A. Yes the CSR1000V will route packets between subnets within a VPC. However, if those subnets both have external connections through the Internet Gateway (IGW) this presents a problem.
For example, consider the following setup:
IGW -- SUBNET-A -- CSR -- SUBNET-B -- IGW
If a packet comes from outside of the VPC onto SUBNET-A, and needs to be routed to SUBNET-B, and then from there it needs to exit the VPC the Amazon Anti-Spoofing feature will come into play and will drop the packet. Amazon Anti-Spoofing is a feature that is implemented by the underlying infrastructure and is not enabled by the user. If a packet is traversing a segment that it did not originate on, and must be sent to the IGW, the IGW will not forward that packet. An alternative would be to use tunneling to get traffic out of the AWS infrastructure so that the source of the packet is not visible to the IGW.
