Amazon VPC Route Priority and Route Propagation

This lesson explains how Amazon VPC route tables decide where to send traffic when multiple routes could match the same destination. This is important for the AWS Certified Solutions Architect – Professional SAP-C02 exam because many networking scenarios depend on correctly understanding route priority, longest-prefix matching, static routes, propagated routes, NAT gateways, internet gateways, VPC peering, VPN, and Direct Connect routing behavior.

For the exam, you need to be able to look at a route table and determine which target AWS will actually use. This becomes especially important in hybrid networking, overlapping CIDR designs, private subnet internet access, and route propagation scenarios.

Key Concepts

Amazon VPC Route Tables

A route table controls how traffic leaving a subnet is routed. Each subnet in a VPC is associated with a route table, either explicitly or through the VPC’s main route table.

A route table entry generally includes:

Field	Meaning
Destination	The IPv4 CIDR block, IPv6 CIDR block, or prefix list being matched
Target	The AWS resource or network path traffic should use
Route Type	Static, local, or propagated

Common VPC route targets include:

• Local VPC route
• Internet Gateway
• NAT Gateway
• VPC Peering Connection
• Virtual Private Gateway
• Transit Gateway
• Network Interface
• Gateway Load Balancer Endpoint

For SAP-C02, the important skill is understanding how AWS chooses between possible matching routes.

Longest Prefix Match

The most important route priority rule is:

The most specific matching route wins.

This is often called longest prefix match. A route with a longer subnet mask takes priority over a broader route.

For example:

Destination	Target
10.0.0.0/16	Internet Gateway
10.0.1.0/24	NAT Gateway

If traffic is destined for 10.0.1.50, both routes technically include that IP address:

• 10.0.0.0/16 includes 10.0.1.50
• 10.0.1.0/24 also includes 10.0.1.50

However, /24 is more specific than /16, so the /24 route wins. The traffic goes to the NAT Gateway.

If traffic is destined for 10.0.2.50, only the /16 route matches, so the traffic follows the route to the Internet Gateway.

Why Prefix Length Matters

The prefix length tells AWS how specific the route is.

Prefix	Meaning	Specificity
/0	Matches everything	Least specific
/16	Large network range	Broad
/24	Smaller subnet range	More specific
/32	Single IPv4 address	Most specific IPv4 match

A /32 route matches exactly one IPv4 address. This can be useful in special routing situations where one host must be routed differently from the rest of a CIDR block.

IPv4 and IPv6 Routing Are Evaluated Separately

IPv4 and IPv6 routes are independent.

For example:

Destination	Target
0.0.0.0/0	NAT Gateway
::/0	Egress-Only Internet Gateway

AWS evaluates the most specific IPv4 route for IPv4 traffic and the most specific IPv6 route for IPv6 traffic. IPv4 routes do not control IPv6 traffic, and IPv6 routes do not control IPv4 traffic.

For the exam, be careful when a scenario includes dual-stack VPCs. You may need to identify separate routes for IPv4 and IPv6 internet access.

Default Routes

A default route is the catch-all route for traffic that does not match anything more specific.

Common default routes include:

Destination	Target	Typical Use
0.0.0.0/0	Internet Gateway	Public subnet outbound internet access
0.0.0.0/0	NAT Gateway	Private subnet outbound IPv4 internet access
::/0	Internet Gateway	Public IPv6 internet access
::/0	Egress-Only Internet Gateway	Private outbound-only IPv6 access

The 0.0.0.0/0 route means “all IPv4 destinations.” It is the least specific IPv4 route. AWS will only use it when no more specific IPv4 route exists.

Local VPC Route

Every VPC route table includes a local route for communication within the VPC CIDR block.

Example:

Destination	Target
10.0.0.0/16	local

This allows resources inside the VPC to communicate with other resources in the same VPC, assuming security groups, network ACLs, and OS firewalls allow the traffic.

