Part 1(4) : Hands-On Guide with Security: Provisioning GoldenGate/Database in a Private Subnet and Access via Bastion Service

May 3, 2024 | 4 minute read
Ravi Gupta
Senior Principal Consultant
Text Size 100%:

Part 1(4) : OCI Resource Creation : This section will furnish instructions for creating all the necessary OCI (Oracle Cloud Infrastructure) resources required to set up OCI GoldenGate.

1. Compartments

Create the following six compartments along with their respective child compartments. In this blog series, we will configure OCI GoldenGate using security best practices for a fictional customer named Max. "SOM" here is taken as a reference for Sales Order Management.

  •  max-app-cmp : This compartment will hold all applications for max Client.
    • dev-app-som-cmp : This compartment will house all development-related applications for the Sales Order Management Project intended for max client.
  • max-database-cmp : This compartment will hold all Database for max Client.
    • dev-database-som-cmp : This compartment will house all development-related database for the Sales Order Management Project intended for max client.
  • max-network-cmp : This compartment will hold all Network related resources for max Client.
  • max-security-cmp : This compartment will hold all Security related resources for max Client.

Compartment List

2. VCN (Virtual Cloud Network)

Create a Virtual Cloud Network (VCN) using the "Start VCN Wizard" option and select "Create VCN with Internet Connectivity." Name the VCN as "som-vcn-dev" and place it under the "max-network-cmp" compartment. Maintain all default values for the CIDR blocks.

VCN

3. Route Table

Create the following route table under the "som-rt-dev-network" compartment.

Route Table

4. Subnet

Create the subnets and assign IPv4 CIDR blocks based on the VCN CIDR block. Ensure all subnets are created under the same network compartment "som-rt-dev-network". Designate all subnets as private subnets (Subnet Access= Private Subnet) and assign the respective route table created in the previous steps.

Subnet

5. Network Security Group (NSG)

Create the following Network Security Group (NSG), which will later be utilized to establish Ingress and Egress rules and then attached to GoldenGate, GoldenGate database connections, and the Database.

As NSG cannot currently be directly attached to Bastion service, we will utilize Security Lists for defining Bastion service egress and ingress rules. Oracle recommends the use of NSG.

Network Security Group

6. Vault Key

Create “som-vlt-dev-gg” under “max-security-cmp” compartment.

Valut Key

After creating the Vault, configure the key with the following specifications.

Valut Key Configuration

7. Bastion Service

The Bastion service is employed to access all OCI resources situated within a private subnet.

Now, establish the OCI Bastion Service under the VCN 'som-vcn-dev' and subnet 'som-pvt-sn-dev-security.' take into account the 'CIDR block allowlist' for access. Since this is a demo, I am utilizing my laptop's IP address. For enhanced security, please include the IP addresses of each team member. Projects may opt to use 0.0.0.0/0 for unrestricted access to the Bastion service.

Note: If you append /32 to your IP address, it will form your CIDR block. For instance, if your IP address is 11.22.33.44, the corresponding CIDR will be 11.22.33.44/32.

Bastion Service

Home Page :

Part 1: OCI Resource Creation

Part 2: GoldenGate Artifacts Creation

Part 3: GoldenGate AdminClient Artifacts Creation

Part 4: DataBase Artifacts Creation

Ravi Gupta

Senior Principal Consultant

Ravi Gupta is a Senior Principal Consultant at Oracle, specializing in Solutioning, Integration, and Project Delivery. With a wealth of experience, Ravi has made significant contributions to numerous global projects necessitating seamless and efficient data flow between applications. Additionally, he has excelled in roles as a solution architect and technical delivery manager.

Show more

Previous Post

Oracle GoldenGate 23ai and Oracle Database 23ai Vectors

Alex Lima | 5 min read

Next Post


Part 2(4) : Hands-On Guide with Security: Provisioning GoldenGate/Database in a Private Subnet and Access via Bastion Service

Ravi Gupta | 4 min read