Here is the background info:
I support a legacy regional group of users with trunk mounted cellular data modems. These devices use a private APN, meaning they do not communicate directly over the Internet, all traffic from these devices come from the wireless provider into our private network over a leased line, at which point the firewall decides to discard or route the packet.
The vendor who provided this private APN setup a long time ago used public addresses for the mobile devices as well as a specific public subnet that they could communicate with. For illustration purposes, I'll say the subnet was 1.2.3.0/29 (this is not the real subnet). So we could address 6 devices on our network (1.2.3.1 - 1.2.3.6).
The device provides connectivity for laptops in the vehicle, but also each also reports AVL location data to one of these servers, lets say that is 1.2.3.6. These reports are UDP messages on a well known port, let's say that is port 21000. The device configuration requires an IP Address, not a DNS queryable device name.
No server on our private network actually has the address 1.2.3.6. The Cisco ASA Firewall has a UDP PORT NAT for port 21000 from any machine in the public subnet that the mobile units use to the real address of the AVL server.
Change is coming: Now, so many years later, we are upgrading capabilities, and the devices will now be assigned private addresses by the wireless vendor. The public subnet for the mobile devices, as well as the public subnet for our servers (1.2.3.0/248 above) will no longer be assigned to us once the migration is complete. So then the 1.2.3.6 address that we've been using for AVL will no longer "belong" or otherwise be assigned to us (It's always belonged to the vendor).
The problem: The new private subnet the mobile devices will now get addresses in is not included in the UDP PORT NAT firewall rule. Once we migrate the APN, then, the cellular modem will no longer be able to report their AVL location successfully. The cellular modems (over 1000 of them) must be manually reconfigured one at a time if we change the AVL server address. If we move forward with the migration, the AVL reports will stop working until we manually reconfigure each modem. If we reconfigure before the migration, we break AVL until the migration occurs. There is no way to automate making these changes concurrently.
My Solution: I first asked my network vendor to add the new 10.x.x.x subnet for mobile devices to the firewall rule that port forwards UDP to 1.2.3.6 port 21000 to the proper server. I was told I cannot NAT traffic from a private (10.x.x.x) address that is attempting to reach a public address (1.2.3.6) to an internal server. I don't know if this is a safety violation the Cisco ASA will not allow, or if this is a policy of the network vendor. I then asked if perhaps the router before the firewall could do this UDP PORT NAT for me, changing 1.2.3.6 to the server's "real" address before the traffic reaches the firewall. No, I was told that since we will no longer be assigned this one particular public address, he cannot include that UDP PORT NAT in the router. "we cannot hang on to a block assignment we do not lease or own."
My Question: Perhaps this is a matter of opinion? Only traffic coming in on our leased line (which is just the mobile devices) would even have access to this one very specific rule. They certainly would never need nor try to access a public Internet device at 1.2.3.6 port 21000. Are there risks I am not aware of? I understand the situation is not ideal, but I am trying to find a solution that would allow us to move forward with the newer faster APN technology but not break every modem configuration in the fleet.
Am I asking the vendor to do something that legitimately should not be done? I don't wish to cause any security risks, or try to use or steal public address space not allocated to me. What would you do to support this network challenge?
