Site-to-Site VPN FAQ

Can I customize configuration parameters such as IKE ID or IPSec VPN tunnel lifetime on the DRG?

No. Oracle has predetermined the configuration parameters that work with the Site-to-Site VPN service. Your Site-to-Site VPN can't be established if there is a mismatch.

Can Oracle initiate the IPsec connection?

No. You must initiate it from your end.

Is IPv6 supported over Site-to-Site VPN?

Yes. IPv6 is supported.

Is a Site-to-Site VPN supported over FastConnect?

No, FastConnect and the Site-to-Site VPN are two different services.

Can packets from the VCN be sourced with the public IP of the DRG? In other words, can the DRG source the NAT VCN traffic?

No. Packets from the VCN have the private IP address of the instance as a source IP address. Oracle cannot change the source IP address to the private or public IP address of the DRG.

Oracle has provided two VPN endpoints to build tunnels to. Does Oracle route the same network over both tunnels?

Yes. Traffic for all the subnets in the VCN attached to your DRG is routed over both tunnels.

How many VPN tunnels can I have from a single CPE device?

You can have a maximum of 100 tunnels from a unique CPE IP address per region. If you want more than 100 tunnels, either use a different IP address for the additional ones, or use a different CPE device (recommended).