How does Alkira solve the problem of overlapping IP addresses in multi-cloud environments?

Alkira addresses overlapping IP address challenges in multi-cloud environments using its NAT policy, which is part of an intent-based policy framework. This allows granular controls at a global level, enabling organizations to connect on-premises sites and cloud networks—even when IP spaces overlap. Alkira's NAT policies can be applied network-wide, supporting dynamic and static NAT, and can be configured for bi-directional translation to ensure seamless communication between overlapping subnets. Source

What types of NAT are supported by Alkira's platform?

Alkira supports several types of NAT, including Dynamic IP and Port (PAT), Static IP (one-to-one NAT), and dynamic NAT for translating entire subnets. For destination address translation, Alkira supports Static IP, Static IP and Port, and Static Port (port forwarding). These options provide flexibility for various enterprise networking scenarios. Source

How does Alkira's NAT policy differ from traditional cloud NAT solutions?

Traditional cloud NAT gateways (e.g., AWS, Azure) typically provide outbound internet connectivity and cannot address overlapping IP use cases. Alkira's NAT policy is designed for multi-cloud networking, allowing NAT rules to be applied at the cloud exchange point (CXP) level, supporting both inbound and outbound traffic, and enabling granular, scalable policy enforcement across connectors and sites. Source

Can Alkira's NAT policy be applied to both cloud and on-premises networks?

Yes, Alkira's NAT policy can be applied to both cloud networks (such as VPCs/VNets) and on-premises sites (SD-WAN or IPsec). This enables seamless integration and communication between different environments, even when IP address spaces overlap. Source

What is Alkira's intent-based policy framework?

Alkira's intent-based policy framework allows organizations to define granular network policies—including NAT rules—at a global level. This framework enables automated, scalable enforcement of policies across the entire network fabric, simplifying management and reducing operational complexity. Source

How does Alkira handle bi-directional NAT translation?

Alkira's NAT policy supports bi-directional translation, meaning NAT rules can be applied to both inbound and outbound traffic. This ensures that communication between overlapping subnets is seamless and return traffic is properly routed, preventing issues like blackholing. Source

What is an Alkira Cloud Exchange Point (CXP)?

An Alkira Cloud Exchange Point (CXP) is a networking fabric in the cloud that connects on-premises sites and cloud networks using native constructs. CXPs allow overlapping IP spaces and enable Alkira's policies, including NAT, to be applied network-wide for seamless integration. Source

How does Alkira's NAT policy help during mergers and acquisitions?

During mergers and acquisitions, organizations often encounter overlapping IP ranges between different cloud networks. Alkira's NAT policy enables seamless integration by translating overlapping subnets, allowing communication without the need to reconfigure existing IP schemes or disrupt production traffic. Source

Can Alkira's NAT policy be used for selective exposure of cloud resources?

Yes, Alkira's NAT policy supports destination address translation, allowing organizations to expose select resources (e.g., web servers) while hiding the real network prefix from other parts of the network. This enhances security and control over cloud resources. Source

How does Alkira prevent blackholing in overlapping IP scenarios?

Alkira's NAT policy ensures that return traffic from overlapping subnets is properly translated, preventing blackholing. By applying source NAT to both sides of the communication, Alkira maintains unique prefixes for each subnet, enabling successful routing and connectivity. Source

Can Alkira's NAT policy be configured for specific connectors or sites?

Yes, Alkira's NAT policy can be applied to a single connector, a group of connectors, or specific sites. This flexibility allows organizations to tailor NAT rules to their unique network topology and requirements. Source

What is the process for configuring NAT rules in Alkira?

NAT rules in Alkira are configured within the policy framework, where administrators define match criteria for traffic flows and specify the desired translation. Options include matching source or destination prefixes, enabling bi-directional translation, and invalidating pre-translated prefixes to control network advertisement. Source

How does Alkira's NAT policy support cloud migration projects?

Alkira's NAT policy simplifies cloud migration by enabling seamless connectivity between on-premises and cloud networks, even when IP address spaces overlap. This eliminates the need for reconfiguring IP schemes or creating new cloud resources, reducing migration complexity and risk. Source

Can Alkira's NAT policy be used for application consolidation?

Yes, Alkira's NAT policy enables organizations to consolidate applications from different development teams that may use overlapping address spaces. By translating subnets as needed, Alkira ensures that applications can communicate without IP conflicts. Source

How does Alkira's NAT policy enhance network scalability?

Alkira's NAT policy is designed for scalability, allowing organizations to manage large, complex networks with overlapping IPs across multiple clouds and on-premises sites. The policy framework supports automated, network-wide enforcement, reducing manual configuration and operational overhead. Source

What are the real-world benefits of using Alkira for multi-cloud networking?

