{"id":945,"date":"2026-04-17T05:42:15","date_gmt":"2026-04-17T05:42:15","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/oracle-cloud-ip-management-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-networking-edge-and-connectivity\/"},"modified":"2026-04-17T05:42:15","modified_gmt":"2026-04-17T05:42:15","slug":"oracle-cloud-ip-management-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-networking-edge-and-connectivity","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/oracle-cloud-ip-management-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-networking-edge-and-connectivity\/","title":{"rendered":"Oracle Cloud IP Management Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for Networking, Edge, and Connectivity"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>Networking, Edge, and Connectivity<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What this service is<\/h3>\n\n\n\n<p>In Oracle Cloud Infrastructure (OCI), <strong>IP Management<\/strong> is the set of networking capabilities and Console workflows used to <strong>allocate, reserve, assign, and govern IP addresses<\/strong>\u2014especially <strong>public IP addresses<\/strong> (reserved or ephemeral) and their association to <strong>private IPs<\/strong> on VNICs within your Virtual Cloud Network (VCN).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Simple explanation (one paragraph)<\/h3>\n\n\n\n<p>IP Management in Oracle Cloud helps you control \u201cwhat IP address is used where\u201d so your applications have stable endpoints, your allowlists stay accurate, and your network changes don\u2019t accidentally break connectivity. The most common task is reserving a public IP so you can move it between resources (or keep it even if an instance is rebuilt), rather than relying on an ephemeral public IP that can change.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Technical explanation (one paragraph)<\/h3>\n\n\n\n<p>Technically, OCI IP Management centers on <strong>Public IP<\/strong> resources (ephemeral and reserved) and how they map to a <strong>Private IP<\/strong> on a VNIC in a subnet inside a VCN. You manage these objects within a region and compartment, enforce access with IAM policies, track changes via audit logs, and automate actions using the OCI Console, CLI, SDKs, and APIs. Advanced capabilities may include <strong>Bring Your Own IP (BYOIP)<\/strong>, depending on your account eligibility and region support (verify in official docs for your tenancy and region).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What problem it solves<\/h3>\n\n\n\n<p>IP Management solves common operational and architectural problems such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Preventing outages caused by <strong>changing public IPs<\/strong> during rebuilds or scaling events.<\/li>\n<li>Enabling stable endpoints for <strong>DNS records, partner allowlists, firewall rules<\/strong>, and integrations.<\/li>\n<li>Supporting patterns like \u201cfloating IP\u201d\/VIP-style failover using <strong>re-assignment<\/strong> (where supported).<\/li>\n<li>Improving governance with compartmentalization, tagging, and auditability of IP usage.<\/li>\n<\/ul>\n\n\n\n<blockquote>\n<p>Important scope note: OCI \u201cIP Management\u201d is not marketed as a standalone \u201centerprise IPAM\u201d product in the way some other clouds provide (for example, AWS VPC IPAM). In OCI, it\u2019s primarily <strong>public IP and related address administration<\/strong> within OCI Networking. For true enterprise IPAM (multi-site, multi-cloud, DHCP\/DNS sync, automated subnet planning), teams often integrate OCI with specialized IPAM tools (self-managed or commercial).<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is IP Management?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Official purpose<\/h3>\n\n\n\n<p>The purpose of <strong>IP Management<\/strong> in Oracle Cloud (OCI Networking, Edge, and Connectivity) is to let you <strong>manage IP addressing for OCI resources<\/strong>, primarily by controlling:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Allocation and lifecycle of <strong>Public IP addresses<\/strong><\/li>\n<li>Association of public IPs to <strong>Private IP<\/strong> objects<\/li>\n<li>(Where applicable) management of <strong>BYOIP<\/strong> address ranges<\/li>\n<\/ul>\n\n\n\n<p>Because OCI documentation and Console evolve, <strong>verify the exact screen names and supported operations in the official OCI Networking documentation<\/strong> for your tenancy\/region.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Core capabilities<\/h3>\n\n\n\n<p>At a practical level, IP Management commonly includes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Creating <strong>Reserved Public IPs<\/strong> for stable, reusable public endpoints<\/li>\n<li>Understanding and using <strong>Ephemeral Public IPs<\/strong> (temporary public addresses)<\/li>\n<li>Assigning\/unassigning public IPs to <strong>private IPs<\/strong> on VNICs<\/li>\n<li>Listing, tracking, and governing public IP inventory across compartments<\/li>\n<li>Automating tasks with <strong>OCI CLI\/SDK\/API<\/strong><\/li>\n<li>Tagging and auditing IP resources for cost, ownership, and compliance<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Major components (how OCI models it)<\/h3>\n\n\n\n<p>In OCI, IP-related networking is built from these core objects:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>VCN (Virtual Cloud Network):<\/strong> Your private network in OCI.<\/li>\n<li><strong>Subnet:<\/strong> A range within a VCN (regional in OCI).<\/li>\n<li><strong>VNIC (Virtual Network Interface Card):<\/strong> Attached to compute instances and some services.<\/li>\n<li><strong>Private IP:<\/strong> An address on a VNIC within a subnet. A VNIC can have a primary private IP and may support secondary private IPs (verify exact limits in docs).<\/li>\n<li><strong>Public IP:<\/strong> An internet-routable IPv4 address that maps to a private IP.<\/li>\n<li><strong>Ephemeral<\/strong>: Typically assigned automatically and released when you terminate certain resources (behavior depends on resource type; verify in docs).<\/li>\n<li><strong>Reserved<\/strong>: Stays allocated to your tenancy until you explicitly release it; can be reassigned.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Service type<\/h3>\n\n\n\n<p><strong>IP Management<\/strong> is best understood as a <strong>networking control-plane capability<\/strong> (resource administration) within OCI Networking\u2014not a data-plane packet processing service by itself.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Scope: regional\/global\/zonal and tenancy boundaries<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Tenancy-scoped governance:<\/strong> Controlled by IAM at the <strong>tenancy\/compartment<\/strong> level.<\/li>\n<li><strong>Regional behavior:<\/strong> Public IP resources and networking constructs are typically <strong>regional<\/strong> in OCI, though attachment\/association can depend on the underlying resource and availability domain constructs. Always confirm the exact scope in the relevant resource docs.<\/li>\n<li><strong>Compartment-scoped resources:<\/strong> Public IPs are created in a <strong>compartment<\/strong>, enabling delegated management.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How it fits into the Oracle Cloud ecosystem<\/h3>\n\n\n\n<p>IP Management is foundational to many services in the <strong>Networking, Edge, and Connectivity<\/strong> category and beyond:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Compute<\/strong> (instances with public endpoints)<\/li>\n<li><strong>Load Balancing<\/strong> (public load balancers \/ network load balancers that need fixed IPs)<\/li>\n<li><strong>Network Firewall \/ WAF<\/strong> (front-door designs often rely on stable IPs and DNS)<\/li>\n<li><strong>VPN \/ FastConnect<\/strong> (allowlisting and routing scenarios)<\/li>\n<li><strong>Kubernetes and microservices<\/strong> (ingress endpoints, NAT, egress controls)<\/li>\n<li><strong>Security and governance services<\/strong> (IAM, Audit, Logging)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use IP Management?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Reduce downtime risk:<\/strong> Stable IPs prevent integration breaks when infrastructure changes.<\/li>\n<li><strong>Faster incident recovery:<\/strong> Reassigning a reserved IP can speed up mitigation and restore service.<\/li>\n<li><strong>Partner integrations:<\/strong> Many partners require fixed IP allowlists for inbound\/outbound connectivity.<\/li>\n<li><strong>Change management:<\/strong> Clear inventory and ownership for IPs supports audit and compliance.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Stable endpoints:<\/strong> Reserved public IPs support consistent DNS A records and firewall rules.<\/li>\n<li><strong>Planned migration:<\/strong> Move traffic from one backend to another without changing the public endpoint.<\/li>\n<li><strong>Environment parity:<\/strong> Manage IPs per environment (dev\/test\/prod) via compartments and tags.<\/li>\n<li><strong>Automation:<\/strong> CLI\/SDK-based control reduces manual errors.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Inventory control:<\/strong> Prevent \u201cIP sprawl\u201d and unknown public exposure.<\/li>\n<li><strong>Delegation:<\/strong> Compartments let platform teams delegate IP tasks to app teams safely.<\/li>\n<li><strong>Auditability:<\/strong> Changes are trackable with OCI Audit and tags.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Minimize accidental exposure:<\/strong> Explicit control over public IP assignment reduces risk.<\/li>\n<li><strong>Policy enforcement:<\/strong> IAM policies restrict who can create and attach public IPs.<\/li>\n<li><strong>Governance:<\/strong> Tagging supports ownership, cost allocation, and compliance reporting.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability\/performance reasons<\/h3>\n\n\n\n<p>IP Management itself doesn\u2019t \u201cscale throughput,\u201d but it enables scalable architectures by ensuring:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Load balancers maintain stable IPs for clients.<\/li>\n<li>Blue\/green and canary patterns don\u2019t require frequent public endpoint changes.