Allowing Overlapping Internal and External Subnets When Defining Security Policy Scope

When defining a security policy scope for an internal network residing behind a DNS firewall, or for an external network, then overlapping subnets containing IP addresses, hosts, or subnets included in other security policies within an organization are allowed. In this case, security policy precedence is used to select the security policy possessing the highest precedence to which the IP addresses, hosts, or subnets should be added. Subnets not already added as part of another security policy within the organization can be added to a different security policy within the same account.

If a public IP address or subnet is mistakenly added to an organization's security policy that has previously been registered by another registered organization, then the public IP address or subnet will not be allowed. In this case, the organization attempting to add the IP address or subnet will be notified regarding the issue since no overlapping of public IP addresses or subnets between organizations is allowed.