Two VPCs, or a VPC and an on-prem site, use the same CIDR and now must talk. What are your options?
Show the answer
Say this first
The clean fix is to re-address one side. If that is not possible, I would expose only the services needed through PrivateLink, which does not care about overlap, or translate addresses: a private NAT gateway in a small routable secondary range, NAT on a VPN gateway or appliance, or load balancers in routable subnets for inbound flows. Plain peering is out, because AWS refuses peering between overlapping VPCs.
Go deeper
Option 1: re-IP
Painful, but it removes the problem forever. Often the right answer for a small VPC or a new acquisition.
Option 2: PrivateLink (service-level connectivity)
The provider puts the service behind an NLB and publishes an endpoint service. The consumer creates an interface endpoint, which takes an IP from the consumer's own subnet. Neither side ever routes to the other's range, so overlap does not matter. Limits: one direction only (consumer starts connections), and it exposes services, not whole networks.
Option 3: NAT with a private NAT gateway (AWS pattern)
- Add a small, unique secondary CIDR to each VPC (the routable range), for example
100.64.10.0/24. - Keep workloads in the overlapping, non-routable range.
- Put a private NAT gateway in a routable subnet. Outbound traffic to the other network is SNATed to it and sent via the transit gateway.
- For inbound, place an internal ALB or NLB in the routable subnets with targets in the overlapping range.
Option 4: NAT on the edge
For on-prem overlap, translate on the VPN or firewall: Azure VPN Gateway supports NAT rules, and a firewall or router appliance in a transit VPC can do static or dynamic NAT. Every translated service needs DNS that returns the translated address.
What I tell the interviewer
Overlap is a planning failure; NAT is a workaround that adds state, breaks protocols that embed addresses, and complicates troubleshooting. I would choose PrivateLink for a few services and re-IP for broad connectivity.
They will ask next
Can a transit gateway route between two attached VPCs with the same CIDR?
Not usefully. It cannot hold two routes for the same prefix pointing at different attachments in one route table, so you still need NAT or separate route tables with translation.
Which applications break with NAT in the path?
Anything that carries IP addresses inside the payload or needs inbound connections to a specific host: FTP active mode, SIP without an ALG, some licensing and Kerberos setups, and peer-to-peer protocols.
Traps
- Suggesting VPC peering. AWS will not create a peering connection between overlapping CIDRs.
- Forgetting DNS. After NAT, clients must resolve names to the translated addresses.