<\/li>\n<li>Egress controls (NAT or egress gateways) keep consistent outbound IPs for allowlisting.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose it<\/h3>\n\n\n\n<p>Choose OCI IP Management patterns when you need:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A <strong>fixed inbound IP<\/strong> for an API, webhook receiver, VPN endpoint, or load balancer.<\/li>\n<li>Stable <strong>outbound IP identity<\/strong> for SaaS allowlisting (often via NAT or controlled egress).<\/li>\n<li>A <strong>repeatable operational process<\/strong> for allocating and assigning public IPs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When they should not choose it<\/h3>\n\n\n\n<p>Avoid building designs that depend on frequently reassigning IPs if:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You can use <strong>DNS-based<\/strong> approaches (CNAME to managed endpoints) and tolerate TTL.<\/li>\n<li>You can front services with a <strong>load balancer<\/strong> and keep the endpoint stable there.<\/li>\n<li>You need full enterprise IPAM features (IP planning, DHCP\/DNS automation across hybrid). In that case, consider integrating OCI with a dedicated IPAM system.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is IP Management used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Financial services:<\/strong> Strict allowlisting, controlled change processes, audit needs<\/li>\n<li><strong>Healthcare:<\/strong> Regulated environments, controlled exposure, stable endpoints<\/li>\n<li><strong>SaaS \/ ISVs:<\/strong> Customer allowlists, stable API ingress, predictable outbound identity<\/li>\n<li><strong>Retail and e-commerce:<\/strong> Reliable public endpoints for storefronts and integrations<\/li>\n<li><strong>Manufacturing \/ IoT:<\/strong> Device gateways, VPN endpoints, stable ingestion endpoints<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud\/platform engineering teams<\/li>\n<li>Network engineering and NetSec teams<\/li>\n<li>DevOps\/SRE teams managing production endpoints<\/li>\n<li>Application teams owning internet-facing APIs<\/li>\n<li>Governance\/risk\/compliance teams needing evidence and control<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Internet-facing APIs and web apps<\/li>\n<li>VPN gateways and network appliances<\/li>\n<li>Bastion access patterns (though OCI Bastion service may reduce direct public exposure)<\/li>\n<li>Load-balanced microservices and ingress<\/li>\n<li>Data ingestion endpoints, webhook handlers<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Architectures<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Public front door with WAF\/LB and private backends<\/li>\n<li>Hub-and-spoke VCNs where shared services own public IPs<\/li>\n<li>DR setups where public endpoints must remain consistent<\/li>\n<li>Hybrid where on-premises firewalls allowlist specific cloud IPs<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Real-world deployment contexts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Production:<\/strong> Reserved public IPs are common for stable endpoints and change control.<\/li>\n<li><strong>Dev\/test:<\/strong> Ephemeral public IPs can be acceptable, but still require governance to avoid accidental exposure and surprise costs.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are realistic scenarios where OCI <strong>IP Management<\/strong> is a key enabling capability.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Stable public IP for a production API endpoint<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Your public API\u2019s IP changes when you rebuild instances, breaking clients and DNS caches.<\/li>\n<li><strong>Why IP Management fits:<\/strong> Reserve a public IP and attach it to the API endpoint\u2019s private IP or front it with a load balancer that uses reserved IPs (depending on service behavior).<\/li>\n<li><strong>Example:<\/strong> <code>api.example.com<\/code> must always resolve to the same IP for enterprise clients with strict allowlists.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Blue\/green cutover by reassigning a reserved public IP<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> You need a fast cutover between two backends without waiting for DNS TTL.<\/li>\n<li><strong>Why it fits:<\/strong> A reserved public IP can be reassigned (within supported constraints) to shift inbound traffic.<\/li>\n<li><strong>Example:<\/strong> Switch from green compute instance to blue instance during a release window.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) Fixed inbound IP for webhook receivers<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A partner SaaS only sends webhooks to allowlisted destination IPs.<\/li>\n<li><strong>Why it fits:<\/strong> Reserve and maintain a stable public IP for the receiver endpoint.<\/li>\n<li><strong>Example:<\/strong> Payment processor webhooks only to registered static IP.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) Outbound allowlisting to third-party APIs (controlled egress identity)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A vendor only accepts requests from known source IPs.<\/li>\n<li><strong>Why it fits:<\/strong> Use an architecture with controlled outbound IP (often via NAT or a dedicated egress path). IP Management helps you keep the outbound public IP stable.<\/li>\n<li><strong>Example:<\/strong> Data pipeline calls a partner API from a known IP.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Public load balancer endpoint with predictable IPs<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Clients require static IPs for a load-balanced service.<\/li>\n<li><strong>Why it fits:<\/strong> Load balancers can provide stable front-door endpoints; in designs needing fixed IPs, IP Management is part of how you reserve and track them.<\/li>\n<li><strong>Example:<\/strong> Enterprise customer firewall allowlists two IPs of your public load balancer.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Disaster recovery (DR) readiness with reserved IP inventory<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> During failover, you must quickly restore services with known endpoints.<\/li>\n<li><strong>Why it fits:<\/strong> Reserved public IPs (and documented assignment runbooks) simplify DR operations.<\/li>\n<li><strong>Example:<\/strong> DR cutover playbook includes reassigning reserved IPs to standby resources.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Compliance-driven public exposure control<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Security policy requires approvals for any public IP assignment.<\/li>\n<li><strong>Why it fits:<\/strong> IP Management combined with IAM policies, compartments, and audit trails enforces controls.<\/li>\n<li><strong>Example:<\/strong> Only NetSec group can create\/attach public IPs in production compartments.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) BYOIP for brand\/registry ownership and reputation continuity<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> You need to use IP ranges you own (reputation, regulatory, routing control).<\/li>\n<li><strong>Why it fits:<\/strong> BYOIP (if supported for your tenancy\/region) allows using customer-owned address space.<\/li>\n<li><strong>Example:<\/strong> Maintain outbound email reputation tied to owned IP ranges (note: email sending has additional requirements; verify in docs).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Stable \u201cjump host\u201d endpoint during migrations (short-lived but controlled)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Migration teams need a known entry point during a limited timeframe.<\/li>\n<li><strong>Why it fits:<\/strong> Reserved IP can remain stable across rebuilds; you can later release it.<\/li>\n<li><strong>Example:<\/strong> A bastion-style host with strict NSG rules and short TTL access.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) Shared services hub: centralized IP allocation and chargeback<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Multiple app teams request public endpoints; IP usage becomes chaotic.<\/li>\n<li><strong>Why it fits:<\/strong> Central IP Management with tagging (<code>CostCenter<\/code>, <code>Owner<\/code>, <code>App<\/code>) and compartment boundaries enables governance.<\/li>\n<li><strong>Example:<\/strong> Platform team manages a pool of reserved IPs and assigns them to approved services.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">11) M&amp;A \/ integration: avoid renumbering during transitional connectivity<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Integrations require stable IPs while network consolidation is in progress.<\/li>\n<li><strong>Why it fits:<\/strong> Reserved IPs provide a stable target even as backends move.<\/li>\n<li><strong>Example:<\/strong> Keep a stable inbound IP while moving workloads between VCNs via new load balancers.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">12) Security tooling integrations (SIEM\/SOAR callbacks)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> External security tooling needs a fixed callback target.<\/li>\n<li><strong>Why it fits:<\/strong> Stable public IP simplifies allowlisting and reduces operational churn.<\/li>\n<li><strong>Example:<\/strong> SOAR platform pushes alerts to your endpoint on a fixed IP.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<p>Because \u201cIP Management\u201d in OCI is a console grouping rather than a single isolated service, the \u201cfeatures\u201d below describe the practical capabilities you typically use.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 1: Reserved Public IP addresses<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Allocates a public IPv4 address that stays in your tenancy until you explicitly release it.<\/li>\n<li><strong>Why it matters:<\/strong> Prevents endpoint changes during rebuilds and supports consistent allowlisting.<\/li>\n<li><strong>Practical benefit:<\/strong> Stable DNS A record targets and consistent firewall rules.<\/li>\n<li><strong>Limitations\/caveats:<\/strong><\/li>\n<li>Availability and limits depend on OCI quotas and IPv4 availability in your region.<\/li>\n<li>Costs may apply for public IPv4 usage (verify current OCI pricing).