Note: Private Access Channel is now available in Oracle Analytics and is recommended by Oracle for new connections to private data sources. For more information on the feature and the data sources it supports refer to:
    Connect to Private Data Sources Through a Private Access Channel
    Supported Data Sources
    A-Team Chronicles Private Access Channel Series

Validated November 24, 2020 with OAC 5.8

Introduction

Oracle Analytics Cloud (OAC) may now be provisioned within a Virtual Cloud network (VCN) on Oracle Cloud Infrastructure (OCI) with a private IP address.

This post is a step-by-step guide for deploying the components and validating the connectivity between them thus enabling a  private connection between OAC and an Autonomous Database (ADB). The ADB may be on shared or dedicated infrastructure and may be either Autonomous Data Warehouse (ADW) or Autonomous Transaction Processing. This guide uses an ADW as the ADB.

This is one of the post listed in the OAC Private Endpoint Parent Post

Validations

November 29, 2020 with OAC 5.8

Topics

Before You Begin

Deploying Components

Validating Connectivity

Creating a Private ADW connection

Final States and Traffic Flows

 Before You Begin

All names and addresses used in this post are for examples only. Although not required, resources are assumed to be in separate subnets to demonstrate security and routing rules.

Three scenarios are provided; Single VCN, Locally Peered VCNs and Remotely Peered VCNs. The "Peered VCNs" scenario includes both peering scenarios and the "All" scenario includes all.

The following are assumed to be in place relative to your scenario.

Privileges

A user account in an OCI tenancy granted compartment privileges for managing Analytics, Compute, ADBs and Networking components.

OAC Subnet

Rules for client connectivity in the OAC subnet's security list and route table.

Components

Single VCN Initial State

Peered VCNs Initial State

 Deploying Components

This section details the following additional components relative to your scenario.

Subnets
Security Lists
Remote Data Gateway
Peering Gateways
Route Tables
DNS Private Views
Gateway Associations
Remote Peering Connections
DNS EndPoints
DNS Rules

Subnets

A Subnet consists of a contiguous range of IPv4 addresses that do not overlap with other subnets in the VCN. They act as a unit of configuration: all instances in a subnet use the same route table, security lists, and DHCP options.

Create subnets relative to your scenario.

Security Lists

Security Lists control network traffic within a subnet in addition to firewall rules within each resource. 

Create security lists for the DB, DNS, and OAC subnets with the following rules.

 Associate the security lists to the corresponding subnet.

Remote Data Gateway

OAC currently requires Remote Data Gateway (RDG) to reach private data sources. RDG is deployed in either a Linux or a Windows VM.

Deploy RDG. Refer here for a post on deploying in a private subnet.

Peering Gateways

A Peering Gateway peers multiple virtual cloud networks (VCNs). There are two types of gateways: Local Peering Gateway (LPG) and Dynamic Routing Gateway (DRG).

Create gateways relative to your scenario.

Peer the LPGs.

Route Tables

Route Tables send a subnet's traffic to destinations outside the VCN. 

Create route tables for Local Peering and Remote Peering with the following rules.

Associate the route tables to the RDG, DNS, and OAC subnets

DNS Private Views

A DNS Private View is a collection of DNS private zones. Private Views relate to VCNs. Private Zones relate to Subnets. You can associate private views within the same region to your VCN's DNS resolver. Private views cannot be used for remote peering.

Associate the VCN1 Private View to VCN2

Gateway Attachments

A Gateway Attachment attaches a DRG to a VCN.

Attach the DRGs to the corresponding VCN.

Remote Peering Connections

A Remote Peering Connection (RPC) acts as a connection point for a remotely peered VCN.

Create an RPC for each DRG.

Peer the RPCs.

DNS Endpoints

A DNS Endpoint is attached to a VCN or a subnet. An endpoint can only be configured to either forward or listen. A listening endpoint receives queries from within the VCN, other VCN Resolvers, or your on-premises network's DNS. A forwarding endpoint forwards DNS queries to the listening endpoint in other peered VCNs or your on-premises network's DNS.

To resolve the OAC FQDN create a listening endpoint in the VCN1 DNS Subnet and a forwarding endpoint in the VCN2 DNS Subnet.

DNS Rules

A DNS Rule is used to answer queries that isn't answered by a VCN's DNS private views.

Create a DNS Rule in VCN2 that detects an OAC domain request, submits it to the VCN2 forwarding endpoint with instructions to forward the request to VCN1's listener endpoint's IP address.

 Validating Connectivity

Validate connectivity between the following components. 

Validating Fully Qualified Domain Name (FQDN) Resolution

Connect to the RDG host and Issue the nslookup command from the command line e.g.

nslookup < your OAC or ADW FQDN >  

Validating Port Access

Connect to the RDG host. Use the traceroute command on Linux and the Test-NetworkConnection (tnc) on Windows.

Linux: 

sudo traceroute  -n -q 1  -T -p  < your OAC or ADW port > < your OAC or ADW FQDN >

For remote peering you see:

 1  nnn.nnn.nnn.nnn  nnn ms
 2  nnn.nnn.nnn.nnn  nnn ms
 3  < your OAC or ADW IP address > nnn ms

Otherwise:

1  < your OAC or ADW IP address > nnn ms

Windows:

tnc < your OAC or ADW FQDN > -port < your OAC or ADW port >

TcpTestSucceeded : True

 Creating an OAC Private ADW connection

Connect to OAC, click Create, click Connection, and click Oracle Autonomous Data Warehouse.

Enter a Connection Name

Enter a Description

Click Select and choose your ADW Client Credentials zip file

Enter an ADW Username e.g. admin and Password

Select a Service Name related to your ADW from the dropdown

Check the box for Use Remote Data Connectivity

Click Save

The connection is created and you may now create data sets, analyses and projects.

 Final States and Traffic Flows

Single VCN

Local Peering

Remote Peering

 Summary

This post provided a step-by-step guide for deploying the necessary components and validating the connectivity between them for a private connection between OAC and an Autonomous Database (ADB). 

For other posts relating to analytics and data integration visit http://www.ateam-oracle.com/dayne-carley