Lecture 27: Extending VPC address space
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：09:55
- 来源：Udemy Lecture 24112954
- Slide 数量：8
- 画面切换：01:18、04:40、05:08、05:52、06:24、06:42、08:11
扫描说明
按 Udemy Transcript 的 143 个时间点逐一定位并比较视频画面，确认标题、规则、两个架构状态、三个示例和最终允许/禁止矩阵共 8 个 Slide。项目逐步出现属于同页动画构建，最终完整状态作为截图。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Why Extend a VPC Address Space
时间范围：00:00–01:18
总结 / Summary
中文
可以通过辅助 CIDR（Secondary CIDR）扩展现有 VPC 地址空间。典型原因有两类：原始 CIDR 太小或地址已耗尽；或者现有 VPC 与本地网络（On-premises Network）的 CIDR 重叠，无法直接建立 VPN 等连接，此时可增加不重叠的辅助范围并把新工作负载部署到该范围。
English
A VPC can be expanded by associating secondary CIDRs. Common reasons are exhaustion of an undersized primary CIDR, or overlap between the existing VPC and an on-premises network that prevents direct VPN-style connectivity. A non-overlapping secondary range can host new workloads that participate in the connection.
Transcript
00:00 Hi and welcome to this lecture extending VPC address space.
00:04 So so far, uh, when we created VPC we always created VPC with single cider.
00:09 Now you would be wondering to know that you can extend your VPC address space by adding the secondary
00:15 Cidrs to your VPC.
00:18 Now that's interesting.
00:20 And the first question comes why would you do that.
00:22 Right.
00:23 So typically there are two use cases that I can think of at this moment.
00:26 One, maybe you created a VPC with very small cidrs, or you already exhausted IP addresses inside VPC
00:33 and you want to add more IP address space.
00:36 In that case, you can add secondary Cidr to your existing VPC, and then you can launch more machines
00:43 inside your VPC.
00:44 Second, maybe you have a VPC.
00:46 It already has a lot of instances, so you can't delete that VPC.
00:51 And unfortunately your VPC Cidr range has an overlapping Cidr with your on premise network.
00:57 And now you want to connect these two networks.
00:59 Now you know that you can't set up this kind of connectivity with overlapping ssids.
01:04 So what you can do is add a secondary VPC, Cidr, and then you can launch additional machines in that
01:10 VPC and then can have the VPN connection with your on premise network.
01:15 So now let's look at this feature in more detail.
2. Secondary CIDR Rules and Restrictions
时间范围：01:18–04:40
总结 / Summary
中文
辅助 CIDR 不能与主 CIDR（Primary CIDR）重叠。若主范围属于某个 RFC 1918 私有地址块（Private Address Block），辅助私有范围应来自同一个 RFC 1918 块，而不能直接改用另一个私有块。现有路由表（Route Table）也会限制关联：若已有 10.2.0.0/24 路由，则不能再关联更宽的 10.2.0.0/16，但可关联更具体的 /25 或 /26。视频还指出 VPC 可关联最多 5 个 IPv4 CIDR 和 1 个 IPv6 CIDR。
English
A secondary CIDR cannot overlap the primary CIDR. When the primary range comes from one RFC 1918 private block, a secondary private range must come from the same RFC 1918 block rather than another private block. Existing route-table destinations also constrain association: if 10.2.0.0/24 already exists as a route, the broader 10.2.0.0/16 cannot be associated, although more-specific /25 or /26 ranges can. The lecture also states a limit of five IPv4 CIDRs and one IPv6 CIDR per VPC.
Transcript
01:18 Okay very first thing you can add secondary VPC ideas to your existing VPC.
01:22 And that's what we are going to see.
01:24 But there are certain restrictions that you need to know when you add secondary Cidr to your existing
01:30 VPC.
01:30 Very first thing is that you cannot add the overlapping cider.
01:34 That means if your VPC has some cider, then the secondary one cannot have the same address range of
01:39 your primary Cidr range.
