AWS site to site VPN - Same range

Question

Morning All,

We are moving all our servers from our data center to AWS. I gather that we will need a Site to Site VPN from our head office to AWS to access the servers without public IPs but it's been a while since I touched networks

The problem is that we have setup our AWS VPC with the same subnet as our current data center so we will need some form of NATing applied (at least while we are still connected to our current DC).

Would we leverage an AWS VPN feature or will it be easier to deploy a virtual VPN appliance (such as an ASA)?

Would we source NAT in AWS to a public IP?

So to summarize:

Head office IP range = 172.16.0.0/22 Datacenter IP range = 192.168.4.0/24 AWS IP range = 192.168.4.0/24

Answer 1

You are going to need to re-number one of your networks. This is unfortunate, but it's the only reasonable solution. Yes, you could cobble a hack together with an entire /24's worth of 1:1 NAT entries for each side, but that is a horrible solution, and will cause problems going forward.

Your best solution is to accept the fact that someone messed up, then plan out how you can re-number one of the networks. Then going forward, make sure that you are maintaining a master numbering spreadsheet so that this doesn't happen again.