How to Handle Overlapping IPs

The rapid transformations in cloud infrastructure have ushered in new challenges, notably the issue of overlapping IP addresses and CIDR blocks. This predicament arises predominantly in hybrid and multi-cloud environments where there’s no centralized system for assigning unique network spaces, leading to connectivity issues across different organizational networks.

Understanding the Overlapping IP Problem

Overlapping IP addresses occurs when identical IP ranges are allocated across different networks or applications, causing significant communication hurdles. This problem is especially prevalent in scenarios such as mergers and acquisitions, where two previously independent networks merge, or when organizations expand into public clouds like AWS, Azure, or Google Cloud, each with its own network configurations.

Common Scenarios Leading To Overlapping IP Addresses

Below are some common scenarios and use cases that Aviatrix solution architects have seen repeatedly with customers:

1. Independent network design in cloud-based services or applications needing to connect to external customer networks.
2. Mergers and acquisitions combining networks with independently planned IP ranges.
3. Connectivity to third-party vendors and partners, where each network was designed without coordination.
4. Within an organization, especially when different business units independently design their cloud VPCs or on-premises networks, potentially leading to overlaps even across AWS VPCs and Azure VNETs​.

What Happens on the Network when Overlapping IPs are Present?

Let’s consider a setup where Application 1 resides in Network 1, in this illustration we’ll assume it’s an AWS VPC (see image below) . This application needs to reach application 2 in network 2 (for example a customer site). Both networks (1 and 2) have the same IP range: 10.0.0.1-to-10.0.0.255. So, when Application 1 sends a message to Application 2, the router of Network 1 will loop the packet back into Network 1.

Connecting these networks together creates faulty traffic flows or even worse, unpredictable traffic flow. This scenario should be avoided at all costs. Accidental overlapping IP (CIDR) connections have resulted in major network outages.

How to Fix Overlapping IP Problems

Aviatrix provides a comprehensive solution to this problem through its cloud network platform, which has been deployed in numerous production environments. The platform facilitates the mapping of conflicting IP ranges to virtual IP ranges, thus allowing seamless connectivity between networks without the need for reconfiguration. For instance, one network’s IP range can be mapped to a virtual range like 192.168.0.0 to 192.168.0.255, effectively eliminating the overlap​​​.

Now, when Application 1 sends a packet to Application 2, the Aviatrix Gateway changes (or maps) the source and destination IP addresses to the respective virtual IP addresses.

When Application 2 responds to Application 1, the Aviatrix Gateway ensures the reverse mapping is done as well:

Common Deployment Patterns to Address Overlapping IPs

Resolving Intra-cloud IP Address Overlaps

Sometimes the overlapping IP spaces are within the organization’s cloud environment. Enterprises use the Aviatrix Gateway’s mapping solution to resolve this issue. This diagram shows how you can peer two AWS VPCs with IP overlaps using Aviatrix Gateways.

Fixing Inter-cloud IP Address Overlaps

Some enterprises have cross-cloud (cross CSP) overlapping IP issues that can also be handled using the same Aviatrix capability. This diagram depicts how an AWS VPC and Azure VNET with overlapping IP spaces can be connected using Aviatrix Gateways.

Handling IP Overlaps in Partner and Customer Networks

Companies that host software for other businesses need to connect to a multitude of customer networks (3rd party sites, AWS VPCs, Azure VNETs, Oracle VCNs etc.). These customer networks pose a high possibility of overlapping IPs. Even if there was no overlapping IP with a particular customer, it is best practice to mask your internal IP ranges from external networks. Aviatrix is the market leader in providing this business-critical connectivity to 3rd party networks.

The IPsec connection can be terminated on a non-aviatrix node like a Cloud-native VPN gateway.

Handling IP Address and Subnet Overlaps

When IP overlap is encountered by organizations, most often, the overlap is not between the source and destination application IP address or the whole network range. The overlap issue is commonly between subnets in the networks. A subnet, as the name suggests, is a subset of the network’s IP range. When two networks have a subnet overlap, all the same issues surface making it impossible to connect using standard routing techniques.

Again, the Aviatrix Gateway’s intelligent mapping will alleviate the problems of subnet overlap.

Key Benefits of Using Aviatrix for Overlapping IPs

The advantages of the above–mentioned solutions are:

1. It is a simple configuration in the Aviatrix controller.
2. There is no need to change configurations in the applications. It is transparent to the applications and the application owners.
3. It is transparent to the third-party router (Router 2). All the intelligence is built into the Aviatrix Gateways running in your public cloud (AWS/Azure/GCP/OCI etc.)
4. Built-in high availability (HA) across Availability Zones and Regions.

Using this solution, enterprises can handle overlapping IP issues that come up internally within the organization or with external connectivity requirements involving customers and partners.