For example, if an EC2 instance in one subnet sends traffic to another private IP inside the same VPC CIDR, the local route handles that traffic.

Private Subnet Internet Access with NAT Gateway

A common VPC pattern is to place application instances in private subnets and allow outbound internet access through a NAT Gateway.

Typical private subnet route table:

Destination	Target
VPC CIDR, for example 10.0.0.0/16	local
0.0.0.0/0	NAT Gateway

In this design:

1. Traffic destined for addresses inside the VPC follows the local route.
2. Traffic destined for the internet follows the default route to the NAT Gateway.
3. The NAT Gateway must be placed in a public subnet.
4. The public subnet route table must have a route to an Internet Gateway.
5. The NAT Gateway uses the Internet Gateway to reach the internet.

The private instances do not need public IP addresses. They can initiate outbound IPv4 connections, but the internet cannot initiate inbound connections directly to them through the NAT Gateway.

Public Subnet Internet Access with Internet Gateway

A public subnet typically has a route table like this:

Destination	Target
VPC CIDR	local
0.0.0.0/0	Internet Gateway

For an EC2 instance to be publicly reachable from the internet, it generally needs:

• A subnet route to an Internet Gateway
• A public IPv4 address or Elastic IP address
• Security group rules allowing the inbound traffic
• Network ACL rules allowing the traffic
• An application or service listening on the target port

A route to an Internet Gateway alone does not automatically make every resource publicly accessible.

VPC Peering and Route Priority

VPC peering allows private connectivity between two VPCs. Route tables must be updated so each VPC knows which CIDR blocks should be routed through the peering connection.

Example route:

Destination	Target
172.16.0.0/16	VPC Peering Connection

A key exam point: VPC peering is not transitive.

If VPC A is peered with VPC B, and VPC B is peered with VPC C, VPC A cannot automatically reach VPC C through VPC B. You would need a direct peering connection or a different architecture, such as AWS Transit Gateway.

Handling Overlapping or Matching CIDR Destinations

Route priority becomes more complicated when multiple possible routes involve the same or overlapping destination ranges.

Example:

Destination	Target
172.16.0.0/16	VPC Peer 1
172.16.0.15/32	VPC Peer 2

In this case:

• Traffic to 172.16.0.15 follows the /32 route to VPC Peer 2.
• Traffic to another address, such as 172.16.0.30, follows the broader /16 route to VPC Peer 1.

The /32 route wins for the single host because it is more specific.

This type of routing can appear in exam questions where one specific host or service must be routed differently than the rest of a network.

Static Routes vs Propagated Routes

Routes can be added manually or learned dynamically.

Route Type	Description
Static Route	Manually created in the route table
Propagated Route	Dynamically added from a supported route source, such as a Virtual Private Gateway or Transit Gateway

A key rule from this lesson:

Static routes with identical destinations take priority over propagated routes.

Example:

Destination	Route Source / Target	Route Type
172.16.0.0/16	VPC Peering Connection	Static
172.16.0.0/16	Virtual Private Gateway	Propagated

If both routes exist for the same destination, AWS prefers the static route. Traffic for 172.16.0.0/16 goes to the VPC Peering Connection instead of the dynamically propagated hybrid route.

This is a major SAP-C02 exam point because hybrid networking questions often include VPN or Direct Connect routes that are dynamically propagated into route tables.

Route Propagation

Route propagation automatically adds routes to a VPC route table from a supported routing source.

Common route propagation sources include:

• Virtual Private Gateway
• Transit Gateway

Route propagation is useful because it reduces the need to manually update route tables when on-premises networks change or when routes are learned dynamically through BGP.

However, propagated routes do not always win. If a static route has the same destination, the static route takes priority.

Hybrid Connectivity Routing

In hybrid AWS architectures, routing may involve:

• Site-to-Site VPN
• AWS Direct Connect
• Virtual Private Gateway
• Transit Gateway
• BGP route propagation
• Static routes
• On-premises CIDR blocks

For SAP-C02, expect scenarios where AWS receives routes from on-premises networks through BGP, but the route table also contains static entries. You need to determine which route AWS will actually use.