01:42 Further, if you are assigning the RFC 1918 range to your VPC and this is what is recommended, then
01:49 the secondary Cidr cannot be from the other.
01:52 RFC 1918 range.
01:54 Now what that means if your VPC has address range of say ten 000 slash 16.
02:00 Now, slash 16 is the, uh, shortest prefix that you can have to your VPC.
02:06 So if you have that range allocated to your VPC, then you cannot have the secondary Sidr range from
02:13 other RFC ranges, that is from 170 to 16 or 192 168 range.
02:19 However, you could have the secondary Cidr range from 10.2.00 16 or 1 .3.00 16 likewise.
02:29 And we will see that in more detail further.
02:32 Cidr block must not be the same or larger than the Cidr range of the routes in any of the VPC route
02:39 table.
02:40 Now this is little complicated, but let's try to understand this.
02:43 Let's say you have VPC.
02:45 You have subnets inside that.
02:46 And this VPC connects to your on premise network as well.
02:50 Now your on premise network might have some Cidr range which of course doesn't overlap with your VPC.
02:55 And then in your subnet route table you would have some route to take you to that destination through
03:01 the virtual private gateway.
03:03 Or there could be other routes through VPC peering or any other kind of the networking component.
03:09 Now, what this rule says is that if you have any route in your VPC, then you cannot add the VPC Sidr
03:17 for the Cidr range larger than that route entry.
03:22 So there is an example.
03:24 Suppose your VPC primary Cidr is ten 000 slash 16, and you want to associate a secondary Sidr of ten
03:32 .2.00 16 range.
03:35 But in one of the route table in your VPC, you already has a destination for ten .2.0024 through any
03:44 of the networking component.
03:45 As I said, like virtual private Gateway, then you cannot associate this range as a secondary Cidr
03:52 block to your VPC.
03:54 However, you can associate a smaller range that is ten .2.00, 25 or 26 likewise.
04:03 And that makes sense because you already have existing root.
04:06 And if you add secondary cider, then there will be a confusion that whether this traffic has to be
04:11 routed inside a VPC or it has to be routed to through the destination router.
04:17 Right.
04:18 And in case of routing preference, you know that the local preference always take preference over the
04:24 static routes that you create manually.
04:26 Finally, you could have up to five IPv4 Cidr ranges and only one IPv6 Cidr block allocated to your
04:34 VPC.
04:35 So these are the things that you need to know about extending Cidr for your VPC.
3. VPC with Only a Primary CIDR
时间范围：04:40–05:08
总结 / Summary
中文
基础示例中的 VPC 只有 10.0.0.0/16 主 CIDR，并从该范围划分两个子网。主路由表（Main Route Table）包含该 CIDR 的本地路由（Local Route），这是扩展前的标准状态。
English
The baseline VPC has only the primary CIDR 10.0.0.0/16, from which two subnets are created. Its main route table contains the local route for that CIDR, representing the normal pre-expansion state.
Transcript
04:40 So now let's look at an example right.
04:43 So here I have one VPC.
04:45 It has a Cidr block of ten 000 16.
04:49 And then I divided that into two subnets.
04:52 Uh so the main route table of course would look something like this.
04:56 Now this is very usual.
04:57 We already did that as an exercise as well.
05:00 Now if I want to add secondary Cidr block, what I can do is I can add uh, any uh, address from the
4. VPC with Primary and Secondary CIDRs
时间范围：05:08–05:52
总结 / Summary
中文
可在同一个 RFC 1918 地址块中添加不重叠的辅助 CIDR，例如为 10.0.0.0/16 增加另一个 10.x.0.0/16。VPC 路由表会自动增加该辅助 CIDR 的本地路由，并可从新范围创建第三个子网。来自主 CIDR 与辅助 CIDR 的子网功能上没有等级差异。
English
A non-overlapping secondary CIDR from the same RFC 1918 block can be added, such as another 10.x.0.0/16 beside 10.0.0.0/16. The VPC route table automatically gains a local route for the secondary range, and new subnets can be carved from it. Subnets created from primary and secondary CIDRs are operationally equivalent.
