3

We’re short on IPv4 address space and thinking about migrating our router interfaces to private RFC1918 addresses.

Because we have lots of L3 links in our data center we would gain quite a lot addresses which can be used better for servers.

What are pros and cons of using private IP addresses on our internal routers?

6
  • What you need to consider is the topology of your network and the services you're presenting externally/internally. What type of external connectivity do you have? And how is traffic routed externally or between sites?
    – ssedwards
    Oct 24, 2017 at 13:07
  • 1
    You need to provide some more information. A diagram of your network would be helpful.
    – Ron Trunk
    Oct 24, 2017 at 13:14
  • We‘ve two 10G connections to our ISP. Routing is done via BGP and we‘re running OSFP as IGP. Oct 24, 2017 at 13:20
  • Nearly all services are presented externally. Oct 24, 2017 at 13:21
  • 2
    How many routers? How many subnets? How many hosts? You really need to provide more info.
    – Ron Trunk
    Oct 24, 2017 at 14:26

3 Answers 3

4

The upsides of migration basically come down to the following:

  1. (obviously) the reclamation of public IP addresses
  2. Transit interfaces are theoretically less directly reachable from the open Internet. I'd be really hesitant to call this a substantial security win, as you ought to be heavily filtering any traffic directly to or from your routers' interfaces.

The downsides tend to come down to a loss of visibility on the part of any external entity, including:

  1. Traceroutes will work but since reverse resolution of the transit IP's won't it will provide no insight to others as to what path a given packet takes (i.e. is 10.x.x.x a router in Ashburn, VA or Hong Kong? Who knows?). Worse yet it may show up as an internal resolution for some, which isn't a huge deal but may be confusing.
  2. Depending on your design, your network management systems ability to reach individual interfaces may suffer. You can potentially offset this by carrying those routes in your own tables with the (hopefully obvious) caveat that these prefixes need to be carefully managed and filtered to avoid exposing them to any third parties.
  3. Again, we don't know much about your network topology but if you're peering with others the extent to which you expose any of these transit routes (or need to) has to be analyzed. As an example, preserving your internal next-hop in a peering environment ceases to be a useful option.
  4. You may run into administrative issues with some providers - or other third parties - as "exposing" 1918 addresses to the broader Internet is considered bad form.

So - in practice with the information provided in the question it's hard to offer much more than the general observations above. I don't know how much space you'd potentially reclaim but would point out the additional (also hopefully obvious) point that the amount of work and potential disruption that migration will require is non-trivial: interruptions of service/change windows, changes to routing schemas and policies, monitoring tool adjustments, operational/troubleshooting protocols, etc.

Is the amount of time spent (or risk engendered) of greater or lesser value than the few thousand dollars the equivalent amount of public address space might be worth?

1

To answer the question directly the pro's and con's are finding a balance between COST and SECURITY.

Maintaining the existing Public IP Addresses introduces COST and trying to get additional Public IP Addresses will increase that COST for obvious reasons but also because of restrictions/hoops the ISP presents for you to get the extra you need.

With a larger number of routers being presented on Public IP Addresses you're also increasing the attack surface of your network. (Based on what we know of your network so far).

Changing to Private IP Addressing will decrease the attack surface but depending on internal skillsets/extra configuration/project time the cost savings may not be realised immediately.

1

Depending on the sophistication of your network, you may find the abundance of private addresses allows you great simplicity in your numbering. Simplicity will pay back time and again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.