Skip to main content
Corvic Private Networking connects Corvic to databases that live in your own network, such as an Oracle database in your data center or cloud VPC. Corvic reaches them over two encrypted site-to-site VPN tunnels to your VPN device, so your databases never need a public address or an internet-facing firewall rule.

​
How it works

1

Send Corvic the request form

Fill in the request form: your VPN device’s addresses, its BGP ASN, and the database hosts Corvic should reach.
2

Corvic sets up its side and replies

Corvic builds a private network dedicated to your connection and sends you its values: its VPN addresses, the tunnel settings, and the firewall rules to open. The VPN’s pre-shared key arrives separately, by a one-time secret-sharing link.
3

Configure your VPN device

Add the two tunnels, the BGP sessions, and the firewall rules, using the settings on this page and the values in Corvic’s reply.
4

Corvic tests the connection

Corvic runs its connection test, from the tunnels up to a database login, and tells you the result.
Private Networking is enabled per organization. Contact Corvic support to add it to your plan and start a connection.

​
Before you start

Your VPN device must:
  • Run a route-based VPN (also called VTI). Google HA VPN, which Corvic uses, supports only dynamic (BGP) routing.
  • Speak IKEv2 with the cipher suites below.
  • Run BGP over each tunnel.
  • Have a public IPv4 address on each interface that ends a tunnel. One address is enough; two give you redundancy on your side as well.
Google’s steps are in Create an HA VPN gateway to a peer VPN gateway. Device guides cover Cisco ASA, FortiGate, Check Point, AWS, and Azure.
Corvic uses 100.64.0.0/10 for the ranges it routes over the tunnels: its source range and its inbound range. If your network already uses that range, for example for Tailscale or carrier equipment, tell Corvic in your request so it can pick addresses that don’t clash.

​
The request form

Copy this table, fill in your values, and send it to Corvic support. The example values show the expected format.
Use a private BGP ASN in 64512–65534 or 4200000000–4294967294, the ranges Google Cloud Router accepts. Any value in those ranges works except Corvic’s 4269070000.
List every address a database client may connect to. For Oracle RAC reached through SCAN, list the SCAN name and each of its addresses, and each node VIP’s name and address. For Data Guard, list every host in your clients’ address list. Corvic can’t use addresses in 100.64.0.0/10 or 169.254.0.0/16, or prefixes that overlap them. If one of your prefixes conflicts with Corvic’s own addresses, Corvic tells you when it reviews your request.
Don’t send a pre-shared key, a device model, or a software version. Corvic generates the pre-shared key and sends it by a one-time link. A software version reveals which known vulnerabilities apply to your device, so Corvic asks for it only if a tunnel won’t come up.

​
What Corvic sends back

Corvic’s reply holds the values for your connection:
  • Corvic’s two HA VPN addresses, one per tunnel.
  • Each tunnel’s BGP addresses: one for Corvic and one for you, in a /30 from 169.254.0.0/16.
  • Corvic’s source range, a /26 that every database connection comes from, and its inbound range, a /27 that Corvic advertises along with it.
  • The firewall rules to open, filled in with your addresses.
  • For Cisco Firepower, Fortinet FortiGate, and Juniper vSRX, Google’s generated configuration for your device, already matched to these values.
The pre-shared key arrives separately, by a one-time secret-sharing link. It’s the only secret in the setup. Use it on both tunnels.

​
Configure your VPN device

These are the settings for each part of Google’s peer VPN guide. Google’s own steps for its side (console, gcloud, API) are Corvic’s to do, so skip them.

​
Tunnels

  • Configure two tunnels, one to each of Corvic’s HA VPN addresses, and keep both up. Corvic’s side stays available while one tunnel is down for maintenance.
  • With two device interfaces, tunnel 0 uses your first address and tunnel 1 your second. With one interface, both tunnels use it.
  • Use the same pre-shared key on both tunnels.
  • Set each tunnel interface’s MTU to 1460. That matches Google’s Cloud VPN gateway MTU. Enable prefragmentation so packets are fragmented before they are encapsulated. Clamp TCP MSS to 1350 on traffic through the tunnels. Without the clamp, small queries work but large results stall.

​
BGP sessions

  • One BGP session per tunnel, between the two BGP addresses in Corvic’s reply.
  • Corvic’s ASN is 4269070000. Use your own ASN from the form.
  • No MD5 authentication.
  • Corvic advertises only its source and inbound ranges. Advertise your listed prefixes. Corvic accepts nothing else you advertise.

