Router interfaces with private IP addresses

Question

We’re short on IPv4 address space and thinking about migrating our router interfaces to private RFC1918 addresses.

Because we have lots of L3 links in our data center we would gain quite a lot addresses which can be used better for servers.

What are pros and cons of using private IP addresses on our internal routers?

Answer 1

The upsides of migration basically come down to the following:

1. (obviously) the reclamation of public IP addresses
2. Transit interfaces are theoretically less directly reachable from the open Internet. I'd be really hesitant to call this a substantial security win, as you ought to be heavily filtering any traffic directly to or from your routers' interfaces.

The downsides tend to come down to a loss of visibility on the part of any external entity, including:

1. Traceroutes will work but since reverse resolution of the transit IP's won't it will provide no insight to others as to what path a given packet takes (i.e. is 10.x.x.x a router in Ashburn, VA or Hong Kong? Who knows?). Worse yet it may show up as an internal resolution for some, which isn't a huge deal but may be confusing.
2. Depending on your design, your network management systems ability to reach individual interfaces may suffer. You can potentially offset this by carrying those routes in your own tables with the (hopefully obvious) caveat that these prefixes need to be carefully managed and filtered to avoid exposing them to any third parties.
3. Again, we don't know much about your network topology but if you're peering with others the extent to which you expose any of these transit routes (or need to) has to be analyzed. As an example, preserving your internal next-hop in a peering environment ceases to be a useful option.
4. You may run into administrative issues with some providers - or other third parties - as "exposing" 1918 addresses to the broader Internet is considered bad form.

So - in practice with the information provided in the question it's hard to offer much more than the general observations above. I don't know how much space you'd potentially reclaim but would point out the additional (also hopefully obvious) point that the amount of work and potential disruption that migration will require is non-trivial: interruptions of service/change windows, changes to routing schemas and policies, monitoring tool adjustments, operational/troubleshooting protocols, etc.

Is the amount of time spent (or risk engendered) of greater or lesser value than the few thousand dollars the equivalent amount of public address space might be worth?

Answer 2

To answer the question directly the pro's and con's are finding a balance between COST and SECURITY.

Maintaining the existing Public IP Addresses introduces COST and trying to get additional Public IP Addresses will increase that COST for obvious reasons but also because of restrictions/hoops the ISP presents for you to get the extra you need.

With a larger number of routers being presented on Public IP Addresses you're also increasing the attack surface of your network. (Based on what we know of your network so far).

Changing to Private IP Addressing will decrease the attack surface but depending on internal skillsets/extra configuration/project time the cost savings may not be realised immediately.

Answer 3

Depending on the sophistication of your network, you may find the abundance of private addresses allows you great simplicity in your numbering. Simplicity will pay back time and again.