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 2: Ephemeral Public IP addresses<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Provides a public IP that may be automatically assigned and later released depending on resource lifecycle.<\/li>\n<li><strong>Why it matters:<\/strong> Useful for non-production or short-lived needs.<\/li>\n<li><strong>Practical benefit:<\/strong> Faster provisioning with fewer administrative steps.<\/li>\n<li><strong>Limitations\/caveats:<\/strong><\/li>\n<li>IP may change on rebuild\/terminate; don\u2019t rely on it for allowlists.<\/li>\n<li>Governance risk if teams accidentally expose services publicly.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 3: Assigning a public IP to a private IP<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Maps a public IP to a <strong>private IP<\/strong> on a VNIC (the private IP is what the instance\/service actually uses inside the VCN).<\/li>\n<li><strong>Why it matters:<\/strong> Public reachability is controlled centrally and explicitly.<\/li>\n<li><strong>Practical benefit:<\/strong> You can move the public endpoint without changing private addressing.<\/li>\n<li><strong>Limitations\/caveats:<\/strong><\/li>\n<li>Association rules vary by resource type (compute vs LB vs other services). Verify specifics per service.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 4: Unassigning\/reassigning public IPs (lifecycle management)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Detaches a reserved public IP from one private IP and attaches to another (where supported).<\/li>\n<li><strong>Why it matters:<\/strong> Enables operational patterns such as fast cutover, controlled migrations, and incident mitigation.<\/li>\n<li><strong>Practical benefit:<\/strong> Reduce reliance on DNS TTL changes during urgent events.<\/li>\n<li><strong>Limitations\/caveats:<\/strong><\/li>\n<li>Not all reassignment patterns are supported for all services; verify before designing HA around it.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 5: Secondary private IPs on VNICs (where supported)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Adds additional private IPs to a VNIC.<\/li>\n<li><strong>Why it matters:<\/strong> Supports multi-IP workloads, virtual appliances, and some HA patterns.<\/li>\n<li><strong>Practical benefit:<\/strong> Separate services can bind to different IPs on the same interface.<\/li>\n<li><strong>Limitations\/caveats:<\/strong><\/li>\n<li>Limits apply per VNIC\/subnet; verify in OCI service limits.<\/li>\n<li>Application\/OS configuration must bind to the secondary IP.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 6: Compartment-based governance<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Places IP resources in compartments and controls access through IAM policies.<\/li>\n<li><strong>Why it matters:<\/strong> Reduces blast radius and supports separation between environments\/teams.<\/li>\n<li><strong>Practical benefit:<\/strong> Platform team can control production IP assignment tightly.<\/li>\n<li><strong>Limitations\/caveats:<\/strong><\/li>\n<li>Poor compartment design leads to policy sprawl; plan hierarchy carefully.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 7: Tagging (defined and free-form tags)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Adds metadata for cost allocation, ownership, and automation.<\/li>\n<li><strong>Why it matters:<\/strong> Public IPs are scarce and sometimes chargeable\u2014tags help manage them responsibly.<\/li>\n<li><strong>Practical benefit:<\/strong> Reports like \u201cunused reserved public IPs by owner.\u201d<\/li>\n<li><strong>Limitations\/caveats:<\/strong><\/li>\n<li>Tag governance requires discipline and possibly Tag Defaults.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 8: API\/CLI\/SDK automation<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Manages public\/private IP resources programmatically.<\/li>\n<li><strong>Why it matters:<\/strong> Enables repeatable IaC workflows and reduces manual mistakes.<\/li>\n<li><strong>Practical benefit:<\/strong> CI\/CD can allocate and bind IPs during deployments with approvals.<\/li>\n<li><strong>Limitations\/caveats:<\/strong><\/li>\n<li>Requires careful IAM and audit controls to prevent automation misuse.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 9: Auditability with OCI Audit<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Records control-plane events (create\/update\/delete\/attach) for IP resources.<\/li>\n<li><strong>Why it matters:<\/strong> Helps with investigations and compliance reporting.<\/li>\n<li><strong>Practical benefit:<\/strong> Trace who reassigned a production IP and when.<\/li>\n<li><strong>Limitations\/caveats:<\/strong><\/li>\n<li>Audit retention and access should be reviewed for compliance needs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 10: BYOIP (Bring Your Own IP) (advanced, if enabled)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Allows you to use IP ranges you own within OCI (subject to OCI support and validation).<\/li>\n<li><strong>Why it matters:<\/strong> Reputation continuity, regulatory, routing control, IP ownership.<\/li>\n<li><strong>Practical benefit:<\/strong> Maintain consistent IP identity across providers or migrations.<\/li>\n<li><strong>Limitations\/caveats:<\/strong><\/li>\n<li>Requires ownership validation and has operational\/routing requirements.<\/li>\n<li>Not all accounts\/regions are eligible; verify in official docs.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">High-level architecture<\/h3>\n\n\n\n<p>OCI IP Management is primarily <strong>control-plane orchestration<\/strong> over networking address objects:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>You create a <strong>Reserved Public IP<\/strong> in a compartment.<\/li>\n<li>You identify the <strong>Private IP<\/strong> on a VNIC that should be internet-reachable.<\/li>\n<li>You associate (assign) the reserved public IP to that private IP.<\/li>\n<li>Routing and security controls (route tables, security lists\/NSGs, gateways) determine whether traffic can actually reach the workload.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Request\/data\/control flow<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control plane:<\/strong> You (or automation) calls OCI APIs (Console\/CLI\/SDK) to create and attach IP resources.<\/li>\n<li><strong>Data plane:<\/strong> Internet traffic to the public IP is routed by OCI to the mapped private IP, then enforced by:<\/li>\n<li>Subnet routing (IGW\/NAT\/SGW as appropriate)<\/li>\n<li>Security lists and\/or NSGs<\/li>\n<li>Host firewall and application listeners<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Integrations with related services<\/h3>\n\n\n\n<p>Common integrations in the <strong>Networking, Edge, and Connectivity<\/strong> ecosystem:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>VCN\/Subnets\/Route tables:<\/strong> Determine reachability.<\/li>\n<li><strong>Internet Gateway (IGW):<\/strong> Required for inbound internet traffic to public subnets.<\/li>\n<li><strong>NAT Gateway:<\/strong> Common for stable outbound egress from private subnets (with NAT gateway\u2019s public IP behavior; verify details for your region and current OCI implementation).<\/li>\n<li><strong>Load Balancer \/ Network Load Balancer:<\/strong> Often the correct way to present stable public endpoints at scale.<\/li>\n<li><strong>DNS (OCI DNS or external):<\/strong> Typically maps hostnames to public IPs.<\/li>\n<li><strong>OCI Bastion:<\/strong> Preferred over permanently exposing SSH\/RDP publicly (reduces need for public IP on instances).<\/li>\n<li><strong>IAM + Audit + Logging:<\/strong> Governance and traceability.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Dependency services<\/h3>\n\n\n\n<p>You usually need:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A <strong>VCN<\/strong> and <strong>subnet<\/strong><\/li>\n<li>A target resource with a <strong>VNIC and private IP<\/strong> (compute instance, LB, etc.)<\/li>\n<li>Network path and controls: <strong>IGW<\/strong>, route tables, security lists\/NSGs<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/authentication model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Authentication is via <strong>OCI IAM<\/strong> (users, groups, dynamic groups, instance principals).<\/li>\n<li>Authorization is via <strong>IAM policies<\/strong> granting rights to <code>public-ips<\/code> (and related networking resources).<\/li>\n<li>All changes are captured in <strong>OCI Audit<\/strong>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Networking model<\/h3>\n\n\n\n<p>OCI networking is VCN-based. A public IP is not \u201cattached to the instance\u201d directly; it is associated to a <strong>private IP object<\/strong>, which is associated to a VNIC in a subnet.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Monitoring\/logging\/governance<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Audit logs<\/strong> show control-plane changes (who allocated\/assigned an IP).<\/li>\n<li><strong>VCN flow logs<\/strong> (if enabled) and <strong>service logs<\/strong> can help troubleshoot traffic.<\/li>\n<li><strong>Tagging<\/strong> is critical for governance and cost controls.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Simple architecture diagram (Mermaid)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  User[Admin \/ CI Pipeline] --&gt;|Console \/ CLI \/ API| OCI[OCI Control Plane]\n  OCI --&gt;|Create Reserved Public IP| PubIP[(Reserved Public IP)]\n  OCI --&gt;|Associate to| PrivIP[(Private IP on VNIC)]\n  Internet((Internet)) --&gt;|Traffic to Public IP| PubIP\n  PubIP --&gt; PrivIP --&gt; App[Compute Instance \/ Service]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Production-style architecture diagram (Mermaid)<\/h3>\n\n\n\n<p>This example shows a common production pattern: stable public entry via a managed front door, private backends, and controlled administration of public IPs.