The most important rules are:

1. Longest prefix match wins.
2. If the destination is identical, static routes are preferred over propagated routes.
3. IPv4 and IPv6 routes are evaluated separately.
4. VPC peering is not transitive.

Exam-Relevant Takeaways

For SAP-C02, remember these routing rules:

• AWS uses the most specific route that matches the destination.
• A /24 route is more specific than a /16 route.
• A /32 IPv4 route matches exactly one IP address.
• 0.0.0.0/0 is the default IPv4 route and only wins when no more specific route matches.
• IPv4 and IPv6 route decisions are independent.
• Private subnet outbound IPv4 internet access usually uses a NAT Gateway.
• The NAT Gateway itself must be in a public subnet with a route to an Internet Gateway.
• A public subnet usually has a default route to an Internet Gateway.
• VPC peering requires explicit routes.
• VPC peering does not support transitive routing.
• Static routes are preferred over propagated routes when the destination is identical.
• Route propagation can dynamically add routes from a Virtual Private Gateway or Transit Gateway.
• In hybrid designs, BGP-learned routes may be overridden by static routes.

Architecture Decision Guide

Scenario	Best AWS Choice	Why
Private EC2 instances need outbound IPv4 internet access	NAT Gateway	Allows outbound internet access without assigning public IPs to private instances
Public EC2 instances need direct internet access	Internet Gateway	Enables internet routing for resources with public IPs in public subnets
Traffic must stay inside the same VPC	Local route	The VPC router handles traffic within the VPC CIDR
Two VPCs need direct private connectivity	VPC Peering	Provides private routing between two VPCs, but is not transitive
Many VPCs or hybrid networks need centralized routing	Transit Gateway	Better fit than many individual peering connections
On-premises routes should update dynamically	Route propagation with VPN, Direct Connect, VGW, or TGW	Reduces manual route table updates
One specific IP must route differently than a larger CIDR block	More specific route, such as /32	Longest-prefix match sends that single IP to a different target
A static route and propagated route have the same destination	Static route wins	AWS prefers static routes over propagated routes for identical destinations
Dual-stack VPC needs IPv6 routing	Add IPv6 routes separately	IPv4 and IPv6 routing are independent

Common Exam Traps

Trap 1: Assuming the Default Route Always Wins

The 0.0.0.0/0 route is the broadest possible IPv4 route. It does not override more specific routes.

If a route table has both:

Destination	Target
0.0.0.0/0	NAT Gateway
10.0.1.0/24	VPC Peering Connection

Traffic to 10.0.1.50 follows the /24 route, not the default route.

Trap 2: Forgetting That NAT Gateway Requires an Internet Gateway Path

A NAT Gateway provides outbound internet access for private subnets, but it must live in a public subnet. That public subnet must have a route to an Internet Gateway.

Private subnet route:

Destination	Target
0.0.0.0/0	NAT Gateway

Public subnet route:

Destination	Target
0.0.0.0/0	Internet Gateway

If the NAT Gateway is not in a properly routed public subnet, private instances will not have working outbound internet access.

Trap 3: Confusing Static and Propagated Route Priority

If AWS learns a route dynamically through BGP and the route table also has a static route for the same destination, the static route wins.

This can cause traffic to go to a VPC peering connection, NAT Gateway, or another static target instead of the expected VPN or Direct Connect path.

Trap 4: Assuming VPC Peering Is Transitive

VPC peering does not allow transitive routing.

VPC A cannot reach VPC C through VPC B just because:

• VPC A is peered with VPC B
• VPC B is peered with VPC C

For transitive or hub-and-spoke routing, use AWS Transit Gateway.

Trap 5: Ignoring IPv6 Route Tables

IPv4 and IPv6 are handled separately.

A route for 0.0.0.0/0 does not route IPv6 traffic. IPv6 requires routes such as ::/0.

