1

Please bear in mind that I am learning and have never set up a network with routers and switches myself. Also please bear this is sort of going to be loaded question because there are multiple layers I'm confused about.

My question stems from this other question asked in Server Fault.

In the question, it seems that OP's ISP provided a gateway (which I presume would have NAT functionality). So I'm not sure why you couldn't have a switch in between the ISP's gateway and the clients, and instead need yet another gateway with NAT. Is it because we won't have access to configure the ISP's gateway to communicate to the switch?

Secondly, why do we need NAT at all? Based on OP's post it seems like he had static IPs that he can use for each of his devices. Is it not possible for the ISP's gateway to strictly act as WAN access? As in, if the device had a static address of 123.123.123.123, there's no need to have the gateway translate that address to the public. And so, can't each device have a static IP address and be connected with a switch?

If we don't need to do NAT, then we don't want the ISP's gateway to be doing the routing (because if it was good at doing that, why would we have a separate switch in the first place). We want every traffic that's passing the gateway to directly go to the layer 3 switch and have the switch take care of the routing to each device. This comes back to my first question. Is the reason why "we can't simply put a switch between the ISP's gateway and the clients" that we can't configure the ISP's gateway to pass every traffic to the layer 3 switch? (Actually, even if we do need NAT, assuming the ISP's gateway does NAT, if the ISP's gateway receives a packet, we just need the ISP's gateway to tell the switch what the translated MAC and private IP address are so the layer 3 switch can do the switching/routing to the devices)

Improve this question
4
  • Not all gateways use NAT. A company usually will install its own router/firewall (gateway), and some companies own public addresses and do not want to use NAT on those. You seem to be looking at this from a (off-topic) home network perspective. You only use NAT where you must (private<->public or overlapping addressing).
    – Ron Maupin ♦
    Commented Feb 14, 2023 at 14:52
  • In retrospect, NAT might not be relevant for this question because my main concern remains regardless of whether the gateway has NAT or not (but the context regarding NAT still helps for this question in my opinion). The main question is whether it is possible to configure a switch between an ISP's gateway and your devices without an extra gateway/router/firewall
    – itsmarziparzi
    Commented Feb 14, 2023 at 15:17
  • That is possible, but not a good idea. Your company really needs a firewall between the company network and the ISP network. Not putting in a firewall is foolish.
    – Ron Maupin ♦
    Commented Feb 14, 2023 at 15:24
  • So the answer is "it's possible, but not recommended"? The answers from the question I'm stemming off from was kind of implying it's not possible
    – itsmarziparzi
    Commented Feb 14, 2023 at 15:26

1 Answer 1

Reset to default
1

In the question, it seems that OP's ISP provided a gateway (which I presume would have NAT functionality).

It might not.

So I'm not sure why you couldn't have a switch in between the ISP's gateway and the clients, and instead need yet another gateway with NAT. Is it because we won't have access to configure the ISP's gateway to communicate to the switch?

You actually maybe could. Depends on the specifics of the situation. But yes, you might or might not have access to manage the ISP provided gateway. Which might, or might not, be an issue for the organization in question.

Secondly, why do we need NAT at all? Based on OP's post it seems like he had static IPs that he can use for each of his devices. Is it not possible for the ISP's gateway to strictly act as WAN access? As in, if the device had a static address of 123.123.123.123, there's no need to have the gateway translate that address to the public. And so, can't each device have a static IP address and be connected with a switch?

They might not provide enough static IP addresses so the organization will need to choose which things should use the public, static IP addresses and which others will share a single IP address via NAT.

If we don't need to do NAT, then we don't want the ISP's gateway to be doing the routing (because if it was good at doing that, why would we have a separate switch in the first place).

They may well need NAT, you can't assume they don't. And there is nothing wrong with the ISP gateway doing routing, it needs to be done there or the gateway needs to be removed or changed into a bridge or something. Either way, it has to be in the mix to some degree in most cases because the ISP will expect it to be there to help them provide the service the customer pays for.

We want every traffic that's passing the gateway to directly go to the layer 3 switch and have the switch take care of the routing to each device.

That's fine, you can have that even with the ISP gateway in use. A layer 3 switch can act as an 'internal gateway' for the various LANs the organization needs and then forward traffic on to another gateway device like a firewall and then on to the ISP provided router and out to the internet. Nothing wrong with that.

This comes back to my first question. Is the reason why "we can't simply put a switch between the ISP's gateway and the clients" that we can't configure the ISP's gateway to pass every traffic to the layer 3 switch?

Maybe, yes, maybe no. Depends on the ISP. That may be a factor or the ISP may provide access or they may agree to allow the customer to replace the gateway with their own device.

(Actually, even if we do need NAT, assuming the ISP's gateway does NAT, if the ISP's gateway receives a packet, we just need the ISP's gateway to tell the switch what the translated MAC and private IP address are so the layer 3 switch can do the switching/routing to the devices)

Yes, but the customer organization might still want their own gateway device for additional features they can't get from the ISP provided gateway (firewall, IPS, SD-WAN, etc.).

The real answer here is that it all depends on the specifics of the ISP, the equipment and the customer organization's needs.

Improve this answer
4
  • Thanks for this super organized answer. So, if we go back to the original question I'm citing, this person simply seems to want his devices to be connected to the internet first and foremost. So, if we ignore the benefits of firewalls, what's missing for that person to be able to connect to the internet is that he has to be able to modify the ISP's gateway to forward all incoming traffic to the switch's IP address. Is that correct?
    – itsmarziparzi
    Commented Feb 14, 2023 at 16:03
  • @itsmarziparzi, a switch only has an address for management, and that has nothing to do with switching. Remember that home/residential networking is off-topic here, and any company that wants to stay in business requires a firewall because anything directly exposed to the public Internet will be compromised in short order. Also, it depends on how many public addresses a company has, but, for IPv4, NAT is almost always a requirement, even if a company has multiple public addresses, and switches simply do not NAT.
    – Ron Maupin ♦
    Commented Feb 14, 2023 at 16:40
  • @itsmarziparzi, the link in the original post is for a discussion about an HP switch that cannot provide NAT, only limited layer 3 features for basic routing. So the concerns about NAT are basically irrelevant in that discussion but even for that situation, I would still recommend they have a firewall regardless of whether they want to use NAT or if they have enough public IPs to skip using it. The ISPs gateway configuration and features are up to the ISP so the customer has to work with them to figure that part out.
    – FrameHowitzer
    Commented Feb 15, 2023 at 0:39
  • @RonMaupin, just to make your life more exciting, the Cisco Nexus 6001 Datacenter switch does offer NAT with the layer 3 base software license. I can't imagine anyone wanting to do that on that kind of switch but technically it is possible. I figure they put it in there just to make everyone upset. :) I think I remember a couple of Arista switches that do so as well. But yeah, as a rule, switches do not do NAT, and even when they do, they almost certainly don't do it well enough to make it enjoyable to use.
    – FrameHowitzer
    Commented Feb 15, 2023 at 0:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.