<\/p>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  subgraph Internet\n    C[Clients]\n  end\n\n  subgraph OCI_Region[OCI Region]\n    subgraph Edge[Edge \/ Public Zone]\n      WAF[WAF or Edge Policy\\n(optional, verify service availability)]\n      LB[Public Load Balancer \/ NLB\\nwith Stable Public Endpoint]\n      IPM[IP Management\\n(Reserved Public IP inventory)]\n    end\n\n    subgraph VCN[VCN]\n      subgraph PublicSubnet[Public Subnet]\n        IGW[Internet Gateway]\n      end\n      subgraph PrivateSubnet[Private Subnet]\n        APP1[App VM\/Node 1\\nPrivate IP]\n        APP2[App VM\/Node 2\\nPrivate IP]\n        DB[(Database)]\n      end\n\n      NSG[NSGs \/ Security Lists]\n      RT[Route Tables]\n      AUD[Audit Logs]\n    end\n  end\n\n  C --&gt; WAF --&gt; LB\n  IPM --- LB\n  LB --&gt;|Backend traffic| APP1\n  LB --&gt;|Backend traffic| APP2\n  APP1 --&gt; DB\n  APP2 --&gt; DB\n\n  IGW --- LB\n  NSG --- APP1\n  NSG --- APP2\n  RT --- PublicSubnet\n  RT --- PrivateSubnet\n  AUD --- IPM\n<\/code><\/pre>\n\n\n\n<blockquote>\n<p>Notes:\n&#8211; Whether a load balancer uses \u201creserved public IPs\u201d directly or exposes stable IPs through its own lifecycle depends on the OCI load balancer type and configuration\u2014verify the current behavior in OCI documentation for the specific load balancer service you use.\n&#8211; WAF integration varies by OCI service offerings and region; verify in official docs.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Tenancy\/account requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An active <strong>Oracle Cloud (OCI) tenancy<\/strong><\/li>\n<li>Access to the <strong>OCI Console<\/strong> and\/or ability to use <strong>OCI CLI<\/strong><\/li>\n<li>A compartment structure where you can create networking resources<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Permissions \/ IAM policies<\/h3>\n\n\n\n<p>You need permissions to manage:\n&#8211; VCN, subnets, route tables, gateways (as applicable)\n&#8211; Public IPs\n&#8211; Compute instance networking (if you\u2019ll attach to an instance)<\/p>\n\n\n\n<p>Typical IAM policy patterns (examples; adjust to your org). <strong>Verify exact resource names and policy grammar in OCI IAM docs<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Allow network admins to manage public IPs:<\/li>\n<li><code>Allow group NetworkAdmins to manage public-ips in compartment &lt;compartment-name&gt;<\/code><\/li>\n<li>Allow app team to use, but not broadly manage networking (principle of least privilege):<\/li>\n<li>Might involve permissions to read networking and to use specific resources.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Billing requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Some public IP usage may incur charges depending on OCI\u2019s current pricing and your contract.<\/li>\n<li>Ensure your account has billing enabled if required.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Tools needed<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI Console<\/strong> (web)<\/li>\n<li>Optional but recommended:<\/li>\n<li><strong>OCI CLI<\/strong>: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/API\/Concepts\/cliconcepts.htm (verify URL if Oracle reorganizes docs)<\/li>\n<li>A shell environment (Cloud Shell or local terminal)<\/li>\n<li><code>ssh<\/code> client (if you launch a compute instance)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Region availability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>IP Management basics (public IPs) are broadly available, but quotas and features vary by region.<\/li>\n<li><strong>BYOIP<\/strong> and certain edge integrations may be region- or account-dependent. Verify in official docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas\/limits to check<\/h3>\n\n\n\n<p>Before designing or running the lab, check:\n&#8211; Public IP address limits per region\/compartment\n&#8211; VNIC and private IP limits per instance type\n&#8211; Any tenancy-wide IPv4 constraints<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisite services for the lab<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>VCN (or use the VCN Wizard)<\/li>\n<li>Compute instance (for a simple demonstration)<\/li>\n<li>Internet Gateway and route rule (for public access)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing model (how costs usually work)<\/h3>\n\n\n\n<p>OCI IP Management as an administrative capability is not typically billed as a standalone \u201cservice.\u201d Costs generally come from the underlying billable resources, commonly:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Public IPv4 addresses<\/strong> (reserved and\/or in-use): pricing and billing dimensions may vary by region and over time.<\/li>\n<li><strong>Network egress (data transfer out)<\/strong>: often a major cost driver for internet-facing services.<\/li>\n<li><strong>Load balancers, NAT gateways, compute instances<\/strong>: if used as part of your design.<\/li>\n<\/ul>\n\n\n\n<p>Because pricing changes and depends on region and contract, <strong>do not rely on static numbers<\/strong>. Use official sources:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI Pricing page: https:\/\/www.oracle.com\/cloud\/pricing\/<\/li>\n<li>OCI Cost Estimator: https:\/\/www.oracle.com\/cloud\/costestimator.html (verify if Oracle changes URL)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing dimensions to understand<\/h3>\n\n\n\n<p>When estimating IP-related costs, consider:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Public IPv4 allocation<\/strong>\n   &#8211; Are you charged per public IPv4 <strong>per hour\/month<\/strong>?\n   &#8211; Is the rate different for <strong>reserved but unassigned<\/strong> IPs?\n   &#8211; Are ephemeral IPs charged differently than reserved?\n   &#8211; <strong>Verify in official pricing<\/strong> for \u201cPublic IP\u201d or \u201cIP address\u201d billing items.<\/p>\n<\/li>\n<li>\n<p><strong>Data transfer<\/strong>\n   &#8211; Internet egress can be charged by GB.\n   &#8211; Cross-region and interconnect egress may also apply depending on architecture.<\/p>\n<\/li>\n<li>\n<p><strong>Supporting services<\/strong>\n   &#8211; <strong>Load balancers<\/strong>: billed by shape\/capacity and data processed (varies by LB type).\n   &#8211; <strong>NAT gateways<\/strong>: may have hourly and data processing charges (verify current pricing).\n   &#8211; <strong>Compute<\/strong>: instance cost is often larger than the IP cost in labs, but in production IP inventory can be meaningful.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Free tier considerations<\/h3>\n\n\n\n<p>Oracle Cloud has a Free Tier program, but whether public IP-related charges are included or excluded depends on current terms and specific SKUs. <strong>Verify Free Tier eligibility and current limits<\/strong>:\n&#8211; https:\/\/www.oracle.com\/cloud\/free\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Cost drivers (common)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Keeping many <strong>reserved public IPs<\/strong> allocated but unused<\/li>\n<li>Scaling out many public endpoints instead of using a shared front door (LB\/API gateway)<\/li>\n<li>High internet egress (downloads, media, APIs with large responses)<\/li>\n<li>Long-lived \u201ctemporary\u201d environments that never get cleaned up<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Hidden or indirect costs<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Operational cost<\/strong>: mismanaged IPs lead to outages and incident time.<\/li>\n<li><strong>Security cost<\/strong>: accidental public exposure can trigger incident response and compliance remediation.<\/li>\n<li><strong>Reputation cost<\/strong>: changing IPs can affect allowlists and integrations.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How to optimize cost<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Prefer <strong>load balancers<\/strong> or managed front doors rather than many public IPs on instances.<\/li>\n<li>Use <strong>OCI Bastion<\/strong> instead of exposing SSH\/RDP on public IPs (where feasible).<\/li>\n<li>Implement tag-based reporting to identify:<\/li>\n<li>Unused reserved public IPs<\/li>\n<li>IPs without owners<\/li>\n<li>IPs in non-production compartments that should be released<\/li>\n<li>Automate cleanup in dev\/test.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Example low-cost starter estimate (no fabricated numbers)<\/h3>\n\n\n\n<p>A low-cost lab typically uses:\n&#8211; 1 small compute instance\n&#8211; 1 VCN with 1 public subnet\n&#8211; 1 reserved public IP for a short time<\/p>\n\n\n\n<p>The cost depends on:\n&#8211; Whether your compute instance is always-free eligible\n&#8211; Whether public IPv4 addresses are billed in your region\n&#8211; How long you keep the reserved IP allocated\n&#8211; Egress traffic you generate (keep it minimal)<\/p>\n\n\n\n<p>Use the OCI Cost Estimator and select your region to produce an accurate estimate.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example production cost considerations<\/h3>\n\n\n\n<p>In production, costs can rise due to:\n&#8211; Multiple environments each keeping pools of reserved IPs\n&#8211; Multiple public load balancers with fixed endpoints\n&#8211; Significant egress traffic\n&#8211; Multi-region designs duplicating endpoints<\/p>\n\n\n\n<p>A good practice is to maintain an \u201cIP budget\u201d (count and cost) per environment and enforce it with quotas and governance.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<p>Create and manage a <strong>Reserved Public IP<\/strong> using <strong>OCI IP Management<\/strong>, attach it to a <strong>compute instance<\/strong>, verify connectivity, then safely clean up to avoid ongoing charges.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<p>You will:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Create a VCN with a public subnet (using the VCN Wizard).<\/li>\n<li>Launch a small compute instance in the public subnet.<\/li>\n<li>Allocate a Reserved Public IP in <strong>IP Management<\/strong>.<\/li>\n<li>Associate the Reserved Public IP to the instance\u2019s private IP.<\/li>\n<li>Validate the public endpoint.<\/li>\n<li>Troubleshoot common issues.<\/li>\n<li>Clean up (release IP and delete resources).<\/li>\n<\/ol>\n\n\n\n<p>This lab is designed to be <strong>beginner-friendly<\/strong> and <strong>low-risk<\/strong>. Costs depend on region and pricing for public IPs\u2014keep the lab short and clean up afterward.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Create a compartment (optional but recommended)<\/h3>\n\n\n\n<p><strong>Console steps<\/strong>\n1. Open the OCI Console.\n2. Go to <strong>Identity &amp; Security<\/strong> \u2192 <strong>Compartments<\/strong>.