VPC CIDR block association restrictions - does order of CIDR blocks matter?

Question

Hi, 
I am trying to understand the AWS VPC User Guide at [page](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-cidr-blocks.html#add-cidr-block-restrictions) IP Addressing > VPC CIDR Blocks, section 'IPv4 CIDR block association restrictions'.

The section seems to suggest that the restricted combinations of multiple VPC CIDR blocks depends on the order in which the CIDR blocks are added, and I wanted to confirm if this is the case or if I have misunderstood (because it feels counter-intuitive somehow).

Specifically, the first row of the table seems to say that if you have an existing VPC CIDR in the private range 10.0.0.0/8 then you can add a further CIDR to the VPC which is publicly routable (non-RFC 1918). The final row of the table seems to say that if you have an existing publicly routable (non-RFC 1918) VPC CIDR then it is forbidden to add a further CIDR which is in the private (RFC 1918) ranges. In other words, the combination of one public and one private CIDR is only acceptable if the first CIDR to exist is a private one. Ie order matters.

Can someone please inform me if I have understood this correctly? Many thanks in advance...

Riku_Kobayashi · Accepted Answer

Hello.

I think your understanding is correct.  
This limitation occurs when adding a CIDR to an existing VPC in the document below.  
https://docs.aws.amazon.com/vpc/latest/userguide/add-ipv4-cidr.html

For example, suppose you want to add a CIDR to a VPC that has a CIDR of "10.0.0.0/16".  
You can add a CIDR in the range of "10.0.0.0/8" in the range of "/16 to 28" to this VPC.  
Specifically, you can add "10.1.0.0/16" etc.  
Also, you can add "20.1.0.0/16" etc. as a public CIDR.  
If you try to add something like "192.168.0.0/16" that is out of range, the following error will occur.  
```
The CIDR '192.168.0.0/16' is restricted. Use a CIDR from the same private address range as the current VPC CIDR, or use a publicly-routable CIDR. For additional restrictions, see https://docs.aws.amazon.com/vpc/latest/userguide/vpc-cidr-blocks.html
```

Conversely, if you try to add "10.0.0.0/16" to a VPC with CIDR "20.1.0.0/16", the following error will occur.  
You can add public CIDR ranges such as "5.0.0.0/16".  
```
The CIDR '10.0.0.0/16' is restricted. Use a CIDR from the same private address range as the current VPC CIDR, or use a publicly-routable CIDR. For additional restrictions, see https://docs.aws.amazon.com/vpc/latest/userguide/vpc-cidr-blocks.html
```

This limitation applies when adding a VPC CIDR, not when creating a VPC.

Ben L · Answer

Thank you for the above responses, much appreciatd. I also reached out to the AWS docs team and they confirmed my (and the above answers') understanding was correct, and they have added some further clarification to those docs.

Ben L

answered 2 years ago

VPC CIDR block association restrictions - does order of CIDR blocks matter?

Add your answer

Relevant content