LAB 43 ‐ Network Visualizer & Network Path Analyzer

Network Visualizer vs Network Path Analyzer in OCI

Both tools are available under OCI Networking and help with network troubleshooting, but they serve different purposes.

Feature	Network Visualizer	Network Path Analyzer
Purpose	Visualize network topology	Troubleshoot connectivity issues
Focus	Understand the network design	Identify why traffic is not reaching the destination
Output	Graphical network diagram	Detailed path analysis report
Traffic Required	No	No
Checks Routing	Shows routes visually	Validates routing decisions
Checks Security Rules	Limited visibility	Identifies exact Security List or NSG blocks
Best For	Understanding architecture	Troubleshooting connectivity

Network Visualizer

Network Visualizer provides a graphical view of your OCI network resources and their relationships.

It can display:

• VCNs
• Subnets
• DRGs
• LPGs
• Internet Gateways
• NAT Gateways
• Service Gateways
• Route relationships

Example Topology

On-Premises
      |
     DRG
      |
    Hub VCN
   /       \
Spoke1    Spoke2

Using Network Visualizer, you can easily see how all components are connected and understand the overall network architecture.

Common Use Cases

• Understanding Hub-and-Spoke architectures
• Reviewing network design
• Verifying VCN connectivity
• Creating network documentation
• Exporting topology diagrams

🗺️ Lab Scenario: Infrastructure Verification using OCI Network Visualizer

🎯 Objective

To visually audit the entire VCN topology and ensure all subnets, compute instances, route tables, and security lists are correctly mapped according to the architecture design.

🔍 Troubleshooting / Audit Use-Case

Unlike Path Analyzer which tests live traffic, Network Visualizer was used to perform a architectural audit:

1. Verifying Isolation: Confirmed that the App-Server is strictly sitting inside the Private Subnet and has no direct connections to the Internet Gateway.
2. Checking Associations: Verified that the newly created custom Route Tables and Security Lists are successfully attached to their respective subnets (no orphaned configurations found).

Network Path Analyzer

Network Path Analyzer is a troubleshooting tool that validates network connectivity between a source and destination without sending actual traffic.

It analyzes:

• Route Tables
• Security Lists
• Network Security Groups (NSGs)
• Gateways
• VCN Routing
• DRG Routing

Example Scenario

Suppose you cannot SSH from a Jump Server to an Application Server.

Jump Server (10.0.1.10)
        |
        X
        |
App Server (10.0.2.10)

Create an NPA test with:

• Source: Jump Server
• Destination: App Server
• Protocol: TCP
• Port: 22

Sample Result

Path Found
↓
Route Table: Allowed
↓
NSG Rule: Denied
↓
Connectivity Failed

This immediately identifies the component blocking the traffic, reducing troubleshooting time.

Common Use Cases

• SSH (Port 22) connectivity issues
• HTTP (Port 80) connectivity issues
• HTTPS (Port 443) connectivity issues
• Connectivity between subnets
• Hub-and-Spoke troubleshooting
• OCI to On-Premises connectivity validation
• Security List and NSG validation

When to Use Which?

Use Network Visualizer When

• You want to understand the network architecture.
• You need a graphical representation of network resources.
• You are documenting the environment.
• You want to verify how VCNs and gateways are connected.

Use Network Path Analyzer When

• A connection is failing.
• SSH, HTTP, or HTTPS traffic is not working.
• You need to identify blocked routes or security rules.
• You want to validate end-to-end connectivity.

Quick Summary

Network Visualizer helps you understand how the network is designed by displaying a graphical topology.

Network Path Analyzer helps you understand why connectivity is failing by analyzing the complete network path between a source and destination.

Steps for Network Visualizer

Click on the Burger Menu in left side, select Networking than go to the Network visualizer

Select Compartment(where your VCN is) and we can see the available networks in our VCN

By selecting the VCN and clicking View additional resource details, you can view the associated Public and Private Subnet details.

Error because there is no network in hub-compute-and-storage-compartment

Steps for Network Path Analyzer

Click on the Burger Menu in left side, select Networking than go to the Network Path Analyzer

Policy has been updated now click on Create path analysis

Enter the Name, select the Compartment, and choose the Protocol.

In the Source section, select IP Address and enter the private IP address of the bastion-server(in my case). No source port configuration is required.

In the Destination section, enter the private IP address of the app-server and specify Port 22. Since we are validating connectivity using the Telnet utility through the OCI Network Path Analyzer GUI, both the destination IP address and destination port must be provided.

🛠️ Lab Scenario: Network Troubleshooting with OCI Network Path Analyzer

🎯 Objective

To simulate a real-world network connectivity issue and verify how the OCI Network Path Analyzer pinpoints the exact root cause of a failure.

🛑 Simulated Issue

Deliberately deleted the Ingress Rule for Port 22 (SSH) in the Private Subnet's Security List (which was configured to allow traffic from the Bastion Subnet CIDR). This was done to simulate a scenario where a DevOps engineer or developer forgets to open the required firewall ports.

🛠️ Scenario: Troubleshooting Network Connectivity using OCI Network Path Analyzer Problem: Bastion server was unable to communicate with the App server on Port 22.

Analysis: Ran the OCI Network Path Analyzer, which accurately pinpointed that the traffic was blocked at the Application Subnet's Security List (Missing Ingress Rule).

---

📊 Analysis Findings (The Error Log)

Parameter	Observation / Result
Forward Path Result	Unreachable
Return Path Result	- (No return path evaluated as forward path failed)
Security Status	Denied
Routing Status	Forwarded based on implicit routing

Detailed Path Hop Breakdown:

• Segment: From Bastion-Server To App-Server
• Routing Action: Forwarded (Based on implicit VCN routing rules)
• Security Action: Denied (Blocked by the destination subnet security posture)

---

🔍 💡 Root Cause Identified

Analysis Summary: The OCI Network Path Analyzer clearly demonstrated that while internal VCN routing was functional (Forwarded based on implicit routing), the traffic was blocked at the destination layer (Security Status: Denied).

This explicitly confirms a missing or misconfigured Ingress Rule in the destination (Application Server) Subnet's Security List.

🔧 Resolution & Verification

1. Re-added the missing Ingress Rule in the Private Subnet Security List:
   • Source Type: CIDR (Bastion Subnet CIDR Block)
   • IP Protocol: TCP
   • Destination Port Range: 22
2. Re-ran the analysis path, and the status successfully changed to Reachable for both Forward and Return paths.

Resolution: Added the missing Ingress rule for Port 22 allowing traffic from the Bastion private IP. Re-ran the analyzer, and the path became successfully Reachable.

🌐 What is a "Hop" in Networking?

In computer networking, a Hop represents one leg of the journey that a data packet takes from its source to its destination. Every time a packet is passed from one network device (like a router, gateway, or virtual firewall) to the next, it is counted as one hop.

• In this Lab: The OCI Network Path Analyzer breaks down the traffic route into specific Path Hops (e.g., from Bastion-Server to App-Server segment) to show exactly at which checkpoint the packet was allowed or denied.