\n3. Create a compartment such as:\n   &#8211; Name: <code>lab-ip-management<\/code>\n   &#8211; Description: <code>IP Management lab resources<\/code><\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; A dedicated compartment for isolation and easy cleanup.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Create a VCN with internet connectivity<\/h3>\n\n\n\n<p>Use the VCN Wizard so you don\u2019t miss routing or gateways.<\/p>\n\n\n\n<p><strong>Console steps<\/strong>\n1. Navigate to <strong>Networking<\/strong> \u2192 <strong>Virtual Cloud Networks<\/strong>.\n2. Select the compartment <code>lab-ip-management<\/code>.\n3. Click <strong>Start VCN Wizard<\/strong>.\n4. Choose <strong>VCN with Internet Connectivity<\/strong> (wording may vary slightly).\n5. Enter:\n   &#8211; VCN name: <code>vcn-ipm-lab<\/code>\n   &#8211; CIDR: accept default (for example, <code>10.0.0.0\/16<\/code>) or choose your own\n   &#8211; Public subnet: accept defaults<\/p>\n\n\n\n<ol class=\"wp-block-list\" start=\"6\">\n<li>Create the VCN.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; A VCN with:\n  &#8211; 1 public subnet\n  &#8211; Internet Gateway (IGW)\n  &#8211; Route table with default route to IGW\n  &#8211; Security list allowing basic traffic (review rules carefully)<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; In the VCN details, confirm an <strong>Internet Gateway<\/strong> exists and is enabled.\n&#8211; Confirm the public subnet route table contains a route rule to the IGW (0.0.0.0\/0).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Launch a compute instance in the public subnet<\/h3>\n\n\n\n<p><strong>Console steps<\/strong>\n1. Go to <strong>Compute<\/strong> \u2192 <strong>Instances<\/strong> \u2192 <strong>Create instance<\/strong>.\n2. Choose:\n   &#8211; Name: <code>vm-ipm-lab<\/code>\n   &#8211; Compartment: <code>lab-ip-management<\/code>\n   &#8211; Placement: choose an Availability Domain (if prompted)\n   &#8211; Image: Oracle Linux (or another supported image)\n   &#8211; Shape: choose a small\/low-cost shape (and Always Free eligible if available)\n3. Under networking:\n   &#8211; Select VCN: <code>vcn-ipm-lab<\/code>\n   &#8211; Select public subnet created by the wizard\n   &#8211; Ensure <strong>Assign a public IPv4 address<\/strong> is enabled (this may assign an ephemeral public IP initially)<\/p>\n\n\n\n<ol class=\"wp-block-list\" start=\"4\">\n<li>Create SSH keys or upload your public key.<\/li>\n<li>Create the instance and wait until it is <strong>Running<\/strong>.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; Instance is running and has:\n  &#8211; A private IP in the public subnet\n  &#8211; Possibly an <strong>ephemeral public IP<\/strong> assigned automatically<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; Open the instance details page and note:\n  &#8211; Public IP (if present)\n  &#8211; Private IP\n&#8211; Try SSH (if port 22 is allowed and you configured keys):\n  <code>bash\n  ssh -i \/path\/to\/private_key opc@&lt;public-ip&gt;<\/code><\/p>\n\n\n\n<blockquote>\n<p>Security note: If SSH is open to the internet, restrict the source CIDR to your IP only. Prefer OCI Bastion for production.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Allocate a Reserved Public IP (IP Management)<\/h3>\n\n\n\n<p>Now you will create a public IP that persists until you release it.<\/p>\n\n\n\n<p><strong>Console steps<\/strong>\n1. Go to <strong>Networking<\/strong> \u2192 <strong>IP Management<\/strong> (menu naming may vary by Console version).\n2. Find <strong>Public IPs<\/strong> (or <strong>Reserved Public IPs<\/strong>).\n3. Click <strong>Create reserved public IP<\/strong>.\n4. Choose:\n   &#8211; Compartment: <code>lab-ip-management<\/code>\n   &#8211; Name: <code>ipm-lab-reserved-ip<\/code>\n   &#8211; (Optional) Tags: <code>Owner=yourname<\/code>, <code>Env=Lab<\/code><\/p>\n\n\n\n<ol class=\"wp-block-list\" start=\"5\">\n<li>Create it.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; A <strong>Reserved Public IP<\/strong> resource exists in your compartment.\n&#8211; Its lifecycle state should show as available\/allocated (wording varies).<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; In the public IP list, ensure <code>ipm-lab-reserved-ip<\/code> exists and note the IP address and OCID.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Associate the Reserved Public IP with the instance private IP<\/h3>\n\n\n\n<p>In OCI, a public IP is associated with a <strong>private IP<\/strong> object.<\/p>\n\n\n\n<p><strong>Console steps<\/strong>\n1. Go to your instance <code>vm-ipm-lab<\/code>.\n2. Open <strong>Attached VNICs<\/strong> \u2192 click the primary VNIC.\n3. Click the <strong>Private IP address<\/strong> entry (primary private IP).\n4. Look for an option like <strong>Assign public IP<\/strong> \/ <strong>Edit<\/strong> \/ <strong>Associate public IP<\/strong> (Console wording can differ).\n5. Choose <strong>Reserved public IP<\/strong> and select <code>ipm-lab-reserved-ip<\/code>.\n6. Save\/confirm.<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; The instance is now reachable at the <strong>reserved<\/strong> public IP.\n&#8211; The original ephemeral public IP (if any) may be removed or replaced depending on OCI behavior for that resource\u2014verify in the instance networking details.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; From your machine:\n  <code>bash\n  ssh -i \/path\/to\/private_key opc@&lt;reserved-public-ip&gt;<\/code>\n&#8211; If you have a web server listening (optional), you can test:\n  <code>bash\n  curl -I http:\/\/&lt;reserved-public-ip&gt;<\/code><\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6 (Optional): Perform the same actions with OCI CLI (automation view)<\/h3>\n\n\n\n<p>This step shows how IP Management can be automated.<\/p>\n\n\n\n<blockquote>\n<p>If you use OCI Cloud Shell, OCI CLI is typically preinstalled. Otherwise, install and configure OCI CLI first.<\/p>\n<\/blockquote>\n\n\n\n<p><strong>1) Set variables<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">export COMPARTMENT_OCID=\"&lt;your_compartment_ocid&gt;\"\nexport INSTANCE_OCID=\"&lt;your_instance_ocid&gt;\"\n<\/code><\/pre>\n\n\n\n<p><strong>2) Find the VNIC and private IP<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\"># List VNICs attached to the instance\noci compute instance list-vnics --instance-id \"$INSTANCE_OCID\"\n\n# Use the returned VNIC OCID:\nexport VNIC_OCID=\"&lt;vnic_ocid&gt;\"\n\n# List private IPs on the VNIC\noci network private-ip list --vnic-id \"$VNIC_OCID\"\n# Capture the primary private IP OCID:\nexport PRIVATE_IP_OCID=\"&lt;private_ip_ocid&gt;\"\n<\/code><\/pre>\n\n\n\n<p><strong>3) Create a reserved public IP<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">oci network public-ip create \\\n  --compartment-id \"$COMPARTMENT_OCID\" \\\n  --lifetime RESERVED \\\n  --display-name \"ipm-lab-reserved-ip-cli\"\n<\/code><\/pre>\n\n\n\n<p>Capture the returned public IP OCID:<\/p>\n\n\n\n<pre><code class=\"language-bash\">export PUBLIC_IP_OCID=\"&lt;public_ip_ocid&gt;\"\n<\/code><\/pre>\n\n\n\n<p><strong>4) Associate the reserved public IP to the private IP<\/strong>\nDepending on the CLI\/API model, you either create it already associated or update it. A common approach is updating the public IP with a private IP association:<\/p>\n\n\n\n<pre><code class=\"language-bash\">oci network public-ip update \\\n  --public-ip-id \"$PUBLIC_IP_OCID\" \\\n  --private-ip-id \"$PRIVATE_IP_OCID\"\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; The reserved public IP is now mapped to the instance\u2019s private IP.<\/p>\n\n\n\n<p><strong>Verification<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">oci network public-ip get --public-ip-id \"$PUBLIC_IP_OCID\"\n<\/code><\/pre>\n\n\n\n<blockquote>\n<p>If CLI parameters differ in your CLI version, verify the current syntax with:\n<code>bash\noci network public-ip --help<\/code><\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>Use this checklist:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Public IP exists<\/strong> in Networking \u2192 IP Management \u2192 Public IPs.<\/li>\n<li>The public IP shows an association to the instance\u2019s <strong>private IP<\/strong> (where visible).<\/li>\n<li>You can reach the instance:\n   &#8211; SSH works (if enabled)\n   &#8211; Ping may be blocked (ICMP often restricted), so don\u2019t use ping as the only test<\/li>\n<li>Route table has <strong>0.0.0.0\/0 \u2192 IGW<\/strong> for the public subnet.<\/li>\n<li>Security list \/ NSG allows required inbound port(s) from your source CIDR.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Issue: SSH times out to the reserved public IP<\/h4>\n\n\n\n<p>Common causes and fixes:\n&#8211; <strong>No IGW route:<\/strong> Ensure the public subnet route table has 0.0.0.0\/0 to the Internet Gateway.\n&#8211; <strong>Security list\/NSG blocks port 22:<\/strong> Add an ingress rule for TCP\/22 from your IP (not 0.0.0.0\/0 for production).\n&#8211; <strong>Host firewall blocks SSH:<\/strong> On Oracle Linux, confirm <code>sshd<\/code> is running and firewall allows it.\n&#8211; <strong>Wrong username:<\/strong> Oracle Linux commonly uses <code>opc<\/code>. Other images differ.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Issue: Reserved public IP cannot be associated<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ensure you have permission to manage <code>public-ips<\/code> and read\/modify the relevant private IP.<\/li>\n<li>Verify the private IP is eligible for association (some service-managed interfaces have constraints).<\/li>\n<li>Check compartment boundaries (public IP and private IP operations might require permissions in both contexts).<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Issue: The instance still shows the old ephemeral IP<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI behavior varies by resource type and workflow. Confirm which public IP is actually associated with the private IP you\u2019re targeting.<\/li>\n<li>Use the <strong>private IP details<\/strong> view to see the associated public IP.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Issue: You can connect, but application traffic fails (HTTP\/HTTPS)<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Open the correct port in NSG\/security list (80\/443).