Configuration of Static Site-to-Site VPN with Single IP Encryption Domain: Seeking Feedback and Documentation

Dear Community,

We have received a request from a client to configure a static Site-to-Site VPN using static routes (not dynamic routes). They require that the encryption domain be limited to a single IP address on both our side and their side to meet their VPN connection configuration standards. Specifically, they wish to expose only one device on their end, which will connect to a remote IP address within our cloud infrastructure.

The client does not wish to use broader CIDR ranges for the Local IPv4 network or the Remote IPv4 CIDR parameters, such as:

• set address VPC-SUBNET 10.0.0.0/16
• set address LAN-SUBNET 192.168.0.0/16

We understand that it is possible to define a single IP address in the static routes of the Site-to-Site VPN configuration, and this option has been communicated to the client. However, they have insisted that their requirement for using a single IP address for the encryption domain is achievable.

Although no visible restrictions are apparent when setting these values through the web console or command line interface, we seek to understand if it is possible to comply with the client's request based on official AWS documentation, or any relevant Site-to-Site IPsec VPN documentation. Specifically, we are looking for information on whether this requirement can be met, or if it must adhere to certain prefix ranges, for example, subnet definitions within AWS Cloud that typically require a range from /16 to /28.

Additionally, we would like to confirm if it is feasible to define a single IP address in the static routes of the Site-to-Site VPN instead of using a broader encryption domain.

We appreciate your input and any official documentation or relevant resources you can provide on this matter.

Kind regards,