Network design for secure EXADATA monitoring with DPA

Good question.  This may come down to an architectural issue within your specific environment, but generally speaking, we have to get a jdbc connection to the instance.  So we need to be able to reach the listener (sometimes the admin interface is not being listened on).  Since we are agentless, this would be a requirement.  You can think of DPA as basically just another application needing access to the instance.

Now I get that you don't want to mix traffic, so it may require a listener configuration tweak (to listen on admin interface).