VPLS design for sites sharing one IP subnet

300-420 By islever Editorial Last updated

Design site-to-site VPN for on-premises, hybrid, and cloud solutions Describe WAN connectivity options for on-premises, hybrid, and cloud solutions

Short answer

C Include 802.1Q connectivity on the LAN side of the CE so the shared subnet's VLAN is carried into the VPLS attachment circuit at each site.

Question

A customer requests a VPN solution to connect multiple sites with the company headquarters. All the sites use the same IP subnet. The engineer plans to use
VPLS. Which solution must the engineer include in the design?
  1. different VLANs on each site
  2. address translation to hide overlapping subnets
  3. 802.1Q connectivity on the LAN side of the CE Correct Answer
  4. route exchange with the service provider

Key Takeaways

This tests understanding that VPLS is a transparent Layer 2 VPN; the trap is reaching for NAT or route exchange, which are Layer 3 fixes that break or bypass the extended-LAN model.

When multiple sites share the same IP subnet over VPLS, the Layer 2 VPN extends that subnet as one broadcast domain, so the design must include 802.1Q connectivity on the LAN side of the CE (C). NAT and route exchange with the service provider are Layer 3 solutions that defeat the purpose of VPLS.

Common mistake: Option B (address translation to hide overlapping subnets) — it is the standard fix for overlapping subnets in Layer 3 VPNs, but VPLS deliberately extends the identical subnet as one L2 domain, so NAT would defeat the technology choice.

Expert Analysis

Why C is the right answer

The attractive wrong answer: B (address translation) Option B sounds plausible at first because overlapping subnets are a classic VPN problem, and NAT is the standard cure in most VPN designs. It even appears to satisfy the literal condition in the stem — every site uses the same IP subnet. But the question specifies VPLS (Virtual Private LAN Service), which is a Layer 2 VPN that presents the provider network as a single transparent Ethernet switch connecting all sites. The whole point of choosing VPLS over a Layer 3 VPN (MPLS L3VPN) is that the identical subnet can be extended across sites as one broadcast domain, so the sites genuinely share one L2 segment. Applying address translation would break that transparent Layer 2 behaviour, defeat the purpose of selecting VPLS, and force the engineer to manage multiple IP networks and translation rules — exactly the operational burden VPLS is chosen to avoid. As one comment puts it, "VPLS is a type of VPN that allows for the connection of multiple sites into a single L2 domain" and "the VPN represents a L2 virtual switch," so "NAT has nothing to do with this."

Why the other options fail Option A contradicts the requirement directly: splitting each site into a different VLAN would stop the sites from sharing the same subnet. Option D belongs to Layer 3 VPN designs, where the PE exchanges routes with the customer; in VPLS the provider switches on MAC addresses and no routing adjacency with the SP is required. Option C is the correct answer: the CE hands Ethernet frames into the provider's L2 VPN, and 802.1Q connectivity on the LAN side of the CE is what carries the customer's VLAN — and therefore the shared subnet — into the VPLS attachment circuit at each site.

Official Reference

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16-11/configuration_guide/mpls/b_1611_mpls_9300_cg/configuring_virtual___private_lan_service__vpls__and_vpls_bgp_based_autodiscovery.pdf

This link opens the official vendor documentation in a new tab.

Exam Strategy

Read the VPN type first — it dictates the answer layer. VPLS, H-VPLS and E-Line are Layer 2 services, so reject any option describing Layer 3 behaviour (NAT, route exchange, routing adjacencies) unless the question explicitly asks about interworking. Then check the stem for the constraint: 'same IP subnet' means the design must carry one shared VLAN end-to-end, which points to 802.1Q tagging on the CE LAN handoff. Applying this layer test eliminates B and D immediately and usually resolves the remaining pair.

Frequently Asked Questions

Why is NAT not needed when sites share the same subnet over VPLS?

VPLS is a Layer 2 VPN that presents all sites as one Ethernet segment, so the identical subnet legitimately spans every site as a single broadcast domain. NAT would break that transparent bridging behaviour and add needless translation management.

Does VPLS require route exchange with the service provider?

No. VPLS switches on MAC addresses like a virtual switch, so there is no routing adjacency with the SP. Route exchange with the provider is a characteristic of Layer 3 MPLS VPNs, not VPLS.

Where is 802.1Q tagging configured in this VPLS design?

On the LAN side of the customer edge (CE), so the customer's VLAN carrying the shared subnet is handed into the VPLS attachment circuit at each site. The provider PE also uses 802.1Q on the attachment circuit toward the CE.