Alkira enables organizations to build scalable, secure, and highly available networks in the cloud, addressing challenges like overlapping IPs, complex NAT configurations, and seamless integration between on-premises and cloud environments. Customers benefit from ease of use, rapid deployment, and reduced operational complexity. Source

How can I learn more about Alkira's cloud networking solutions?

You can learn more about Alkira's cloud and multi-cloud networking solutions by visiting Alkira's Cloud Networking Page and taking a virtual tour at Alkira's Virtual Tour. Personalized demos are also available upon request. Source

What customer success stories demonstrate Alkira's NAT policy in action?

A real-world example involves a customer connecting on-premises branch locations to AWS VPCs using Alkira. When overlapping subnets were discovered, Alkira's NAT policy enabled seamless communication without reconfiguring IP schemes or disrupting production traffic. Source

How does Alkira's NAT policy support hybrid cloud networking?

Alkira's NAT policy supports hybrid cloud networking by enabling seamless integration between on-premises and cloud networks, regardless of overlapping IP address spaces. This simplifies network design and ensures consistent connectivity across environments. Source

What is the role of Alkira's policy framework in network governance?

Alkira's policy framework provides centralized control and visibility over network policies, including NAT rules. This enhances governance, transparency, and compliance across multi-cloud and hybrid cloud environments. Source

How does Alkira's NAT policy contribute to business agility?

Alkira's NAT policy enables rapid onboarding of new sites and clouds, seamless integration during mergers, and quick resolution of overlapping IP issues. This drives business agility by reducing deployment times and minimizing operational disruptions. Source

What industries benefit from Alkira's NAT policy and multi-cloud networking solutions?

Industries such as manufacturing, retail, healthcare, financial services, media & entertainment, telecommunications, biotech, software, and aviation have benefited from Alkira's NAT policy and multi-cloud networking solutions, as demonstrated in various case studies. Source

What is Alkira's pricing model?

Alkira offers both consumption-based (pay-as-you-go) and commitment-based pricing models. Pricing is tailored to each customer and is influenced by factors such as the quantity and size of network elements, cloud and on-prem connectors, next-generation firewalls, and data egress. Fixed hourly rates are available for specific components. For a personalized quote, visit Alkira's Pricing Page.

What core problems does Alkira solve for enterprises?

Alkira solves critical problems such as intra-cloud connectivity, global connectivity, design sprawl, performance issues, cost challenges, complexity in multicloud and hybrid cloud networking, lack of visibility and governance, scalability challenges, and operational complexity. Source

What business impact can customers expect from using Alkira?

Customers can expect operational efficiency (cloud setup time reduced by 96%, network management time by 47%), cost savings (up to 40% lower TCO), scalability, enhanced security, global connectivity, business agility, and improved service quality (mean-time-to-resolution reduced by 70%). Source

Who is the target audience for Alkira's product?

Alkira's product is designed for technical personas (Network Architect, Cloud Architect, Security Architect, IT Manager/Director, CloudOps) and business personas (VP, CTO, CIO, CISO) in organizations navigating multicloud and hybrid cloud environments. Source

What customer pain points does Alkira address?

Alkira addresses pain points such as intra-cloud connectivity, global connectivity inefficiencies, design sprawl, inconsistent network performance, high costs, complexity in multicloud networking, lack of visibility and governance, scalability challenges, and operational complexity. Source

How does Alkira's platform deliver measurable ROI?

Alkira reduces cloud setup time by 96%, network management time by 47%, and delivers up to 40% lower TCO compared to traditional solutions. Customers have reported reductions in network stack complexity (up to 88%) and fewer devices needed for cloud connections (44% reduction). Source

What customer feedback has Alkira received regarding ease of use?

Customers praise Alkira's drag-and-drop interface and rapid deployment. For example, a customer implemented a proof of concept in just 4 hours, and another noted that "I just need one engineer to manage the world. Otherwise, 10 engineers." Source

How long does it take to implement Alkira's platform?

Proof of concept can be implemented in as little as 4 hours, and full production deployment is typically completed in about 8 weeks. Source

What are some notable customer success stories for Alkira?

Notable success stories include Michaels transforming its network across 1,400 stores, Koch Industries reducing network complexity, Warner Hotels improving networking efficiency, and SITA integrating global aviation infrastructure. Source

What integrations does Alkira offer?

Alkira integrates with AWS, Azure, Google Cloud, Cisco, Fortinet, Palo Alto, Check Point, Splunk, Terraform, Infoblox, HPE Aruba, Wiz, and Itential Automation Platform. These integrations enhance connectivity, security, and automation. Source

Does Alkira provide an API?

Yes, Alkira provides an API for developers and users to integrate platform functionalities into their systems. Detailed documentation is available at Alkira's API Documentation Page.

