<li>VCNs, subnets, NSGs\/security lists<\/li>\n<li>DRG concepts<\/li>\n<li>Azure basics:<\/li>\n<li>Resource groups, RBAC<\/li>\n<li>VNets, subnets, NSGs<\/li>\n<li>Virtual Network Gateway and ExpressRoute concepts<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after this service<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Advanced multicloud networking:<\/li>\n<li>Hub-and-spoke at scale<\/li>\n<li>Firewall insertion and symmetric routing patterns<\/li>\n<li>Cross-cloud DNS architectures<\/li>\n<li>Infrastructure as Code:<\/li>\n<li>Terraform for OCI and Azure (separate providers; careful orchestration)<\/li>\n<li>Observability:<\/li>\n<li>Building SLOs\/SLIs for network connectivity<\/li>\n<li>Cross-cloud incident response<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Network Engineer<\/li>\n<li>Solutions Architect (Multicloud)<\/li>\n<li>Platform Engineer<\/li>\n<li>SRE (Network-focused)<\/li>\n<li>Security Engineer (cloud network security)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (if available)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI:<\/li>\n<li>OCI networking-focused certifications (verify current Oracle certification tracks)<\/li>\n<li>Azure:<\/li>\n<li>Azure Network Engineer Associate (or equivalent; verify current)<\/li>\n<li>Multicloud:<\/li>\n<li>Vendor-neutral networking certifications can help (conceptually), but always align to your employer needs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Build OCI\u2194Azure connectivity and publish internal service over private IP.<\/li>\n<li>Implement hub-and-spoke in both clouds with firewall inspection.<\/li>\n<li>Create a cross-cloud DNS conditional forwarding setup.<\/li>\n<li>Build monitoring dashboards and alerts for BGP\/circuit health.<\/li>\n<li>Run a failure drill: withdraw a route, validate recovery procedures.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI (Oracle Cloud Infrastructure):<\/strong> Oracle Cloud\u2019s IaaS\/PaaS platform.<\/li>\n<li><strong>Azure:<\/strong> Microsoft\u2019s cloud platform.<\/li>\n<li><strong>Multicloud:<\/strong> Using more than one cloud provider in a coordinated architecture.<\/li>\n<li><strong>VCN (Virtual Cloud Network):<\/strong> OCI\u2019s virtual network container.<\/li>\n<li><strong>VNet (Virtual Network):<\/strong> Azure\u2019s virtual network container.<\/li>\n<li><strong>Subnet:<\/strong> A segment of a VCN\/VNet where resources are deployed.<\/li>\n<li><strong>DRG (Dynamic Routing Gateway):<\/strong> OCI\u2019s virtual router for connecting VCNs to external networks.<\/li>\n<li><strong>FastConnect:<\/strong> OCI service for private connectivity to on-prem or partners.<\/li>\n<li><strong>ExpressRoute:<\/strong> Azure service for private connectivity to on-prem or partners.<\/li>\n<li><strong>BGP (Border Gateway Protocol):<\/strong> Routing protocol used to exchange network prefixes dynamically.<\/li>\n<li><strong>CIDR:<\/strong> Notation for IP address ranges (e.g., 10.10.0.0\/16).<\/li>\n<li><strong>NSG (Network Security Group):<\/strong> Security rules in OCI (and also in Azure, NSG is a similar concept) controlling traffic.<\/li>\n<li><strong>Security List (OCI):<\/strong> Subnet-level firewall rules (older model compared to NSGs).<\/li>\n<li><strong>Route table:<\/strong> Defines next hops for traffic to destination CIDRs.<\/li>\n<li><strong>Peering (Azure ExpressRoute private peering):<\/strong> The configuration to enable private routing over ExpressRoute.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p>Oracle Interconnect for Azure is an Oracle Cloud <strong>Multicloud<\/strong> connectivity service\/pattern that provides <strong>private, routed network connectivity<\/strong> between OCI and Microsoft Azure in supported paired regions. It matters because it enables real-world cross-cloud architectures\u2014like apps in Azure accessing data services in Oracle Cloud\u2014without relying on the public internet.<\/p>\n\n\n\n<p>From an architecture perspective, it fits best when you need predictable performance, enterprise routing (BGP), and tight security boundaries across clouds. From a cost perspective, the biggest drivers are typically <strong>ExpressRoute\/FastConnect-style connectivity charges, gateway SKUs, and data egress<\/strong>, so you should model bandwidth and monthly data volume carefully. From a security perspective, treat the interconnect as private transport, but still apply <strong>least privilege routing<\/strong>, <strong>segmentation<\/strong>, and <strong>encryption at higher layers<\/strong> (TLS\/mTLS) as required.<\/p>\n\n\n\n<p>Use Oracle Interconnect for Azure when you have supported region pairs and production-grade cross-cloud requirements. If you\u2019re early-stage or cost-sensitive, consider VPN for dev\/test and migrate to interconnect for production once traffic and reliability needs justify it.<\/p>\n\n\n\n<p>Next step: read the official OCI Oracle Interconnect for Azure documentation and build a small proof of concept that validates routing, security rules, and monitoring before scaling to hub-and-spoke production design.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Multicloud<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[73,62],"tags":[],"class_list":["post-939","post","type-post","status-publish","format-standard","hentry","category-multicloud","category-oracle-cloud"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/939","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=939"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/939\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=939"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=939"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=939"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}