Agentic Data Plane

Choose CIDR Ranges

When you create an Agentic Data Plane environment, you choose the Classless Inter-Domain Routing (CIDR) block for its Redpanda network. The block cannot change after the environment is created, and it must not overlap any network that you connect to the environment’s virtual private cloud (VPC), for example through VPC peering or a VPN.

Supported IP address ranges

Redpanda Cloud uses private IPv4 address spaces for environment CIDRs. These ranges are designed for internal networks and cannot be accessed directly from the internet. Choose a CIDR from one of the following RFC 1918 ranges:

  • 10.0.0.0/8 - Provides addresses from 10.0.0.0 through 10.255.255.255

  • 172.16.0.0/12 - Provides addresses from 172.16.0.0 through 172.31.255.255

  • 192.168.0.0/16 - Provides addresses from 192.168.0.0 through 192.168.255.255

An Agentic Data Plane environment accepts only these RFC 1918 ranges, and Redpanda’s network infrastructure routes traffic only within them. Traffic from public IP addresses or other private ranges is blocked by design.

What are CIDRs?

The following CIDR ranges are a critical part of your Redpanda environment’s network configuration:

  • Your existing (client) VPC/VNet CIDR

  • Your Redpanda environment CIDR

It is important to ensure that these ranges do not overlap when setting up VPC peering.

Choose the CIDR ranges

To choose a range for Redpanda, you must know your VPC/VNet CIDR:

  • In AWS, find it in the VPC area of the AWS Management Console, labeled IPv4 CIDRs.

  • In Azure, find it in the Essentials view of your virtual network, labeled Address space.

  • In GCP, find it in the Details view of your VPC, labeled Internal IP Ranges.

You can check which IPs this range encompasses by using either the ipcalc command in your terminal or the CIDR calculation tool. For example, if your client’s CIDR range is 10.0.0.0/20, run:

ipcalc 10.0.0.0/20

The output should look similar to the following:

Address:   10.0.0.0             00001010.00000000.0000 0000.00000000
Netmask:   255.255.240.0 = 20   11111111.11111111.1111 0000.00000000
Wildcard:  0.0.15.255           00000000.00000000.0000 1111.11111111
=>
Network:   10.0.0.0/20          00001010.00000000.0000 0000.00000000
HostMin:   10.0.0.1             00001010.00000000.0000 0000.00000001
HostMax:   10.0.15.254          00001010.00000000.0000 1111.11111110
Broadcast: 10.0.15.255          00001010.00000000.0000 1111.11111111
Hosts/Net: 4094                  Class A, Private Internet

Note the values for HostMin (10.0.0.1) and HostMax (10.0.15.254). These are the minimum and maximum values of the range of 4,094 IPs that this CIDR covers. The number of IPs is governed by the suffix: /16 contains 65534 IPs, /21 contains 2046, /24 contains 254, and so on. For private networks, this number can range from 8 (which contains 16777214 IPs) to 30 (which contains 2).

An Agentic Data Plane environment’s CIDR block requires a block size between /16 and /20 on AWS, or between /16 and /19 on GCP.

Example

Assume that your client’s CIDR range is 10.0.0.0/20. Your Redpanda range cannot overlap with it; if it does, VPC peering will not work.

A limited set of examples that work with 10.0.0.0/20 are 10.8.0.0/20, 10.0.16.0/20, or 10.1.0.0/20.

Ranges like 10.0.0.6/20, 10.0.8.0/20, or 10.0.1.7/20 would not work. You can use ipcalc to check for overlapping IPs.

Multi-VPC/VNet example

If you have many IP ranges allocated in a complex system, work with a network engineer who can help with IP allocation. Your Redpanda CIDR cannot overlap with any of your existing VPCs/VNets, nor can it overlap with the VPC/VNet you want to peer with.

Assume that the following example ranges are in use:

  • 10.0.0.0/20

  • 10.8.0.0/20

  • 10.0.35.8/20

  • 10.0.16.8/20

A Redpanda CIDR that would work (and not overlap) with any of them is 10.8.48.8/20