By using AWS re:Post, you agree to the Terms of Use
/Transit Gateway: Connect two DCs via VPN with overlapping CIDR range/

Transit Gateway: Connect two DCs via VPN with overlapping CIDR range


Consider a setup similar to:





You want to use a Transit Gateway and site-to-site VPN to connect each on-premises data center with one of the VPCs. Is this possible if the DCs have the same CIDR Ranges? How does the TGW know where to route traffic back?

1 Answers
Accepted Answer

I see different use cases here:

  1. VPC1 <-> DC1
  2. VPC1 <-> DC2
  3. VPC2 <-> DC1
  4. VPC2 <-> DC2

Separately, use cases 1 and 4 together, or use cases 2 and 3 together are doable by creating two separate route tables for VPCs and have data center CIDRs pointing to VPN attachments.

if you want to do all of them together then the complication arises and you need to NAT DC1 or DC2 (one of them) to something like and use that NATed range as destination in the route table. Here the aim is to make one DC's range look different for TGW. This NAT can be done either in Customer Gateway side or AWS by spinning up NAT appliance in a separate VPC then use that as destination for traffic destined to a DC.

With NAT in picture things generally get messy.

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions