Subnet Allocation
When we set up a VPC for an environment (AWS account) we provide subnets for transit gateway connection, protected resources such as VPC endpoints, along with a general subnet set. See the subnets section for more information.
Here we go into a bit more detail on how the CIDR ranges have been created and how they are allocated.
Transit Gateway and Protected subnets allocation
Both the transit gateway subnets and the protected subnets are created per VPC, not per account. As VPCs are shared across the accounts in a business unit, this capacity is shared across that business unit.
Subnet Sets
Each subnet set is a /21, divided into nine subnets across the three London availability zones:
| Subnet type | Size | Usable addresses | Used for |
|---|---|---|---|
| Private | 3 x /24
|
753 | Applications. Reaches the internet via centralised NAT over the transit gateway |
| Public | 3 x /25
|
369 | Public-facing resources such as load balancers |
| Data | 3 x /25
|
369 | Databases. Usually has no internet connection |
How have we decided the ranges?
We analysed the existing MoJ network infrastructure to ensure that we didn’t clash with any existing ranges. The modernisation platform CIDR ranges are documented here. Predefining these IP ranges it makes it easier for us to onboard new applications.
Example
Below is an example of how CIDR ranges would be assigned. In this example there are 2 additional subnet sets for this VPC, but normally we would expect the general set to be enough for a business area.
Secondary CIDR blocks
Where a business unit needs more address space than its subnet set provides, we can attach one or more secondary CIDR blocks to the VPC.
Each secondary CIDR block is divided into further private, public and data subnets, in the same pattern as the general subnet set. This means a VPC with a secondary CIDR block will have more than nine subnets.
Secondary CIDR blocks are configured with the secondary_cidr_blocks option in the environments-networks JSON. See environments-networks json explained for details.
If you think you are running short of address space, please get in touch in #ask-modernisation-platform.