<\/li>\n<li>Ensure the application listens on <code>0.0.0.0<\/code> (all interfaces) and the expected port.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<p>To avoid ongoing charges and reduce exposure, delete resources when done.<\/p>\n\n\n\n<p><strong>1) Unassign and release reserved public IPs<\/strong>\n&#8211; Go to <strong>Networking \u2192 IP Management \u2192 Public IPs<\/strong>\n&#8211; For each reserved IP you created:\n  &#8211; Unassign it (if required by Console workflow)\n  &#8211; Delete\/release it<\/p>\n\n\n\n<p><strong>2) Terminate the compute instance<\/strong>\n&#8211; Compute \u2192 Instances \u2192 <code>vm-ipm-lab<\/code> \u2192 <strong>Terminate<\/strong>\n&#8211; Confirm termination<\/p>\n\n\n\n<p><strong>3) Delete the VCN<\/strong>\n&#8211; Networking \u2192 VCNs \u2192 <code>vcn-ipm-lab<\/code> \u2192 <strong>Delete<\/strong>\n&#8211; The wizard-created VCN includes multiple dependent objects; OCI usually handles dependencies, but you may need to delete sub-resources first if prompted.<\/p>\n\n\n\n<p><strong>4) Delete the compartment (optional)<\/strong>\n&#8211; Only if it contains no resources.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>reserved public IPs<\/strong> for production endpoints that must not change.<\/li>\n<li>Prefer <strong>managed front doors<\/strong> (load balancers, API gateways, WAF where applicable) over public IPs on individual instances.<\/li>\n<li>Keep most workloads in <strong>private subnets<\/strong>; expose only the minimum required edge.<\/li>\n<li>Design for <strong>change<\/strong>: rebuild instances freely, keep endpoints stable via IP or LB.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Separate duties:<\/li>\n<li>Network team manages public IP allocation\/assignment.<\/li>\n<li>App teams consume endpoints but don\u2019t get broad <code>manage<\/code> permissions.<\/li>\n<li>Use compartments:<\/li>\n<li><code>Prod-Network<\/code>, <code>Prod-Apps<\/code>, <code>NonProd<\/code>, etc.<\/li>\n<li>Use <strong>least privilege<\/strong> policies and prefer dynamic groups\/instance principals for automation.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Track and review reserved IP inventory regularly.<\/li>\n<li>Use tags like:<\/li>\n<li><code>Owner<\/code>, <code>CostCenter<\/code>, <code>Environment<\/code>, <code>ExpiryDate<\/code><\/li>\n<li>Automate cleanup of unused reserved IPs in non-production.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>IP Management doesn\u2019t tune throughput, but performance architectures benefit from:<\/li>\n<li>Load balancing instead of single-instance public endpoints<\/li>\n<li>Reduced hop count and correct subnet\/routing design<\/li>\n<li>Avoiding overuse of NAT instances (prefer managed gateways where appropriate)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Avoid \u201csingle VM with public IP\u201d as your only production design.<\/li>\n<li>Put stable public endpoints on highly available services (LB\/NLB) where possible.<\/li>\n<li>Keep a documented runbook for:<\/li>\n<li>IP reassignment procedures (if used)<\/li>\n<li>DNS update procedures (TTL strategy)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Monitor:<\/li>\n<li>Audit events for IP changes<\/li>\n<li>Flow logs (if enabled) for traffic patterns<\/li>\n<li>Maintain an IP registry:<\/li>\n<li>At minimum: IP \u2192 owner \u2192 purpose \u2192 environment \u2192 expiration date<\/li>\n<li>Use IaC (Terraform for OCI is common) for repeatable networking baselines; keep manual exceptions minimal.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Naming convention examples:<\/li>\n<li><code>pip-prod-api-01<\/code><\/li>\n<li><code>pip-nonprod-webhook-01<\/code><\/li>\n<li>Tagging convention examples:<\/li>\n<li><code>Environment=Prod|NonProd<\/code><\/li>\n<li><code>DataClassification=Public|Internal|Confidential<\/code><\/li>\n<li><code>OwnerEmail=team@example.com<\/code><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Access is controlled through <strong>OCI IAM<\/strong> policies.<\/li>\n<li>Key controls:<\/li>\n<li>Who can create reserved public IPs?<\/li>\n<li>Who can assign them to private IPs?<\/li>\n<li>Who can list inventory across compartments?<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>IP addresses themselves are control-plane metadata; encryption considerations typically apply to:<\/li>\n<li>Application traffic (TLS)<\/li>\n<li>Secrets used by automation tools<\/li>\n<li>Logs and audit storage<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A public IP makes a target reachable from the internet <em>if routing and security rules permit<\/em>.<\/li>\n<li>Reduce exposure by:<\/li>\n<li>Restricting ingress CIDRs<\/li>\n<li>Using NSGs to tightly scope rules<\/li>\n<li>Avoiding public SSH\/RDP in production<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>If you automate IP assignment with CI\/CD, store OCI API keys\/secrets securely:<\/li>\n<li>OCI Vault (where applicable)<\/li>\n<li>Use instance principals\/dynamic groups when possible to avoid static keys<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable and monitor <strong>OCI Audit<\/strong> for:<\/li>\n<li>Public IP create\/update\/delete<\/li>\n<li>Changes to route tables\/IGW<\/li>\n<li>Security list\/NSG changes<\/li>\n<li>Consider alerting on:<\/li>\n<li>Creation of public IPs in production<\/li>\n<li>Attachment of public IPs to unexpected subnets\/resources<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Maintain evidence of:<\/li>\n<li>Who approved public exposure<\/li>\n<li>Which services use public IPs<\/li>\n<li>Change history (audit logs)<\/li>\n<li>Use tags and compartments to support compliance reporting and least privilege.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Common security mistakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Leaving SSH open to the world (<code>0.0.0.0\/0<\/code>)<\/li>\n<li>Allocating many reserved IPs and forgetting them<\/li>\n<li>No ownership tagging, leading to \u201cmystery endpoints\u201d<\/li>\n<li>Treating ephemeral IPs as stable identifiers in allowlists<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Put edge services behind managed front doors when feasible.<\/li>\n<li>Use <strong>OCI Bastion<\/strong> for administrative access rather than permanent public IPs on instances.<\/li>\n<li>Implement policy guardrails:<\/li>\n<li>Only allow public IP creation\/assignment in specific compartments.<\/li>\n<li>Require defined tags on public IP resources (tag enforcement where possible).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Known limitations (common patterns)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Not a full enterprise IPAM:<\/strong> OCI IP Management is primarily public IP lifecycle management within OCI. For enterprise IP planning and hybrid IPAM, use dedicated tools and integrate.<\/li>\n<li><strong>IPv4 scarcity:<\/strong> Public IPv4 is limited; quotas apply and may require requests.<\/li>\n<li><strong>Resource constraints:<\/strong> Some managed services\/interfaces have constraints on how public IPs can be attached.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Public IP quotas vary by tenancy and region. Check <strong>Service Limits<\/strong> in OCI.<\/li>\n<li>VNIC\/private IP limits vary by instance shape and OCI limits.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Regional constraints<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Feature availability (including BYOIP) and quotas can differ by region.<\/li>\n<li>Always validate in the region where you deploy.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing surprises<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Reserved public IPs that remain allocated but unused can still cost (depending on current OCI pricing rules).<\/li>\n<li>Egress traffic typically costs more than the IP itself.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compatibility issues<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Some \u201cfloating IP\u201d HA patterns that work on-prem may not map 1:1 in cloud.<\/li>\n<li>Reassignment behaviors differ by resource type. Verify supported reassignment workflows before relying on them for HA.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational gotchas<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Confusing \u201cpublic IP on the instance\u201d with \u201cpublic IP associated to private IP object.\u201d<\/li>\n<li>Updating DNS without accounting for TTL and client caching.<\/li>\n<li>Forgetting to update allowlists (partners\/customers) after changes.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Migration challenges<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Lifting-and-shifting systems that require fixed IPs for licensing or allowlists needs careful design.<\/li>\n<li>BYOIP migrations add complexity (validation, routing, governance).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Vendor-specific nuances<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI networking uses specific constructs (VCN, NSG, DRG). Be cautious when translating patterns from other clouds.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Nearest services in the same cloud (Oracle Cloud)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI Load Balancing \/ Network Load Balancer:<\/strong> Often a better production front door than assigning public IPs directly to instances.<\/li>\n<li><strong>OCI DNS:<\/strong> Manages name-to-IP mapping; can reduce dependency on fixed IP reassignment if DNS-based failover is acceptable.<\/li>\n<li><strong>OCI Bastion:<\/strong> Reduces need for public IPs on administrative endpoints.<\/li>\n<li><strong>NAT Gateway:<\/strong> Helps provide controlled outbound connectivity without public IPs on instances (verify exact outbound IP behavior and billing).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Nearest services in other clouds<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AWS VPC IPAM:<\/strong> A dedicated IPAM service for planning and tracking IPs across VPCs and accounts.<\/li>\n<li><strong>Azure IP address management offerings:<\/strong> Azure has IP address features and governance; dedicated IPAM-like capabilities vary and may rely on integrations.