What technical documentation resources does Alkira offer?

Alkira provides whitepapers (e.g., On Demand Next-Generation Cloud Firewalls), solution briefs, and a dedicated wiki for in-depth technical information. Wiki

What security and compliance certifications does Alkira have?

Alkira is SOC 2 compliant and adheres to PCI-DSS standards, ensuring robust security and protection of customer data. Source

How does Alkira ensure secure connectivity for distributed workforces?

Alkira provides integrated security features such as Zero Trust Network Access (ZTNA) and next-generation firewalls, ensuring secure connectivity for distributed workforces and applications. Source

How does Alkira compare to traditional cloud networking solutions?

Alkira offers a true abstraction layer, leveraging cloud providers' infrastructure for end-to-end solutions, single-click provisioning, and a vendor-agnostic approach. This simplifies multicloud networking and reduces deployment times from months to minutes, compared to manual configurations required by traditional solutions. Source

What are Alkira's competitive advantages?

Alkira's competitive advantages include ease of use (drag-and-drop interface), rapid deployment (POC in 4 hours, production in 8 weeks), measurable ROI, vendor-agnostic approach, integrated security, global backbone-as-a-service, and comprehensive visibility. Source

How does Alkira's vendor-agnostic approach benefit customers?

Alkira allows customers to choose their preferred security and network stack components without vendor lock-in, offering unmatched flexibility and integration with existing investments. Source

What is Alkira's vision and mission?

Alkira's vision is to simplify and enhance networking across multicloud and hybrid cloud environments. The mission is to eliminate the complexity of traditional hardware-dependent networking and provide seamless, secure, and scalable connectivity through Network Infrastructure-as-a-Service (NIaaS). Source

What industry recognition has Alkira received?

Alkira has been ranked as one of the fastest-growing companies in North America, recognized as a Gartner Cool Vendor, and has secured Series C funding. Source

Blog

Solving Overlapping IPs in the Era of Multi-Cloud Networking

February 22, 2022

Summarize with AI

Cloud adoption continues to grow feverishly as AWS, Azure, and GCP showed YoY revenue growth of 40%, 48%, 45% respectively in Q4 ‘21. In this digital transformation journey, enterprises have found that you can not simply lift and shift your network designs from on-premises to the cloud and it requires a different approach to build scalable, secure and highly available networks in the cloud.

With all the benefits that come with migrating your infrastructure to the cloud, we take for granted some of the simple networking concepts we can do on-premise that becomes very difficult in the cloud. Today we would like to discuss the problem of overlapping IP address space in the cloud networks and how Alkira can help you address it elegantly at scale.

Table of Contents

The IP Overlap Problem

Overlapping IP addresses in the cloud is a common issue that can arise due to various causes. Here are some of the common scenarios:

Your organization acquires another enterprise and their cloud’s IP ranges overlap with your existing cloud networks.
During onboarding of on-premise networks to connect them to the cloud, you find overlapping subnets between on-premise sites and cloud networks.
Consolidation of cloud applications in an organization discovers that there are multiple applications from different development teams that use the same address space of 10.0.0.0/16.

Network Address Translation (NAT) can help, at a complex cost

If these problems occur in a data center, networking teams traditionally address them by configuring Network Address Translation (NAT) on the routers in the access layer. What do you do for cloud networks? NAT Gateways in AWS or Azure only provide outbound internet connectivity for the virtual networks and cannot address these use cases. Building a transit network in the cloud and using a third party device to perform NAT is cumbersome and does not scale. Even the newly minted Private NAT Gateway in AWS is complex to configure and manage.

Alkira NAT Policy, built for multi-cloud networking

NAT policy is a part of Alkira’s intent-based policy framework providing granular controls that can be enforced at a global level. It can be used to address various NAT use cases in enterprise networks. When we discuss NAT use cases with Alkira, we really have to think about how the policy is applied relative to the Alkira CXP. The Alkira CXPs or cloud exchange points form a networking fabric in the cloud that you can connect on-premise sites like SD-WAN or standard IPsec sites, and also connect your cloud networks using native constructs. Once these on-prem sites and cloud networks like VPC or VNets are connected to the Alkira CXPs – where overlapping IP spaces are allowed, Alkira’s policies can be applied network wide to them and part of the policy is NAT.

The Alkira NAT policies can apply to a single connector or a group of connectors or sites. A NAT policy concatenates multiple NAT rules matching traffic based on the first match, and the NAT rules within the policy will apply to traffic coming inbound from the CXP’s perspective. NAT in the reverse direction would apply if bi-directional translation is enabled. We have to think about what we’re matching in terms of traffic coming in from the connector you’re applying the policy to, and the NAT rules will match the traffic flows and then apply the proper translation that we’re trying to accomplish. The diagram below illustrates where the NAT policy is applied.