Trap 6: Not Recognizing /32 Host Routes

A /32 route is an exact IPv4 host match. In route priority questions, a /32 route will beat broader CIDR routes such as /24, /16, or /0.

Real-World Engineer Notes

Route Tables Are Often the First Place to Troubleshoot

When connectivity fails in a VPC, route tables are one of the first things to check. Common issues include:

• Private subnet missing a default route to a NAT Gateway
• Public subnet missing a default route to an Internet Gateway
• NAT Gateway placed in the wrong subnet
• Missing return route from a peered VPC
• Hybrid route propagation not enabled
• Static route overriding a propagated route
• Incorrect CIDR block in a route table

A route table may look simple, but one incorrect destination or target can break connectivity across an entire subnet.

Be Careful with Overlapping CIDRs

Overlapping CIDRs create operational complexity. Even when a design can be made to work with highly specific routes, it is usually fragile.

In real environments, overlapping IP ranges commonly appear during:

• Mergers and acquisitions
• Data center migrations
• Partner connectivity
• Multi-account AWS growth without IP governance
• Legacy networks using common RFC1918 ranges

The cleaner long-term answer is usually IP address management, CIDR planning, Transit Gateway design, or network segmentation. Host-specific routes may solve a narrow case, but they are not ideal as a general architecture pattern.

Static Routes Can Break Hybrid Expectations

In hybrid networks, engineers often expect BGP-learned routes to control traffic automatically. However, a static route with the same destination can override the propagated route.

This matters when troubleshooting:

• VPN failover
• Direct Connect routing
• On-premises reachability
• Migration cutovers
• Temporary routing exceptions

Always compare the destination prefix and route type before assuming BGP is controlling the path.

NAT Gateway Design Has Cost and Resiliency Implications

For production architectures, NAT Gateway placement matters.

A common resilient design is to deploy one NAT Gateway per Availability Zone and route each private subnet to the NAT Gateway in the same AZ. This reduces cross-AZ dependency and avoids unnecessary cross-AZ data processing.

A cheaper design may use a single NAT Gateway, but that creates a dependency on one AZ and can introduce cross-AZ data transfer costs.

VPC Peering Is Simple but Limited

VPC peering is useful for simple one-to-one private VPC connectivity. However, it becomes harder to manage as the number of VPCs grows.

Limitations to remember:

• No transitive routing
• Route tables must be managed on both sides
• Overlapping CIDRs are problematic
• Large mesh designs become operationally messy

For larger environments, AWS Transit Gateway is usually the better architectural choice.

Quick Reference Summary

• Longest prefix match determines route priority.
• More specific routes beat broader routes.
• /32 is an exact IPv4 host route.
• 0.0.0.0/0 is the default IPv4 route.
• IPv4 and IPv6 routes are separate.
• Private subnet internet access commonly uses a NAT Gateway.
• NAT Gateway must have a path to an Internet Gateway through a public subnet.
• Public subnet internet access uses an Internet Gateway.
• VPC peering is not transitive.
• Static routes beat propagated routes when the destination is identical.
• Route propagation can dynamically add routes from a Virtual Private Gateway or Transit Gateway.
• In hybrid routing scenarios, always check whether a static route is overriding a propagated BGP route.

Flashcards

Q: What is the most important route priority rule in Amazon VPC?
A: The most specific matching route wins, also known as longest prefix match.

Q: Which route is more specific: 10.0.0.0/16 or 10.0.1.0/24?
A: 10.0.1.0/24 is more specific.

Q: What does 0.0.0.0/0 represent in a VPC route table?
A: It is the default IPv4 route and matches all IPv4 destinations not matched by a more specific route.

Q: What does a /32 IPv4 route match?
A: Exactly one IPv4 address.

Q: If a route table has both a static route and a propagated route for the same destination, which route wins?
A: The static route wins.

Q: Are IPv4 and IPv6 routes evaluated together in a VPC route table?
A: No. IPv4 and IPv6 routes are evaluated independently.

