Connecting Oracle Cloud Infrastructure (OCI) and Amazon Web Services (AWS) with an IPSec VPN provides encrypted private connectivity between workloads hosted in both clouds. This guide presents a practical implementation approach, from CIDR planning and gateway configuration through routing and validation.

1. Reference architecture

The design uses an OCI VCN connected through an OCI Dynamic Routing Gateway (DRG) and Site-to-Site VPN to an AWS VPC through an AWS Virtual Private Gateway or Transit Gateway. The VPN uses redundant IPSec tunnels where supported, providing encrypted connectivity across the cloud providers.

2. Plan the CIDRs

Before configuring either cloud, make sure the OCI VCN and AWS VPC use non-overlapping CIDR ranges. Define the subnets that must communicate and document the expected traffic directions.

• OCI VCN CIDR — example: 10.20.0.0/16
• AWS VPC CIDR — example: 10.30.0.0/16
• OCI workload subnet — example: 10.20.10.0/24
• AWS workload subnet — example: 10.30.10.0/24

3. OCI configuration

On OCI, create or identify the VCN and attach a Dynamic Routing Gateway. Create an IPSec connection from the DRG toward AWS and configure the required customer-premises-equipment definition and tunnel parameters. Record the OCI tunnel endpoints and shared secrets required for the AWS configuration.

4. AWS configuration

On AWS, create the VPN-side gateway architecture for the VPC. Depending on the design, this can use a Virtual Private Gateway attached to the VPC or a Transit Gateway for a centralized connectivity model. Define the OCI VPN endpoint as the customer gateway and create the VPN connection with the required tunnel settings.

5. IPSec parameters

The two sides must agree on compatible IKE and IPSec parameters. Document the selected IKE version, encryption algorithms, integrity algorithms, Diffie-Hellman groups, lifetime settings, and authentication method. When using pre-shared keys, ensure the same key is configured on both ends.

6. Routing is critical

A tunnel can be established while application traffic still fails if routes are missing. On OCI, add routes for the AWS VPC CIDR through the DRG. On AWS, add routes for the OCI VCN CIDR through the appropriate VPN gateway or Transit Gateway. If dynamic routing is used, verify that the expected prefixes are being advertised and learned.

7. Security controls

Allow the required traffic in OCI security lists or Network Security Groups and in AWS security groups and network ACLs. Check both directions, including return traffic. Restrict the rules to the required source and destination CIDRs and ports rather than opening broad access.

8. Validation checklist

1. Confirm both IPSec tunnels are established.
2. Verify OCI route tables contain the AWS VPC CIDR.
3. Verify AWS route tables contain the OCI VCN CIDR.
4. Confirm security rules permit the test traffic.
5. Test connectivity between known workloads.
6. Check tunnel and gateway logs when traffic does not pass.
7. Validate return routing and asymmetric-routing conditions.

9. Common troubleshooting areas

• Overlapping VPC/VCN CIDRs.
• IKE or IPSec parameter mismatch.
• Incorrect pre-shared key.
• Missing or incorrect route-table entries.
• Security group, NSG, network ACL, or firewall restrictions.
• Incorrect gateway attachment or DRG/VPN routing configuration.
• Application ports blocked even though ICMP or another test protocol works.

Conclusion

An OCI-to-AWS IPSec VPN requires alignment across three layers: tunnel negotiation, cloud routing, and workload security controls. Designing the CIDRs and routing model first makes the implementation and troubleshooting process much more predictable.

Note: AWS and OCI service interfaces and supported VPN options can change. Validate the exact gateway, routing, and IPSec options against the current provider documentation when implementing this in production.