Peering in OCI

 

Interview-Ready Answer

In OCI, a subnet can be associated with multiple security lists, with a maximum limit of 5 security lists per subnet. All rules from the attached security lists are evaluated together, and traffic is allowed if any applicable rule permits it.

Note:- Any subnet can't have same IP address 

Key Differences at a Glance

Feature	Stateful Firewall	Stateless Firewall
Connection Context	Keeps track of active sessions using a State Table (long-term memory).	Treats every packet as an isolated event without remembering previous traffic.
Return Traffic	Automatically permits return traffic for legitimate, already-established sessions.	Needs explicit, manual rules created to allow reply traffic back into the network.
Speed & Efficiency	Slower due to the processing and memory overhead required to track state.	Faster and lightweight, utilizing very little CPU or memory.
Security Level	High; protects against state-based threats (e.g., SYN floods, session hijacking).	Basic; excellent for high-performance filtering, but easier to bypass via spoofing.
Primary Use Cases	Enterprise perimeters, edge networks, user-facing internet connections.	High-speed routers, internal network segments, Access Control Lists (ACLs).

 

Stateful firewall remembers connections and automatically allows return traffic. Stateless firewall does not remember connections and requires separate rules for both directions. For Web Servers and Database Servers in OCI, Stateful firewall is generally the preferred choice.

Q: What is NSG?

Answer:

An NSG (Network Security Group) is a virtual firewall in OCI that controls ingress and egress traffic for specific VNICs or instances, independent of the subnet.

---

Q: Difference between Security List and NSG?

Security List	NSG
Subnet level	Instance/VNIC level
Applies to all resources in subnet	Applies only to attached resources
Less flexible	More flexible
Older approach	Recommended approach