<\/li>\n<li><strong>Google Cloud IP address management patterns:<\/strong> Primarily address reservation\/assignment; enterprise IPAM typically via partners\/tools.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Open-source or self-managed alternatives<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>NetBox (open-source):<\/strong> Popular for enterprise IPAM\/DCIM; can be integrated with OCI via automation.<\/li>\n<li><strong>phpIPAM:<\/strong> Another IPAM tool for IP tracking.<\/li>\n<li>Commercial: Infoblox, BlueCat (verify product fit and integration approach for OCI).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Comparison table<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>OCI IP Management (Public IPs\/Private IP associations)<\/strong><\/td>\n<td>Managing OCI public IP lifecycle and assignments<\/td>\n<td>Native, IAM-integrated, auditable, automatable<\/td>\n<td>Not a full enterprise IPAM; scope is OCI-centric<\/td>\n<td>You need stable OCI public endpoints and governance<\/td>\n<\/tr>\n<tr>\n<td><strong>OCI Load Balancer \/ Network Load Balancer<\/strong><\/td>\n<td>Production ingress at scale<\/td>\n<td>HA, TLS features, backend pooling, stable front door patterns<\/td>\n<td>Extra service cost and configuration<\/td>\n<td>Most internet-facing production apps<\/td>\n<\/tr>\n<tr>\n<td><strong>OCI DNS<\/strong><\/td>\n<td>Name-based routing and indirection<\/td>\n<td>Decouples clients from IP changes<\/td>\n<td>TTL and caching delays<\/td>\n<td>When failover\/cutovers can tolerate DNS propagation<\/td>\n<\/tr>\n<tr>\n<td><strong>OCI Bastion<\/strong><\/td>\n<td>Secure admin access<\/td>\n<td>Reduces public exposure<\/td>\n<td>Requires bastion workflow adoption<\/td>\n<td>Avoid public SSH\/RDP on instances<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS VPC IPAM<\/strong><\/td>\n<td>Multi-account AWS IP planning<\/td>\n<td>Purpose-built IPAM features<\/td>\n<td>AWS-specific<\/td>\n<td>You need enterprise IPAM inside AWS<\/td>\n<\/tr>\n<tr>\n<td><strong>NetBox \/ phpIPAM (self-managed)<\/strong><\/td>\n<td>Enterprise IP inventory across hybrid\/multi-cloud<\/td>\n<td>Rich IP planning, ownership, automation<\/td>\n<td>You operate it; integration work required<\/td>\n<td>You need full IPAM beyond OCI capabilities<\/td>\n<\/tr>\n<tr>\n<td><strong>Infoblox\/BlueCat (commercial)<\/strong><\/td>\n<td>Large enterprise IPAM\/DNS\/DHCP<\/td>\n<td>Mature enterprise features<\/td>\n<td>Licensing cost; integration effort<\/td>\n<td>Regulated, large-scale hybrid environments<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example: regulated financial services API modernization<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A bank modernizes customer APIs on OCI. Clients and partners require strict allowlists and stable endpoints. The bank also needs audit trails and separation of duties.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>Public entry through <strong>OCI Load Balancer<\/strong> (or equivalent managed edge)<\/li>\n<li>Reserved\/stable public endpoints tracked in <strong>IP Management<\/strong><\/li>\n<li>Backends in private subnets; database in private subnet<\/li>\n<li>IAM policies restrict public IP creation\/assignment to NetSec group<\/li>\n<li>Tags required: <code>System<\/code>, <code>Owner<\/code>, <code>DataClassification<\/code>, <code>ChangeTicket<\/code><\/li>\n<li>Audit log monitoring for all IP and route changes<\/li>\n<li><strong>Why IP Management was chosen:<\/strong><\/li>\n<li>Native control of public IP inventory with compartment scoping<\/li>\n<li>Auditability for compliance<\/li>\n<li>Stable endpoints for allowlisting and change management<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Fewer incidents due to IP changes<\/li>\n<li>Faster, safer releases (stable endpoints)<\/li>\n<li>Improved compliance evidence via audit logs and tagging<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example: SaaS webhook receiver with partner allowlisting<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A startup integrates with an enterprise partner that only sends webhooks to allowlisted IPs. The startup frequently rebuilds infrastructure.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>Single small service behind a minimal public endpoint<\/li>\n<li>Allocate a <strong>reserved public IP<\/strong> for the ingress endpoint<\/li>\n<li>Keep DNS constant and avoid changing IP on rebuild<\/li>\n<li>Use NSG rules to restrict inbound to partner IP ranges<\/li>\n<li><strong>Why IP Management was chosen:<\/strong><\/li>\n<li>Simple and low operational overhead<\/li>\n<li>Meets partner\u2019s fixed-IP requirement<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Fewer partner integration failures<\/li>\n<li>Faster rebuilds without coordination headaches<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">1) Is \u201cIP Management\u201d a standalone OCI service?<\/h3>\n\n\n\n<p>In OCI, <strong>IP Management<\/strong> is commonly a <strong>Console section and set of capabilities<\/strong> for managing IP address resources (especially public IPs). It is not necessarily a separate, SKU-like service branded as \u201cIPAM.\u201d Verify current OCI Console structure and docs for your region.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2) What\u2019s the difference between a reserved and ephemeral public IP?<\/h3>\n\n\n\n<p>A <strong>reserved<\/strong> public IP stays allocated until you release it. An <strong>ephemeral<\/strong> public IP is generally temporary and may be released when the associated resource is terminated or reconfigured (behavior varies by resource\u2014verify in docs).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3) Why should I avoid ephemeral IPs in production?<\/h3>\n\n\n\n<p>Because they can change, breaking:\n&#8211; Customer and partner allowlists\n&#8211; DNS assumptions\n&#8211; Firewall rules\nUse reserved IPs or a managed front door.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4) Can I move a reserved public IP from one instance to another?<\/h3>\n\n\n\n<p>Often yes by re-associating it to a different private IP, subject to OCI constraints and permissions. Validate the exact supported reassignment workflow in OCI docs for your resource type.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">5) Does associating a public IP automatically open my service to the internet?<\/h3>\n\n\n\n<p>Not by itself. You also need:\n&#8211; A route to an Internet Gateway (for inbound)\n&#8211; Security list\/NSG rules allowing the traffic\n&#8211; The host and application listening on the port<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">6) Where do I see what private IP a public IP maps to?<\/h3>\n\n\n\n<p>In the public IP or private IP details pages in the Console, or via CLI\/API (<code>public-ip get<\/code>, <code>private-ip get\/list<\/code>).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">7) How do compartments help with IP Management?<\/h3>\n\n\n\n<p>Compartments allow:\n&#8211; Separation of environments (prod vs dev)\n&#8211; Delegated administration\n&#8211; Cleaner policies and reporting<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">8) Are public IPs charged in OCI?<\/h3>\n\n\n\n<p>They can be, depending on OCI\u2019s current pricing rules, your region, and contract terms. Always check the official pricing page and cost estimator.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">9) What\u2019s the best practice for production ingress: public IP on instances or load balancer?<\/h3>\n\n\n\n<p>For most production systems, prefer a <strong>load balancer<\/strong> (or equivalent managed edge) and keep instances in private subnets. Use public IPs on instances only when justified and controlled.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">10) Can I use IP Management for IPv6?<\/h3>\n\n\n\n<p>OCI supports IPv6 in certain contexts, but \u201cIP Management\u201d workflows may differ. Verify IPv6 support and management steps in the official OCI Networking documentation.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">11) How do I avoid \u201corphaned\u201d reserved public IPs?<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use tags (<code>Owner<\/code>, <code>ExpiryDate<\/code>)<\/li>\n<li>Run periodic inventory checks<\/li>\n<li>Add governance so unused IPs are flagged and released<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">12) How does BYOIP relate to IP Management?<\/h3>\n\n\n\n<p>BYOIP (if supported for your region\/tenancy) extends IP Management by allowing you to use customer-owned address ranges. It comes with additional validation and routing considerations.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">13) What logs should I monitor for IP-related changes?<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI Audit<\/strong> for create\/update\/delete\/attach operations<\/li>\n<li>VCN Flow Logs (if enabled) for traffic troubleshooting<\/li>\n<li>Security rule change events (route tables, NSGs, security lists)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">14) Can I fully manage IP assignments using Terraform?<\/h3>\n\n\n\n<p>Terraform can manage many OCI networking resources, including public IP resources in many cases. Confirm provider support for your specific workflow and resource types.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">15) What\u2019s the safest way to provide SSH access without public IPs?<\/h3>\n\n\n\n<p>Use <strong>OCI Bastion<\/strong> (where available and appropriate), and keep instances in private subnets.