Network migrations and cutovers
VPC addressing
Section titled “VPC addressing”The decision that is most painful to reverse is the VPC CIDR range. Overlapping address space between a VPC and the on-premises network breaks routing between them, and no VPN or Direct Connect circuit will fix it — traffic destined for an address that exists on both sides has nowhere unambiguous to go. Take the range from unused space in the corporate addressing plan before the first subnet is created, not after.
A VPC supports IPv4 netmasks from /16 to /28: from 65,536 addresses down to 16.
Reserved addresses
Section titled “Reserved addresses”AWS reserves five addresses in every subnet. For a subnet at 10.0.0.0/24 they are:
| Address | Reserved for |
|---|---|
| 10.0.0.0 | Network address |
| 10.0.0.1 | VPC local router |
| 10.0.0.2 | DNS server |
| 10.0.0.3 | Future use by AWS |
| 10.0.0.255 | Network broadcast address (AWS does not support broadcast, but the address is still reserved) |
The consequence is worth working through for the smallest subnet AWS allows. A /28 has 16 addresses; five are reserved; 11 are usable. Sizing a subnet for exactly the number of instances planned leaves no room for the load balancer, the NAT gateway, the interface endpoints or next year’s growth.
From VPN to Direct Connect
Section titled “From VPN to Direct Connect”Most organisations start with a Site-to-Site VPN. It is secure, it costs little, and it can be stood up in an afternoon, which makes it the right choice for a pilot and for the early phases of a migration.
As usage grows — and particularly once bulk data transfer starts — the constraint becomes bandwidth and jitter over the public internet, and Direct Connect becomes worth the lead time and the port charge. The usual end state is both: Direct Connect as the primary path, VPN retained as backup.
The transition is managed with BGP rather than with a cutover window:
- Configure both the VPN and the Direct Connect connection to advertise identical BGP prefixes.
- AWS prefers the Direct Connect path automatically when both are available.
- Configure the on-premises side to prefer Direct Connect, using BGP local preference or AS path weighting, or static routes if the equipment cannot do better.
Because both paths stay up and advertise the same prefixes, failure of the circuit falls back to the VPN without manual intervention, and the migration to Direct Connect happens without a scheduled outage. Test the failover deliberately before relying on it; a backup path nobody has exercised is a hypothesis.