IPv6 Connectivity Across OCI VCNs via Dynamic Routing Gateway

In the past articles, we discussed the IPv6 address format and how the communication can happen via Internet Gateway. In this article, we will explore how IPv6 communication can be set up via Dynamic Routing Gateway (DRG).

IPv6 address includes a VCN-specific identifier, which ensures global uniqueness. Because of this uniqueness, interconnectivity between networks is possible even when their IPv4 CIDR ranges overlap. If the VCN, Subnets and Compute instances are enabled with IPv6 then please move to DRG section.

First, we create two VCNs with the same IPv4 CIDR range. Next, we enable IPv6 CIDR ranges for both VCNs to allow seamless communication over IPv6. In this exercise VCNs are created in the same region.

The VCN has only IPv4 CIDR Range.

Lets enable IPv6 CIDR range to the VCN.

After enable, we could see IPv6 CIDR range now.

Right now, only VCN got enabled with IPv6 and we need to enable IPv6 CIDR range at Subnet level.

In the Subnet -> IP Administration page, add IPv6 prefix.

Perform the above steps for Second VCN and subnets within the second vcn.

At this stage VCNs and Subnets are configured with IPv6. Lets test the communication among them by creating VM compute instance in each VCN and try to communicate through IPv6.

After instance creation, we can check their IPv4 and IPv6 address.

 

Dynamic Routing Gateway

Create a Dynamic Routing Gateway (DRG) in the OCI console.

Attach the VCNs into the DRG.

 

The DRG attachement has default route table. Check the route rules.

Click “Get all route rules” button. We could see IPv4 CIDR are showing conflict and IPv6 routes are clean.

 

Security rules and Route tables configuration

At the network side, we need to enable rules to allow communication among them. Add Security list and Route rule to allow communication between the instances. Specify IPv6 CIDR range of other VCN as Source CIDR (Ingress) and Destination CIDR (Egress) and use “IPv6-ICMP” protocol.

First_VCN

 

For Route rules, Specify Dynamic routing gateway as protocol with IPv6 version.

Second_VCN

Perform the security rule and Route rule configuration in Second VCN.

Test the connectivity by pinging the compute instances from each other.

 

 

Enabling IPv6 Communication Between Overlapping VCN CIDR Networks

In the previous article, we discussed the IPv6 address format and how it differs from IPv4. In this article, we will explore how IPv6 communication can be set up.

In the IPv4 model, VCN CIDR ranges must not overlap in order to establish connectivity between networks. However, in real-world environments - especially in multi-cloud architectures - CIDR overlap is a common challenge. This limitation can be effectively addressed by using IPv6 for communication.

As we know, an IPv6 address includes a VCN-specific identifier, which ensures global uniqueness. Because of this uniqueness, interconnectivity between networks is possible even when their IPv4 CIDR ranges overlap.

Let’s look at the steps in detail. First, we create two VCNs with the same IPv4 CIDR range. Next, we enable IPv6 CIDR ranges for both VCNs to allow seamless communication over IPv6.

The VCN has only IPv4 CIDR Range.

Lets enable IPv6 CIDR range to the VCN.

After enable, we could see IPv6 CIDR range now.

Right now, only VCN got enabled with IPv6 and we need to enable IPv6 CIDR range at Subnet level.

In the Subnet -> IP Administration page, add IPv6 prefix.

Perform the above steps for Second VCN and subnets within the second vcn.

At this stage VCNs and Subnets are configured with IPv6. Lets test the communication among them by creating VM compute instance in each VCN and try to communicate through IPv6.

After instance creation, we can check their IPv4 and IPv6 address.

At the network side, we need to enable rules to allow communication among them. Add Security list and Route rule to allow communication between the instances. Specify IPv6 CIDR range of other VCN as Source CIDR (Ingress) and Destination CIDR (Egress) and use “IPv6-ICMP” protocol.

First_VCN

 

In general, the communication between different VCN happens via Local peering gateway, but here IPv4 CIDR ranges are overlapping, hence we can’t use Local peering gateway, lets use Internet gateway.

Second_VCN

Perform the security rule and Route rule configuration in Second VCN.

Test the connectivity by pinging the compute instances from each other.

Enabling IPv6 Connectivity Between OCI VM Instances

 

In general, we will use IPv4 CIDR range for networking mostly and VCNs will be configured with IPv4. VMs will be created with IPv4 IP Address.

OCI VCN also supports IPv6 CIDR ranges. In this blog we will explore how to enable IPv6 to VCN and VM instances and then how to connect two instances through IPv6.

IPv6 is 128bit address, whereas IPv4 is 32bit address.

IPv6 will have 32 hex digits and each hex digit is 4 bits, hence IPv6 is 128bit address.

Example:

2603:c020:4012:3a01:0:792b:d3de:1f01

The above address is a IPv6 address and it has 32 hex digits and created as 8 groups (separated by colons) with each group having 4 hex digits (consider the fifth group as 0000).

32 hex digits = 128bits (32*4)

Let’s interpret this address.

Block	Meaning
2603	Region allocation block
c020	Identifies OCI cloud network
4012	VCN identifier
3a01	Subnet Identifier
0	Reserved
792b:d3de:1f01	Host portion

Let’s consider another example: 2603:c020:4012:3a01:0:14cf:1bd1:6801

Block	Meaning
2603	Region allocation block
c020	Identifies OCI cloud network
4012	VCN identifier
3a01	Subnet Identifier
0	Reserved
14cf:1bd1:6801	Host portion

 

We could see the first 5 blocks are similar for example 1 & 2. It means the resource exists in the same vcn, subnet.

                                   

IPv6 can be enabled to VCN at the time of creation or after creation. While creating new VCN we could see option to enable IPv6 prefixes.

Enable IPv6 by clicking “Assign an Oracle allocated IPv6 /56 prefix”.  It also has option for BYOL.

 To enable IPv6 in existing VCN which was created with IPv4, go to VCN details page.

Click on IP Administration page, we can find Add CIDR Block/IPv6 Prefix button. Click on that.

Click on Assign an Oracle allocated IPv6/56 prefix. It will enable IPv6 prefixes to existing vcn.

Let’s create two VMs on this VCN and try to make connection between them through IPv6. The VM creation steps for as usual, the only additional step required is to enable IPv6 in the network section.

Consider two VMs(vm1, vm2)  are created with IPv6 Prefix in the same public subnet.

VM1 Network settings

VM2 Network settings

Let’s connect with vm1 via ssh protocol and try to ping vm2. ICMP protocol is allowed in the security list ingress traffic.

Though ICMP protocol is allowed in the Ingress traffic, the ping command is not working.

For IPv6, the usual ICMP protocol is not enough. We need to explicitly add security rule for IPv6-ICMP.

Here the Source CIDR is Subnet’s IPv6 Prefix.

Now lets try to ping between VMs.