OIC Gen3 Private Endpoint: Simplifying Secure Connections

Oracle Integration Cloud (OIC) Gen3 introduces a powerful feature called Private Endpoint (PE) — offering more secure and seamless access to private resources. In this post, we’ll walk through what it is, why it matters, how to set it up, and a real-world use case with troubleshooting tips.

💡 What is OIC Private Endpoint?

A Private Endpoint (PE) in OIC is just like any other private endpoint — it uses a private IP address from your Virtual Cloud Network (VCN). That means your OIC instance will operate within the same private IP space as your other OCI resources.

This is a game changer for securely accessing resources that live behind firewalls, without relying on public internet routing.

❓ Why Use OIC PE?

🔙 Background: OIC Gen2 and Connectivity Agents

In previous versions like OIC Gen2, if you wanted to connect to a resource behind a firewall (e.g., a database or FTP server), you needed to deploy an OIC Connectivity Agent — a lightweight Java application installed on a VM inside your network.

This setup required:

• Managing an extra VM or server
• Installing and maintaining the agent
• Firewall rules and network configurations

Learn more about the OIC Connectivity Agent here

🚀 Enter OIC Gen3 Private Endpoints

With OIC Gen3, Oracle introduced Private Endpoints, eliminating the need to install the agent in many cases.

Benefits include:

• Reduced setup and maintenance overhead
• No need for on-prem agent installations (great for customers with strict security policies)
• Flexibility to choose from:

Adapter connection Access types.

Choose the method that aligns best with your network and security requirements.

🛠 How to Set Up OIC Private Endpoint

Setting up a Private Endpoint is straightforward:

Go to your OIC Instance in the OCI Console → Developer Services → Application Integration → Integration

Open your OIC instance > Navigate to the Private Endpoints section (bottom-left pane) > Click Create Private Endpoint

Select the desired VCN and Subnet from your compartment — this defines where the PE will be created to enable communication with other resources.

Once created, the PE allows secure access to internal OCI or even on-prem resources, much like how the Connectivity Agent worked earlier.

🏗 Architecture Patterns with OIC PE

Here are two common architectural use cases for OIC Private Endpoints:

🔐 Scenario 1: On-Premise Resource Behind a Firewall

Use OIC PE to securely connect to databases or apps running on-premises without installing the agent.

☁️ Scenario 2: Private Cloud Resource

Access OCI-hosted services like DBaaS, FTP servers, or VMs running within a private subnet.

🧪 Real-World Use Case + Error Scenario

Use Case: A customer wanted to connect OIC to an SFTP server hosted on an OCI Linux VM using the FTP Adapter with OIC PE.

Issue Faced: When using OIC PE, the customer provided the Host IP address in the FTP adapter configuration. However, the connection failed with an error.

Resolution: When using OIC Private Endpoints, you must use the Host FQDN (Fully Qualified Domain Name) instead of the IP address. This is required as per Oracle’s documentation.

✅ Once the Host FQDN was used, the connection worked as expected.

Use Case: A Customer want to connect to the ATP DB in a private subnet via private endpoint

Issue Faced:

Ran into the below error even after configuring the Private endpoint

Resolution: When using OIC Private Endpoints for ATP DB in Private subnet, you must add DB port to Security list > Ingress rules of the VCN

✅ Add the DB port to the Security list > Ingress rules to fix the issue.

🔗 References

• Oracle Docs: Connect to Private Resources Using a Private Endpoint