More 300-420 FAQ →

Community Votes

C
54%
B
38%
D
8%

54% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 21 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 21

  1. jzzmth 👍 3
    I'm going with C. The question states all sites use the same subnet... while answer "B" states [... NAT to hide overlapping subnetS ...]. To me this just doesn't sound correct because there is only 1 subnet in question and that answer uses the plural form of that word, also the question uses the words "must include" and you can absolutely get this working without any NAT involved if you treat it simply as a Layer2 extension (just don't have overlapping IPs). "C" sounds more correct here because yeah if you use a VPLS circuit to extend a broadcast domain obviously you need to tag that traffic with a VLAN before you can even send it into the VPLS circuit.
  2. Beehurls 👍 3 Answered C
    VPLS is a way to share the same subnet at multiple sites. Using NAT to hide the overlapping subnets does not make sense and defeats the purpose. A few are caught up in the idea that the PE side should be configured with 802.1Q, but they must be looking at the configuration guide for the PE only. You are perfectly fine with configuring 802.1Q on the CE side, and it is required to use multiple VLANs.
  3. Clauster 👍 3 Answered C
    Because VPLS is a L2 VPN topology, the best answer here is C, you need to configure VLAN on the CE side of the LANs at each site. This is the best answer. NAT can also be used but it will be way more work as you would have to manage several IP networks and handle all of those translations, and they are planning on scaling.
  4. beskar 👍 3 Answered C
    VPLS is a L2 WAN technology therefore it makes sense that the answer be C and not B. NAT has nothing to do with this. The same IP subnet is nothing more than extending a subnet/vlan across a WAN to other sites.
  5. Reinier_veen 👍 3 Answered C
    "VPLS is a type of VPN that allows for the connection of multiple sites into a single L2 domain over a managed IP/MPLS network". So the VPN represents a L2 "virtual switch".
Show 16 more comments
  1. musclehamster 👍 3 Answered C
    Being in the same subnet does not mean there is an issue as long as there are no duplicate IPs
  2. SpicyMochi 👍 2 Answered B
    B. address translation to hide overlapping subnets When connecting multiple sites with the same IP subnet using VPLS, the engineer must include address translation to hide overlapping subnets. VPLS (Virtual Private LAN Service) is a Layer 2 VPN technology that allows multiple sites to appear as if they are connected to the same LAN segment, but each site must use a unique IP subnet. Address translation is used to map the overlapping IP subnets to unique subnets, allowing them to be transmitted across the VPLS network without conflicts.
  3. mohdx 👍 2 Answered C
    C. 802.1Q connectivity on the LAN side of the CE Because with VPLS, the customer edge usually hands off Ethernet/VLAN traffic into the provider L2 VPN. If you need to carry the same Layer 2 subnet/VLAN across sites, you commonly use 802.1Q VLAN tagging on the CE-facing LAN side.
  4. Beehurls 👍 2
    No one said anything about duplicate IPs. VPLS is a way to extend a L2 domain which means the design is meant to use the same subnet.
  5. iLikeHamburgers 👍 2 Answered B
    Question states "All the sites use the same IP subnet.", thus NAT is needed.
  6. Abdulmw 👍 1 Answered D
    When connecting multiple sites that use the same IP subnet over a VPLS (Virtual Private LAN Service) network, it is essential to include route exchange with the service provider. VPLS is a Layer 2 VPN technology that extends the LAN segment across multiple sites, including the headquarters and remote locations. In such a scenario, the service provider plays a crucial role in ensuring that traffic is appropriately routed between the sites. Route exchange with the service provider allows the service provider's network to understand the reachability of each site's IP subnets. This enables proper routing of traffic within the VPLS network, despite the overlapping IP subnets at different locations.
  7. G_Singh12 👍 1 Answered C
    Because Virtual Private LAN Service (VPLS) is a Layer 2 VPN architecture, the service provider's network behaves exactly like a giant enterprise network switch. Traffic is forwarded across the WAN based on MAC addresses rather than Layer 3 routing tables. Adding address translation would break this transparent Layer 2 behavior and completely defeat the purpose of selecting VPLS over a Layer 3 VPN.
  8. sylux 👍 1
    It says here you should do it on the PE device not the CE Page 3-7 https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16-11/configuration_guide/mpls/b_1611_mpls_9300_cg/configuring_virtual___private_lan_service__vpls__and_vpls_bgp_based_autodiscovery.pdf
  9. Clauster 👍 1
    This is not correct, you cannot have overlapping subnets when using VLANs the router/switch won't allow you to configure overlapping subinterfaces. NAT is needed.
  10. iLikeHamburgers 👍 1
    "All the sites use the same IP subnet." We have to NAT the networks at each site because of this. Only answer that facilitates this requirement is B
  11. cerifyme85 👍 1 Answered B
    Therefore LAn users would be on a different subnet behind CE and would still ned to NAT to ISP subnet... B
  12. mgiuseppe86 👍 1 Answered B
    Cisco config guide states 802.1q should be configured on the PE side, not CE.. I am going with B
  13. Beehurls 👍 1
    You want to share the subnet with VPLS. So you should not hide it.
  14. cerifyme85 👍 1
    I think the question meant all the CE routers on same subnet.
  15. zzmejce 👍 1
    Don't we need 802.1q on the WAN side in this case...
  16. Swiz005 👍 1 Answered B
    NAT is required for duplicate IPs - B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

POV Report Builds the Customer Platform During Discovery

S-grade

Inter-VN Communication in Cisco SD-WAN Architecture

S-grade

Advertising a Default Route from Core to Aggregation to Hide Instability

S-grade

Hierarchical QoS Shaping to Protect Voice at a 50 Mbps CIR

S-grade

Practice All 300-420 Questions

Access 150 questions with complete answers and detailed explanations.

View Full 300-420 Practice Test →

← Back to 300-420 Study Guide