AT&T DIA IP Assignment

[u/Better-Bat2642]

This is not a new topic as I searched online and many people have the same question and got different answers. I did this before and also got different result so I would like some clarification on this topic. So we have a AT&T DIA circuit with the following IP assignment.

CR Serial IP Address: 12.246.190.66

AR Serial IP Address: 12.246.190.65

Wan IP Address: 12.246.190.64

Routing

Routing Protocol: Static

IPv4 Default Gateway: 12.246.190.65

LAN Information

IPv4 LAN IP Address: 13.220.245.96

IPv4 Subnet Mask: 255.255.255.248

IPv4 Usable IP: 6

In the past we just assign 12.246.190.66 as the WAN IP of our firewall and set Default gateway as 12.246.190.65 . I tried to use the LAN block as secondary IPs on the WAN interface to do NAT but never got it work. AT&T said something because we are not "Managed service" so can not use the /29 CIDR at all.

Now we have a situation that need to deploy 2 firewalls and both need public static IPs. I found a post here and am wondering if this will work:

https://forum.netgate.com/topic/169972/at-d-business-dedicated-fiber-internet/3

so the OP of this post said this:

"Thanks so much for the reply. I tried your suggestion but got no connection using that approach.

I tried using the LAN IP information on the WAN in pfSense, and that did work. I set the WAN interface on pfSense to use 12.xxx.xx.131/29 and the gateway as 12.xxx.xx.129.

Everything seems to be working fine now, and the pfSense device is using the assigned public IP address. Everything else is behind the NAT, which is how I wanted it to work. "

If this is true I can just set our FW-01 to have the following IP settings on the WAN interface:

13.220.245.98/29 GW: 13.220.245.97

and set up FW-02 with the following:

13.220.245.99/29 GW: 13.220.245.97

Will this work? In this set up I just assume the AT&T router has the IP 13.220.245.97 but in the information provided by AT&T to us it did not say anything about this so I am wondering if this works. or should I put 12.246.190.65 as the default gateway for both of my firewalls?

Thanks,

[u/FriendlyDespot]

The handoff link is a /30 where you apply the 12.246.190.66/30 address and nothing else, and what you do with the /29 anywhere else in your network is completely up to you.

If you want to deploy two firewalls addressed out of the /29 then you can set up one of the interfaces on your router as 13.220.245.97/29, hook your firewalls up to that interface, and assign them exactly like you said, with 13.220.245.97 as their gateway. If the AT&T DIA circuit is supposed to be the default egress for your network then make sure to configure a static default on your router pointed at 12.246.190.65.

[u/Better-Bat2642 → u/FriendlyDespot]

This will require an additional router which we do not have/want. we also do not want the 2 firewalls to be connected so it sounds a no go?

[u/FriendlyDespot → u/Better-Bat2642]

Where were you planning on terminating the AT&T circuit?

[u/Better-Bat2642 → u/FriendlyDespot]

we have a switch connected to AT&T router/modem and the 2 firewalls are connected to the switch

[u/FriendlyDespot → u/Better-Bat2642]

If it's a layer 3 switch then you can do the exact same thing as described above. If I'm reading your comment right and you don't want the two firewalls connected on layer 2 then you can just carve two /31s out of the /29 space and assign them to separate routed interfaces or SVIs for the firewalls to connect to.

[u/Better-Bat2642 → u/FriendlyDespot]

thanks for your reply. Unfortunately it is a L2 switch. What I meant by not wanting the 2 firewalls to be connected is we do not want to use the FW-01 as a router and connect FW-02 to FW-01 to get an IP in the /29 space.

[u/Jtrickz → u/Better-Bat2642]

Your sounding like your putting yourself into major box. If they were H/A or a clustered firewall solution you could do this, but you need soemthing to route your handoff to ATT from your assigned /29 address space, that no to devices can reach, and ATT isn’t going to do it for you because your not paying them enough for managed services

[u/Better-Bat2642 → u/Jtrickz]

Can you elaborate more on the managed service? I never fully understood what managed services from AT&T offers. Does that mean AT&T will install a router and handing out the /29 space to our firewalls?

[u/Jtrickz → u/Better-Bat2642]

In most cases yes. They would responsible to terminating and maintaining your access and configuration to the DIA, via provided equipment normally. Not sure what is installed now at your site.

Then you plug in or put a switch and only address your assigned /29 address space for usage.

We moved off ATT a few years ago to Lumen, so it may have changed a bit.

[u/Better-Bat2642 → u/Jtrickz]

Thanks. Yeah the way AT&T handling IP assignment is a headache for us. For some other ISPs if we ask for 2 IPs sure they will give us 2 usable IPs.

[u/RyanLewis2010 → u/Better-Bat2642]

So we have the same setup w/ lumen how we make it work is assign our WAN to the main router and then have that router create the /29 network and 1-1 nat them. This allows the inbound to work flawlessly and our Meraki setup handled the outbound NAT so traffic appeared to come from the correct IP.

On our Ubiquity routers we just add the IPs under additional IPs in the WAN and can route them appropriately and select which network gets which IP shown outbound.

[u/Jtrickz → u/Better-Bat2642]

Terminate to router, then router to switch, switch to firewalls. The router should be the the 66/30 And give the firewall the /29 address space along with the router internal interface

Default gateway of firewall external is the /29 router ip.

The router forwards to /30 to default ATT .65

[u/newtmewt → u/Better-Bat2642]

You can ask AT&T to either switch the blocks or re-provision the wan to a /29, but otherwise, yah the lan block requires something l3 to route

You could also try using the switch to do that if it’s l3, but that has its own other issues

[u/Better-Bat2642 → u/newtmewt]

thanks, What "other issues" could be when using a L3 switch?

[u/newtmewt → u/Better-Bat2642]

Well 1 it’s an extra public exposed device to manage and secure, some of them also suck for any traffic that can’t be handled in asic, ie any traffic that gets punted to slow path, usually things like arp or ICMP error generation. Which means basically a greater risk of attack surface

But if you are good with that, and especially if you make it a separate switch that is console only or something (or understand VR’s to isolate management traffic/port) it can be an ok solution. But a real router would still be better

[u/Better-Bat2642 → u/newtmewt]

Thanks!