IP Address Overlap Management

During AWS cloud deployment, you may need to provide connectivity between resources that have overlapping IP address ranges. This could be for several reasons, such as a developer configuring a VPC without checking whether the IP address range was available within their IP address manager (IPAM) solution or even a merger/acquisition between two companies. Nonetheless, from a networking perspective, you may be tasked with making connectivity happen. This short section will touch on how to accomplish this with AWS NAT gateways, but there is another method using AWS PrivateLink covered later, in Chapter 3, Networking Across Multiple AWS Accounts.

Using Private NAT Gateways for IP Overlaps

As mentioned in the previous chapters, AWS NAT gateways can be used to allow private subnets to talk to resources on the public internet or even other private resources within the AWS cloud or on-premises. Allowing communication between resources with overlapping IP address space can be one of those particular use cases. Refer to the following example.

Trailcats has acquired another company called Mountain Felines (MF), which also uses the AWS cloud for its applications. An MF VPC needs to communicate with some Trailcats resources, but it is using an IPv4 CIDR that is already in use by a Trailcats VPC, 10.100.0.0/16. Trailcats has attached the acquired MF VPC to their existing AWS TGW but cannot have two routes to the same destination. To allow the two VPCs to communicate with other resources, a secondary CIDR is used within the VPC to house an AWS NAT gateway. The NAT gateway can then be used as the next hop for traffic from the overlapping subnets to any other resources. This (in addition to some DNS adjustments) would allow for the VPC to initiate and establish connectivity. This is shown in Figure 1.21:

Figure 1.21: Overlapping IP space with NAT gateways

The use of a private NAT gateway allows workloads with overlapping IPs to communicate; the nature of a NAT gateway requires that the workload using the NAT gateway is the one to initiate the communication. This is why if both sides initiate communication, a NAT gateway is needed for each subnet.

Note

This same behavior could not be achieved with VPC peering because two VPCs cannot be peered together if they have overlapping CIDR ranges.