​
Firewall

Open only these, and drop everything else from Corvic’s ranges: Corvic sends no ICMP, DNS, or other traffic over the tunnels. To add database hosts later without a firewall change each time, you can admit the source range to a whole subnet on your database ports instead of host by host.

​
IKE and traffic selectors

Configure exactly one suite per phase, on both tunnels:
  • Turn on IKE fragmentation (RFC 7383). Google recommends it so IKE packets larger than the gateway MTU still arrive.
  • The tunnels are route-based. HA VPN uses 0.0.0.0/0 for both the local and remote traffic selectors, and BGP decides what goes through them.
The lifetimes in the table are Cloud VPN’s defaults: 36,000 seconds for phase 1 and 10,800 seconds for phase 2. If Corvic’s reply includes a generated configuration for your device, use the lifetimes in that file when they differ. Google’s templates sometimes shorten them for the vendor, and the two sides have to match.
Google lists the IKE ciphers HA VPN supports if your device needs different ones. Tell Corvic before changing them.

​
Prepare your databases

Check each host in the form:
  • The listener accepts Corvic’s source range. If Oracle’s valid node checking (TCP.INVITED_NODES) is on, add Corvic’s source range to it.
  • The TLS certificate names every host clients use. For TCPS, the listener’s certificate must name each hostname in the form, including the RAC node VIPs that a SCAN listener redirects to.
  • A private CA is added to the connector. If your certificates come from your own CA, or are self-signed, add the CA certificate under the database connector’s Trusted CAs. Without it, the connection fails with ORA-29024.
  • A database user for Corvic. Create one with only the access your use needs. Oracle change data capture setup is on the Oracle connector.

​
Health checks your hosts will see

Google’s load balancer, on Corvic’s side, checks each host by opening a TCP connection from Corvic’s source range and closing it at once: no data, no login, no service name. Expect about 3 such connections a minute per host, more under heavy use. The firewall rule for the source range already admits them. An Oracle listener may log each as a connection that sent no connect data, which is expected.

​
Maintenance and support

  • Maintenance. Google maintains one HA VPN interface at a time, and traffic moves to the other tunnel. Change your device one tunnel at a time, too.
  • Alerts. When a tunnel, a BGP session, or a database host goes down, Corvic’s on-call team and your contact are alerted together, in business hours.
  • Adding a host. Send its hostname, address, and port. Corvic adds it and replies with its values. If your firewall admits the source range for a whole subnet, nothing else changes.
  • Changing an address. Tell Corvic before a database host’s address or your device’s public address changes.
  • Rotating the pre-shared key. Corvic sends a new key by a one-time link, and both sides change it in one agreed window. A key that differs between the two sides takes the tunnels down.
  • Getting help. Contact Corvic support and name your connection. Corvic runs the connection test and replies with the step that fails and its usual cause.

​
Troubleshooting

  • Check that UDP 500, UDP 4500, and ESP pass between your device’s public addresses and Corvic’s HA VPN addresses, including on any firewall in front of the device.
  • Compare the IKE settings with the table above: exactly one suite per phase, IKEv2.
  • Re-enter the pre-shared key from the one-time link. A wrong key often shows as a failed handshake rather than an authentication error.
  • If it still fails, Corvic may ask for your device’s software version to check it against Google’s notes.
Check both ASNs, each tunnel’s BGP addresses from Corvic’s reply, and that MD5 authentication is off.
  • Check that you advertise a prefix containing the host’s address.
  • Check the firewall rule from Corvic’s source range to the host’s port, and the listener’s valid node checking.
  • Check that the listener is running on the port in the form.
The tunnels drop full-size packets. Set the tunnel interfaces’ MTU to 1460, enable prefragmentation, and clamp TCP MSS to 1350.
Check that the listener’s certificate names the hostname Corvic connects to, including RAC node VIPs, and that a private CA is added under the connector’s Trusted CAs.

​
Other ways to connect

For a path marked On request, contact Corvic support.

Dedicated IP

Reach services behind an IP allowlist from fixed Corvic addresses.

Connector Vault

Store connector credentials, trusted CAs, and client certificates.

Deployment Options

Single-tenant deployments with their own network.