Network Sizing - Whether CIDR /22 and /28 have to be part of user managed vpc ?

[joby_kurian]

Hello Team,

I am planning to provision apigee x instance in my project. As per apigee documentation, each apigee instance requires non-overlapping CIDR range of /22 and another /28 for debugging/trouble shooting purposes. 

Questions :

1. The CIDR range of /22 AND /28 that is required for APIGEE Instance, would like to know does the entire /22 and /28 CIDR range have to be a part of the user managed VPC (There are 2 VPCs - Google managed and user managed) and is Primary ?  The diagram present in the link gave us a sense that only the bridge VMs and Egress NAT may need to come from the shared VPC(user managed vpc) range. 
2. /22 and /28 CIDR range would be required for each APIGEE Instance. Lets say we have 3 org in our entitlement. Does that mean this(/22 and/28) would be shared across all APIGEE Orgs  / Projects or Is it specific to each instance ? as I see its also state that there can only be one Apigee instance per Cloud region.

Thanks,

JK

[Arnaduga · Accepted solution]

From my point of view, these 2 CIDR ranges are "reservations" only, to be sure you won't have your own subnets overlapping them.

The subnet you have to provision is NOT those CIDR ranges.

I guess Google Apigee is building a subnet with this range on their side (not visible for us), in the peered VPC.

On the instanciation I've done, I have one small subnet (compliant with my on prem IP addressing plan) to host the MIG (Manages Instance Group), LB, etc.

The two reserved ranges (/22 and /28) are not compliant (and I won't be able to use this, to avoid overlap, as it is reserved already).

Hope this help (a little at least 🙂 )