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn IP Management<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI Networking documentation<\/td>\n<td>Primary reference for VCN, subnets, public IPs, routing, NSGs. Start here: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Network\/Concepts\/overview.htm (verify if Oracle reorganizes docs)<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI CLI documentation<\/td>\n<td>Learn to automate IP Management tasks via CLI: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/API\/Concepts\/cliconcepts.htm<\/td>\n<\/tr>\n<tr>\n<td>Official docs (Networking tasks)<\/td>\n<td>Public IP addresses \/ managing public IPs (OCI)<\/td>\n<td>Operational steps for reserved\/ephemeral IPs (use Oracle docs search if URL changes): https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Network\/Tasks\/managingpublicIPs.htm<\/td>\n<\/tr>\n<tr>\n<td>Official docs (IAM)<\/td>\n<td>OCI IAM policy reference<\/td>\n<td>Required to securely delegate IP operations: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Identity\/Concepts\/policygetstarted.htm<\/td>\n<\/tr>\n<tr>\n<td>Official docs (Audit)<\/td>\n<td>OCI Audit<\/td>\n<td>Track changes to public IP resources: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Audit\/Concepts\/auditoverview.htm<\/td>\n<\/tr>\n<tr>\n<td>Official pricing<\/td>\n<td>Oracle Cloud Pricing<\/td>\n<td>Understand public IP, networking, and egress costs: https:\/\/www.oracle.com\/cloud\/pricing\/<\/td>\n<\/tr>\n<tr>\n<td>Official calculator<\/td>\n<td>OCI Cost Estimator<\/td>\n<td>Model your region-specific costs: https:\/\/www.oracle.com\/cloud\/costestimator.html<\/td>\n<\/tr>\n<tr>\n<td>Official architecture<\/td>\n<td>OCI Architecture Center<\/td>\n<td>Reference architectures involving networking and edge designs: https:\/\/docs.oracle.com\/en\/solutions\/<\/td>\n<\/tr>\n<tr>\n<td>Official tutorials\/labs<\/td>\n<td>OCI Tutorials<\/td>\n<td>Guided labs (search for networking\/public IPs): https:\/\/docs.oracle.com\/en\/learn\/<\/td>\n<\/tr>\n<tr>\n<td>Community (reputable)<\/td>\n<td>Oracle Cloud user communities and blogs<\/td>\n<td>Practical tips; validate against official docs to avoid outdated guidance: https:\/\/community.oracle.com\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Institute<\/th>\n<th>Suitable Audience<\/th>\n<th>Likely Learning Focus<\/th>\n<th>Mode<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps engineers, SREs, platform teams<\/td>\n<td>OCI + DevOps foundations, automation, infrastructure practices<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>ScmGalaxy.com<\/td>\n<td>Beginners to intermediate engineers<\/td>\n<td>DevOps\/SCM concepts supporting cloud operations<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.scmgalaxy.com\/<\/td>\n<\/tr>\n<tr>\n<td>CLoudOpsNow.in<\/td>\n<td>Cloud operations teams<\/td>\n<td>Cloud operations and runbooks; cloud reliability practices<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.cloudopsnow.in\/<\/td>\n<\/tr>\n<tr>\n<td>SreSchool.com<\/td>\n<td>SREs, production engineers<\/td>\n<td>SRE practices: reliability, incident response, monitoring<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.sreschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>AiOpsSchool.com<\/td>\n<td>Ops\/SRE teams adopting AIOps<\/td>\n<td>AIOps concepts, monitoring automation and analytics<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.aiopsschool.com\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Platform\/Site<\/th>\n<th>Likely Specialization<\/th>\n<th>Suitable Audience<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>RajeshKumar.xyz<\/td>\n<td>DevOps\/cloud training content (verify current offerings)<\/td>\n<td>Beginners to intermediate<\/td>\n<td>https:\/\/rajeshkumar.xyz\/<\/td>\n<\/tr>\n<tr>\n<td>devopstrainer.in<\/td>\n<td>DevOps tools and practices (verify OCI coverage)<\/td>\n<td>DevOps engineers<\/td>\n<td>https:\/\/www.devopstrainer.in\/<\/td>\n<\/tr>\n<tr>\n<td>devopsfreelancer.com<\/td>\n<td>Freelance DevOps guidance and services (verify scope)<\/td>\n<td>Teams seeking practical implementation help<\/td>\n<td>https:\/\/www.devopsfreelancer.com\/<\/td>\n<\/tr>\n<tr>\n<td>devopssupport.in<\/td>\n<td>DevOps support and training resources (verify offerings)<\/td>\n<td>Ops and DevOps teams<\/td>\n<td>https:\/\/www.devopssupport.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Company Name<\/th>\n<th>Likely Service Area<\/th>\n<th>Where They May Help<\/th>\n<th>Consulting Use Case Examples<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>cotocus.com<\/td>\n<td>Cloud\/DevOps consulting (verify current practice areas)<\/td>\n<td>Architecture, implementation, operationalization<\/td>\n<td>Network baseline, secure ingress\/egress, automation guardrails<\/td>\n<td>https:\/\/cotocus.com\/<\/td>\n<\/tr>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps\/cloud consulting and training (verify current offerings)<\/td>\n<td>Delivery acceleration, DevOps enablement<\/td>\n<td>IaC implementation, governance and tagging strategy, CI\/CD integration for networking<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>DEVOPSCONSULTING.IN<\/td>\n<td>DevOps consulting (verify scope and services)<\/td>\n<td>Platform operations, automation<\/td>\n<td>IP governance runbooks, cost controls, policy design<\/td>\n<td>https:\/\/www.devopsconsulting.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before IP Management<\/h3>\n\n\n\n<p>To use OCI IP Management effectively, first learn:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Networking fundamentals: IPv4, CIDR, NAT, routing, DNS, TLS<\/li>\n<li>OCI basics: tenancies, regions, compartments<\/li>\n<li>OCI Networking: VCNs, subnets, route tables, IGW, NAT gateway, NSGs\/security lists<\/li>\n<li>Basic Linux administration and SSH (if using compute instances)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after IP Management<\/h3>\n\n\n\n<p>Build depth and production readiness with:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI Load Balancing and resilient ingress architectures<\/li>\n<li>OCI Bastion and zero-trust administrative access patterns<\/li>\n<li>Infrastructure as Code (Terraform with OCI)<\/li>\n<li>Observability: audit, logging, flow logs, monitoring<\/li>\n<li>Security engineering: least privilege IAM, threat modeling, hardening<\/li>\n<li>Hybrid connectivity: DRG, VPN, FastConnect (as needed)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Engineer \/ Cloud Network Engineer<\/li>\n<li>DevOps Engineer \/ Platform Engineer<\/li>\n<li>Site Reliability Engineer (SRE)<\/li>\n<li>Security Engineer (NetSec \/ CloudSec)<\/li>\n<li>Solutions Architect<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (if available)<\/h3>\n\n\n\n<p>Oracle offers OCI certifications, but the exact certification names and tracks change. Use Oracle University to find current paths:\n&#8211; https:\/\/education.oracle.com\/ (verify current certification catalog and OCI tracks)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Build a production-like front door:<\/li>\n<li>Reserved IP + public load balancer + private backend + restricted NSGs<\/li>\n<li>Create an \u201cIP inventory\u201d script:<\/li>\n<li>List public IPs by compartment, show tags, flag unassigned reserved IPs<\/li>\n<li>Implement a governance policy set:<\/li>\n<li>Only NetSec can assign public IPs in prod compartments<\/li>\n<li>Enforce required tags for public IPs (where feasible)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI (Oracle Cloud Infrastructure):<\/strong> Oracle Cloud\u2019s IaaS\/PaaS platform.<\/li>\n<li><strong>Networking, Edge, and Connectivity:<\/strong> OCI category covering VCN, gateways, load balancing, DNS, and edge connectivity.<\/li>\n<li><strong>VCN (Virtual Cloud Network):<\/strong> A private network in OCI, similar to a VPC in other clouds.<\/li>\n<li><strong>Subnet:<\/strong> A range of IP addresses within a VCN.<\/li>\n<li><strong>VNIC:<\/strong> Virtual network interface attached to a compute instance or service.<\/li>\n<li><strong>Private IP:<\/strong> IP address within the VCN\/subnet assigned to a VNIC.<\/li>\n<li><strong>Public IP:<\/strong> Internet-routable IPv4 address mapped to a private IP.<\/li>\n<li><strong>Reserved Public IP:<\/strong> Public IP that remains allocated until you release it.<\/li>\n<li><strong>Ephemeral Public IP:<\/strong> Public IP that may be automatically assigned\/released based on lifecycle.<\/li>\n<li><strong>IGW (Internet Gateway):<\/strong> Provides inbound\/outbound internet connectivity for public subnets (when routes and security allow).<\/li>\n<li><strong>NSG (Network Security Group):<\/strong> Stateful virtual firewall rules applied to VNICs.<\/li>\n<li><strong>Security List:<\/strong> Subnet-level firewall rules.<\/li>\n<li><strong>Compartment:<\/strong> OCI logical container for organizing resources and IAM boundaries.<\/li>\n<li><strong>Tagging:<\/strong> Metadata used for cost allocation, ownership, automation, and governance.<\/li>\n<li><strong>IAM Policy:<\/strong> Rules defining who can do what in OCI.<\/li>\n<li><strong>Audit Logs:<\/strong> Records of control-plane API actions for traceability.<\/li>\n<li><strong>BYOIP:<\/strong> Bring Your Own IP; using customer-owned IP ranges in OCI (if supported).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p><strong>IP Management (Oracle Cloud)<\/strong> is the practical set of OCI Networking capabilities used to <strong>allocate, reserve, assign, and govern IP addresses<\/strong>, especially <strong>public IPs<\/strong> and their association to <strong>private IPs<\/strong> on VNICs inside a VCN. It matters because stable IP endpoints reduce outages, simplify allowlisting, and improve operational control in production environments.<\/p>\n\n\n\n<p>From a cost perspective, watch for <strong>public IPv4 charges (if applicable)<\/strong> and, more importantly, <strong>internet egress costs<\/strong>. From a security perspective, treat public IP assignment as a high-risk action: lock it down with <strong>least-privilege IAM<\/strong>, compartments, and auditing, and avoid exposing SSH\/RDP directly.<\/p>\n\n\n\n<p>Use IP Management when you need <strong>stable endpoints<\/strong> and controlled IP lifecycle. Prefer managed front doors (load balancers, bastion) for production-grade designs. Next, deepen your skills by learning OCI Load Balancing, OCI Bastion, and Terraform-based automation for repeatable network governance.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Networking, Edge, and Connectivity<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[74,62],"tags":[],"class_list":["post-945","post","type-post","status-publish","format-standard","hentry","category-networking-edge-and-connectivity","category-oracle-cloud"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/945","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=945"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/945\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=945"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=945"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=945"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}