Last updated: June 15, 2026
Some frequent questions that A-team encounters from customers are about connectivity to Oracle SaaS. With the flexibility and options that Oracle Cloud Infrastructure (OCI) brings to customers, there are several alternatives for network connectivity. In this post, I’ll address the most common of these alternatives, in the context of Oracle Cloud Applications, aka. Fusion cloud applications, HCM, ERP, SCM, and Sales to be specific. The patterns explained here can generally be applied to other Oracle SaaS applications.
This post will address the connectivity architecture at a high level. I’ll delegate to other Oracle blogs and documentation for detailed instructions for tasks such as setting up VPN Connect or FastConnect connections. The suitable audience for this post is cloud architects and engineers with a foundational understanding of networking with OCI.
Connectivity patterns
Here are the common connectivity patterns for connecting to Oracle Applications Cloud, starting with the most common.
- Pattern#1 – Connect over public internet from all clients with CDN enabled (The default, most common scenario)
- Pattern#2 – Connect over VPN or FastConnect, with CDN disabled (Typical for VPN and FastConnect customers)
- Pattern#3 – Connect over FastConnect or VPN, with CDN by-passed for connections from customer premises and OCI with additional custom network components and DNS (Anti-pattern, least common)
The CDN for Fusion cloud applications is Akamai, which also provides edge-protection services. By default, when a pod is provisioned, Akamai CDN is enabled. Akamai (internet cache) enable/disable is a self-service feature for the cloud admin. For the Pattern#2 (FastConnect/VPN), the Akamai (CDN) is required to be disabled. The Akamai (internet cache) can be enabled/disabled as described in the docs here: https://docs.oracle.com/en/cloud/saas/field-service/fauoc/c-enable-disable-internet-caching.html.
By default, Fusion pods are also provisioned with the Oracle-managed WAF (WAF4SaaS) service for application-layer security; this blog does not discuss WAF4SaaS security features. WAF4SaaS implementation and the details are explained in the docs here: https://docs.oracle.com/en-us/iaas/Content/Resources/Assets/whitepapers/oracle-web-application-firewall-for-saas.pdf.
NOTE: To implement WAF4SaaS IP based access control, please refer to the article – KB75019 (How To Request for WAF4SaaS IP Based Access Control?)
Now, Let’s take a closer look at each of the networking patterns.
Pattern #1: Connect over public internet from all clients with CDN enabled
NOTE: CDN is automatically bypassed for all traffic originating from OCI tenancies (i.e. intranet) traffic irrespective of region. Please refer to this blog for verifying bypass.
This is the connectivity pattern for Fusion SaaS customers who do not choose to customize connectivity. All connections originating from customer premises and the Internet are made over the public internet, through the CDN. There are a couple of key points to note.
- All connections to or from Fusion SaaS applications (HTTPS, SFTP) are encrypted with TLS 1.2 or higher cryptographic protocol.
- All traffic, including API, web services, and browser, all through the CDN, which is Akamai for Fusion SaaS applications.
A high-level visual of this pattern is shown below.
All Fusion SaaS clients, including the clients inside the customer’s OCI tenancy, connect through the CDN. This pattern works well for most customers.
Pattern #2: Connect over VPN or FastConnect, with CDN disabled
Many Fusion SaaS customers want to connect over encrypted tunnels, or over dedicated circuits to the application from the customer’s premises. OCI VPN connect or OCI FastConnect provides this capability. Before I discuss this pattern, let me provide a quick introduction to OCI VPN Connect and FastConnect.
VPN connects is IPSec VPN from customer’s premises (including customer’s other 3rd party cloud provider accounts) to OCI. VPN provides an encrypted tunnel for all connections. However, note that all connections to and from Fusion SaaS are encrypted already. VPN can provide an additional measure of protection, for customers who see the benefit in it. VPN connections typically have a ceiling to the bandwidth, estimated to be around 250 Mbits. OCI VPN Connect is a fully self-service option for customers. VPN allows customers to extend their on-premises networks into OCI, for seamless connectivity between on-premises services and cloud services over private IP networks.
