ANS-C01 Question 175
Select 2Your organization has a hybrid architecture with an on-premises data center connected to AWS using an AWS Site-to-Site VPN. The VPN connection uses BGP for dynamic routing. Recently, a new VPC was added, and its CIDR block overlaps with the CIDR block of one of the subnets in the on-premises network. Traffic destined for the overlapping CIDR from the on-premises network is not reaching the VPC. Which of the following actions should you take to resolve this issue?
- A
Update the VPC's CIDR block to a non-overlapping range.
- B
Use route filtering in the AWS VPN connection to filter out the overlapping CIDR block from on-premises routes.
- C
Create a static route in the VPC route table for the on-premises subnet, pointing to the VPN connection.
- D
Configure NAT on the VPC to translate the overlapping CIDR block to a non-overlapping range.
- E
Use AWS Transit Gateway and route propagation to handle the overlapping CIDR issue.
Show answer and explanation
Correct answers: A, D
Explanation
Overlapping CIDR blocks cause routing conflicts because the network cannot determine which destination to use. Resolving this issue often involves either modifying the CIDR block to ensure uniqueness or using NAT to translate one of the conflicting ranges into a non-overlapping range. Solutions like Transit Gateway or route filtering do not inherently address the issue of overlapping CIDR blocks.
- A. Correct.
This is a valid solution since modifying the VPC's CIDR block to a non-overlapping range eliminates the conflict. However, this may not always be feasible if the VPC is already in use.
- B. Incorrect.
Route filtering does not solve the issue of overlapping CIDR blocks because it only prevents routes from being advertised. It does not handle the underlying traffic routing issue.
- C. Incorrect.
Adding a static route would not resolve the problem of overlapping CIDR blocks. The route table still wouldn't be able to differentiate between the conflicting addresses.
- D. Correct.
Configuring NAT is a valid solution as it can translate the conflicting CIDR block into a non-overlapping range, allowing traffic to flow correctly between the on-premises network and the VPC.
- E. Incorrect.
While AWS Transit Gateway can simplify network architecture, it does not inherently solve the problem of overlapping CIDR blocks. Additional configurations like NAT or route translation would still be required.