Q: What route target is commonly used for private subnet outbound IPv4 internet access?
A: NAT Gateway.

Q: Where should a NAT Gateway be placed?
A: In a public subnet with a route to an Internet Gateway.

Q: What route target is commonly used for public subnet internet access?
A: Internet Gateway.

Q: Does VPC peering support transitive routing?
A: No. VPC peering is non-transitive.

Q: What AWS service is commonly used when many VPCs require centralized routing?
A: AWS Transit Gateway.

Q: What is route propagation?
A: The automatic addition of routes to a route table from a supported source, such as a Virtual Private Gateway or Transit Gateway.

Q: Why can static routes cause issues in hybrid networking?
A: A static route can override a dynamically propagated BGP route with the same destination.

Q: If traffic matches both 172.16.0.0/16 and 172.16.0.15/32, which route is used for 172.16.0.15?
A: The /32 route is used because it is more specific.

Q: What is a common exam trap involving NAT Gateways?
A: Forgetting that the NAT Gateway must be in a public subnet with a route to an Internet Gateway.

Practice Questions

Question 1:
A private subnet route table contains the following routes:

Destination	Target
10.0.0.0/16	local
0.0.0.0/0	NAT Gateway

An EC2 instance in the private subnet sends traffic to 8.8.8.8. Which route is used?

A. The local route
B. The NAT Gateway route
C. The Internet Gateway route
D. The VPC peering route

Correct Answer:
B. The NAT Gateway route

Explanation:
8.8.8.8 is outside the VPC CIDR. Since no more specific route matches, the default route 0.0.0.0/0 is used, sending traffic to the NAT Gateway.

---

Question 2:
A route table contains the following routes:

Destination	Target
172.16.0.0/16	VPC Peer 1
172.16.0.15/32	VPC Peer 2

Traffic is sent to 172.16.0.15. Which target is selected?

A. VPC Peer 1
B. VPC Peer 2
C. The local route
D. The default route

Correct Answer:
B. VPC Peer 2

Explanation:
Both routes could match, but 172.16.0.15/32 is more specific than 172.16.0.0/16. Longest prefix match sends the traffic to VPC Peer 2.

---

Question 3:
A VPC route table has a static route to 172.16.0.0/16 through a VPC peering connection. The same route table also receives a propagated route to 172.16.0.0/16 from a Virtual Private Gateway. Which route is preferred?

A. The propagated route from the Virtual Private Gateway
B. The static route to the VPC peering connection
C. The route with the lowest latency
D. The route with the newest timestamp

Correct Answer:
B. The static route to the VPC peering connection

Explanation:
When destinations are identical, static routes are preferred over propagated routes.

---

Question 4:
A company has VPC A peered with VPC B. VPC B is peered with VPC C. The company wants instances in VPC A to reach instances in VPC C through VPC B. What is the issue with this design?

A. VPC peering does not support IPv4 traffic
B. VPC peering does not support transitive routing
C. VPC peering requires NAT Gateway
D. VPC peering only works with public subnets

Correct Answer:
B. VPC peering does not support transitive routing

Explanation:
VPC peering is non-transitive. VPC A cannot use VPC B as a transit path to reach VPC C. A direct peering connection or Transit Gateway would be required.

---

Question 5:
A dual-stack VPC has the following route:

Destination	Target
0.0.0.0/0	Internet Gateway

Instances still cannot send IPv6 traffic to the internet. What is the most likely reason?

A. IPv6 traffic requires a separate IPv6 route such as ::/0
B. Internet Gateways only support IPv4
C. NAT Gateways are required for all IPv6 traffic
D. Local routes override all IPv6 routes

Correct Answer:
A. IPv6 traffic requires a separate IPv6 route such as ::/0

Explanation:
IPv4 and IPv6 routing are independent. A route for 0.0.0.0/0 only applies to IPv4 traffic. IPv6 requires its own route, such as ::/0.