Figure 1: NAT rules apply to inbound traffic flows on a CXP

The table below shows the different types of NAT that are supported on the Alkira platform. So under source address translation, Dynamic IP and Port is basically port address translation or PAT in a traditional sense, but the context is obviously a little bit different here. Static IP in our case is one-to-one NAT or dynamic NAT use cases when you want to translate a whole subnet to another prefix with the same CIDR – i.e. translating an entire /24 network to another /24. The IP address in the last octet will remain the same. For destination address translation use cases, Static IP or Static IP and Port is typically used when you only want to expose a select number of, let’s say, web servers from a network in the cloud and hide that cloud network’s real prefix from other parts of the network. Static port is similar to port forwarding use case traditionally when you need to forward a particular port to a different port.

Figure 2: Network Address Translation methods supported on Alkira

Solving Overlapping IP’s with Alkira NAT Policy

Now we’re going to walk through a real-world use case of how a customer utilized NAT policy to solve overlapping IP’s in the cloud. This customer leverages Alkira to connect all of their on-premises branch locations to applications in a number of VPCs in AWS.The roll out was straightforward as the branch locations connect to their regional Alkira CXPs using BGP over IPsec and the VPC’s are connected to CXPs using Transit Gateways. As they started to migrate their on-premises locations on day N, they found a branch’s subnet overlapping with a particular VPC in AWS. Limitations due to production traffic prevents the customer from creating a new VPC or reconfiguring the branch IP scheme.

The problematic topology is shown in the diagram below where Branch2’s IP address of 10.8.100.0/24 overlaps with the AWS VPC:

Figure 3: Branch2 and VPC1 having overlapping IP subnetsThe requirements from the design are as following:

NAT VPC1’s traffic when it goes to Branch2
No changes in traffic from VPC1 to Branch1 and the rest of the network

Due to these requirements, VPC1 will remain 10.8.100.0/24 when its workloads talk to Branch1 or any other parts of the network except Branch2. For traffic from VPC1 to Branch2, we’re going to source NAT 10.8.100.0/24 to the 30.30.30.0/24 subnet shown in the diagram. For Branch2, since it can no longer be seen as 10.8.100.0/24 to the rest of the network, all traffic coming from Branch2 is going to be source NATed to 20.20.20.0/24 regardless of destination. Communication between VPC1 and Branch2 is what generated requirement #1 to NAT VPC1, otherwise the return traffic from Branch2’s original prefix (10.8.100.0/24) to VPC1 (also 10.8.100.0/24) would get blackholed.

The NAT policy applied to Branch2 can be configured with a NAT rule shown below where all traffic from the subnet is source NATed to the 20.x subnet. Additionally, we’re going to check the flag “Match and Invalidate Pre-translated Source Prefix”. That means even though Branch2 is connected to Alkira, the CXP is going to invalidate the 10.8.100.0/24 prefix and prevent it from being advertised to the rest of the network.Figure 4: NAT rule applied to Branch2For VPC1’s policy, we only want to match traffic coming from VPC1 going to the NATed IP of Branch2. So, if traffic matches the destination of 20.20.20.0/24 which is the NATed subnet of Branch2, then the source IP will be NATed to the 30.30.30.0/24 subnet. The configuration for the NAT rule in the policy is shown in the diagram below. Note that the “Match and Invalidate Pre-translated Source Prefix” option is not checked because on behalf of VPC1, we want the Alkira CXP to advertise both 10.8.100.0/24 and the translated prefix to the rest of the network.Figure 5: NAT rule applied to VPC1

With two simple NAT rules in corresponding policies, the desired outcomes are achieved where the two overlapping subnets can now communicate with each other and VPC1’s traffic to the rest of the network is unaffected. The same workflow can be applied to overlapping IP’s between cloud networks, or between two on-premise networks.

Summary

In this blog we discussed the common challenge of overlapping IP address space in the cloud and how Alkira’s NAT policy can be leveraged to address various NAT use cases including overlapping IPs. Furthermore, we demonstrated an example of overlapping prefixes between an on-premise location and a cloud network, and how an Alkira customer solved it with NAT policies. We’ve showed both ease of use and scalability with Alkira’s policy framework.

Learn more about how to build cloud and multi-cloud networks with Alkira at https://alkirastg.compiledrogue.com//cloud-networking/

Take a tour of Alkira cloud network as-a-service solution at https://alkirastg.compiledrogue.com//virtual-tour

Request your own personalized demo at https://alkirastg.compiledrogue.com//demo

Other Categories:

Single, Multicloud and Hybrid Networking

About the author

Frequently Asked Questions

Product Features & Capabilities