FastConnect provides a quick way to enable dedicated connections from customer’s premises (again, including customer’s other 3rd party cloud provider accounts) to OCI. FastConnect is easier enabled through one of Oracle’s partners, such as Equinix or Megaport, among others. It is possible to enable direct circuits from customer premises to OCI where a partner is not available, but this is done as a last resort, with consultation from OCI networking support.
Fastconnect provides two types of peering. Private peering allows customers to extend their on-premises networks into OCI. This enables the customer to connect over private IP addresses. Public peering permits accessing Oracle public IP addresses advertised over FastConnect, which includes Fusion SaaS applications. Customers can choose to enable both private and public peering over the same FastConnect. FastConnect is also mostly self-service configuration, through OCI-console and Partner’s console. There are, however, a few last steps that need to be performed by OCI network support before FastConnect becomes active. Consult OCI documentation or OCI networking support for more information.
Here is a visual of this pattern.
To ensure that all connections are only between customer premises and Oracle cloud services, and no 3rd parties are in-between, the CDN is disabled in this pattern. To ensure that connections can only originate from customer premises, the customer configures Location-Based Access control (LBAC) in the Fusion SaaS instances. Any clients outside the customer’s premises, such as users on Mobile devices will have to be routed through the customer’s premises using technologies such as VPN. If the mobile device’s IP addresses can reliably fit into a few trusted-CIDR ranges that can be specified with LBAC, then the mobile clients might be able to connect directly. A solution for this is something within the customer’s control, and the customer’s network engineers must determine an appropriate design. Blocking all clients originating from outside customer premises is also a possibility.
NOTE: PaaS services hosted by Oracle Cloud, such as OIC, are located in Oracle Service Network (OSN), even though they are created by customers and administratively located inside a compartment. As a result, these products can not take the same connectivity route as other components such as services deployed on OKE or Compute.
For this pattern, Securely Accessing Fusion Applications is available from the docs: https://docs.oracle.com/en-us/iaas/Content/fusion-applications/network-setup.htm
Following this, the A-Team has published blogs on FastConnect and VPN deployments using a network provider (Example: Equinix) for secure network connectivity between On-prem to Fusion SaaS environment are available
- Restrict public access of Fusion Cloud Applications and enable access to OCI Resources using IPSEC VPN – part1
- Restricting Public Internet Access to Oracle Fusion Cloud Applications Using FastConnect Private Peering & Equinix Fabric – part2
- Restricting Public Access to Oracle Fusion Cloud Applications using FastConnect Public Peering with Equinix – part3
- Provision Fast Connect (Equinix) and an IPSec VPN simultaneously (Backup line) – part4
Pattern #3: Anti-Pattern: Connect over FastConnect or VPN, with additional network components (Least common)
This scenario is addressed as it can be a part of discussion around connectivity architectures. Despite its potential technical feasibility, we discourage custom solutions for multitude of reasons. Some of the reasons are:
- A custom solution comprising additional network components (like Network Load Balancer at the PaaS tenancy and DNS configurations (or) network firewall with IPS/IDS access controls) will be owned and supported by customer and Oracle SaaS support will not be able to assist with issues pertaining to those components.
- Such a solution can introduce operational, security and compliance risks that the customer is responsible to mitigate.
- The operational risks introduced by such a custom solution could potentially result in loss of access to enterprise applications.
- Customer will be resoponsible to ensure that application features are not impacted in anyway by the custom solution.
References
Securely Accessing Fusion Applications: https://docs.oracle.com/en-us/iaas/Content/fusion-applications/network-setup.htm
Enable or Disable (CDN) Internet Caching: https://docs.oracle.com/en/cloud/saas/field-service/fauoc/c-enable-disable-internet-caching.html
Interconnectivity within OCI Regions: https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/fastconnectpublicpeeringaddressranges.htm
OCI FastConnect: https://www.oracle.com/cloud/networking/fastconnect/
OCI VPN Connect: https://www.oracle.com/cloud/networking/vpn-connect.html