Transcript
05:08 non-overlapping address from the same RFC 1918 range, not the others, one like one nine 2 or 172 range.
05:16 Right.
05:17 So here I can add 1.1.006010.2.00 16.
05:21 Likewise, I can use the same range.
05:24 As you know these are not overlapping and then you will see your main route table has additional route
05:29 created for another Cidr range.
05:32 Now this is how you go and add secondary Sidr.
05:37 And then I can very well create third subnet which takes the Sidr address range from the secondary Cidr
05:46 range.
05:46 And all these subnets can be treated equally.
05:49 There is no real difference between this.
05:51 Okay.
5. Example 1: Add CIDRs from the Same Private Block
时间范围：05:52–06:24
总结 / Summary
中文
当主 CIDR 位于 10.0.0.0/8 私有地址块时，可以继续关联多个不重叠的 10.x.0.0/16 辅助 CIDR。该示例强调“同一 RFC 1918 块且不重叠”的有效组合，并展示最多关联 5 个 IPv4 CIDR 的情形。
English
When the primary CIDR is in the 10.0.0.0/8 private block, multiple non-overlapping 10.x.0.0/16 secondary CIDRs can be associated. The example illustrates valid combinations from the same RFC 1918 block and the lecture's five-IPv4-CIDR limit.
Transcript
05:52 Now let's take an example.
05:54 Right.
05:54 Suppose you create a VPC with Sidr ten 310 000 16.
05:58 And then what you can do is you can just go to your VPC editor and add a new Cidr from, uh, this ranges
06:06 of course, you know, that you can add secondary Cidr from this ranges.
06:11 So you can attach up to five such Cidr block.
06:14 And this is what is shown here.
06:17 Now let's uh, try to uh, see what happens when you add Cidr block from other RFC.
06:23 Uh 1918 ranges.
6. Example 2: Other RFC 1918 Blocks Are Rejected
时间范围：06:24–06:42
总结 / Summary
中文
若主 CIDR 来自 10.0.0.0/8，尝试把 192.168.0.0/16 或 172.16.0.0/12 范围作为辅助 CIDR 会被拒绝。它们虽然同为私有地址，但属于不同的 RFC 1918 地址块。
English
If the primary CIDR belongs to 10.0.0.0/8, attempts to associate ranges from 192.168.0.0/16 or 172.16.0.0/12 are rejected. They are private addresses, but they belong to different RFC 1918 blocks.
Transcript
06:24 Okay.
06:25 So example two, you have a VPC with Cidr ten zero zero 16.
06:29 And now let's try to add 19216 8 or 1 7216.
06:34 Uh Cidr ranges.
06:35 Now as soon as you try to do that, you get a message that you cannot add this Cidr range.
06:41 Okay.
7. Example 3: Shared Address Space 100.64.0.0/10
时间范围：06:42–08:11
总结 / Summary
中文
RFC 1918 主 CIDR 还可搭配共享地址空间（Shared Address Space）100.64.0.0/10 的不重叠子范围。该范围用于运营商级 NAT（Carrier-grade NAT, CGNAT），不是 RFC 1918 地址；互联网服务提供商（Internet Service Provider, ISP）可在客户侧复用地址并在边缘执行 NAT。
English
An RFC 1918 primary CIDR can also be paired with a non-overlapping range from the shared address space 100.64.0.0/10. This block is used for Carrier-grade NAT (CGNAT), is not RFC 1918 space, and lets Internet service providers reuse customer-side addresses while translating at the provider edge.
Transcript
06:42 Now let's look at the third example.
06:43 Now this is slightly different.
06:45 So here we create the VPC with the same Cidr as previously.
06:49 But this time I don't want to add RFC 1918 range from the same Cidr block.
06:55 But I want to add non rcfc 1918 range.
06:58 So there is one specific Cidr block that is 10.64.0.0 16.
07:06 Now this is a range which is non RFC.
07:09 And you can add this as a secondary Sidr.
07:11 If your primary Cidr is from the RFC 1918 range.
