Tuesday, January 22, 2019

Question about having a static IP assigned to the WAN interface on a router vs using NAT

Hi everyone, we are a MSP and use Peplink devices to provide failover internet to customers. So for example they will have fibre internet with 1 or more static IP addresses, and we add our device so that if the fibre fails the LTE network takes over. So in a simple config, a customer might have a Meraki router, their WAN configured with their fibre static IP, and the WAN connected to the fibre gateway from the ISP. Our Peplink devices are routers, so by default we would be adding the ISP fibre to our WAN port, then connecting the LAN port from our device to the customer's Meraki. Our device might have an IP like 192.168.50.1 and assigns 192.168.50.2 to the Meraki, and we then use port forwarding to forward all ports to 192.168.50.2, and the customer then needs to reconfigure their Meraki using 192.168.50.2 as the WAN IP vs the Static IP. Whether the fibre is up, or LTE, the customer's Meraki is always 192.168.50.2, so pretty basic stuff.

Peplink supports drop-in mode, where it sits instead transparently in the mix. So with this deployment, the customer's Meraki keeps the fibre static IP assigned, and our device just passes traffic through it. So whether fibre or LTE is active on the Peplink, the Meraki always has the fibre static IP programmed to it, and there's no port forwarding or NAT. This is our preferred deployment and how we do most of them.

The question I have though is do most people really hate using NAT? Originally we just figured that's how we'd always do it, but literally every customer would be against it, or have a reason they need their static IP assigned to their WAN. One company said it was corporate policy, they could not have an internal IP assigned to the WAN but only external. Then another one we had issues with their site to site VPN even with port forwarding on, and only got it to work when using drop-in mode.

The reason for my question is because we're using Cradlepoint a bit now as well, but they don't seem to have a drop in mode type feature and instead just use NAT. Just curious if it was just a few bad customers I had up front that didn't want it, or if most people are against NAT and want their static IP assigned to their CPE directly as I'd love to get some feedback on the pro's and cons.

Thanks!



No comments:

Post a Comment