07:15 Now you must be asking what this range is all about.
07:18 Now this is a special Cidr range which was specifically created to solve the problem of internet service
07:25 providers because you know that they provide the internet service, and every router then would need
07:30 to have a public IP because it connects to the internet.
07:33 Now, in order to save the IP addresses, now all these ISP customers are allocated a private IP address
07:40 range from 164,016 range.
07:44 And then they do some kind of natting at the ISP router level so that they don't allocate individual
07:50 public IPS to the customer router, but just use one public IP at the ISP router level.
07:58 So this is a spatial range and it is non RFC 1918 range.
08:02 So if you have existing VPC you can simply just go and add this private IP address range to your VPC.
08:11 Okay.
8. Allowed and Disallowed CIDR Combinations
时间范围：08:11–09:55
总结 / Summary
中文
最终矩阵总结：RFC 1918 主 CIDR 可搭配同一私有块内的不重叠范围、100.64.0.0/10 共享地址或合适的公有 IPv4 范围；不能搭配其他 RFC 1918 块、重叠范围，或与既有路由冲突的更宽范围。若主 CIDR 本身来自 100.64.0.0/10，可继续使用同一共享块中的不重叠范围或公有 IPv4，但不能添加 RFC 1918 私有范围。
English
The final matrix summarizes the rules. An RFC 1918 primary CIDR can use non-overlapping ranges from the same private block, shared space from 100.64.0.0/10, or suitable public IPv4 space. Other RFC 1918 blocks, overlaps, and broader ranges conflicting with existing routes are disallowed. If the primary CIDR itself comes from 100.64.0.0/10, non-overlapping shared-space or public IPv4 ranges are allowed, but RFC 1918 ranges are not.
Transcript
08:11 Now this is a quick view of what you can do and what you cannot do as a secondary Sidr.
08:18 So if Primary Sidr is from, say, your RFC 1918 range then allowed secondary Sidr would be anything
08:27 from the same Cidr range or this shared private address range 164 range or any public IPv4 ranges.
08:36 Now these two are like private and any public IP for range you can add.
08:41 At the same time, you cannot really add other RFC 1918 ranges 192 or 172 and any other overlapping
08:48 sidr.
08:49 And as you know about the uh, if there is a route table entry, then you cannot also add the same Sidr
08:56 to your, uh, VPC again.
08:58 Right.
08:58 You can add a smaller Sidr range there.
09:01 So same rule applies for another, uh, RFC 1918 range, or even if there would have been 192, the
09:08 same kind of, uh, table, it would have.
09:11 Now, uh, particular thing about this shared, uh, address range that is 160 400 16.
09:18 You can still go and add, uh, the non-overlapping address from the same address range or public IPv4
09:25 ranges.
09:26 And important to know that you cannot add any of the RFC ranges here as a secondary Cidr.
09:32 So if your primary is this make sure you don't select any of this as a uh allowed ranges.
09:39 They are not really allowed there.
09:42 Right.
09:42 So remember these things.
09:44 And then you should be good to answer any question about adding the secondary Cidr to your existing
09:49 VPC.
09:50 So that's it about this lecture and stay tuned.
整讲总结 / Overall Summary
中文
辅助 VPC CIDR（Secondary VPC CIDR）解决地址耗尽和网络重叠后的扩展需求，但必须同时满足不重叠、RFC 1918 地址块兼容性和现有路由表约束。关联成功后，VPC 自动为新 CIDR 添加本地路由，主/辅助范围中的子网地位相同。考试应重点记住同一私有块规则、100.64.0.0/10 共享地址空间、路由冲突限制，以及视频给出的 CIDR 数量限制。
English
Secondary VPC CIDRs address growth and overlap problems, but they must satisfy non-overlap, RFC 1918 block compatibility, and existing route-table constraints. After association, the VPC automatically adds a local route for the new CIDR, and subnets from primary and secondary ranges are equivalent. Exam-focused points include the same-private-block rule, shared space 100.64.0.0/10, route conflicts, and the CIDR-count limits stated in the lecture.