5

I work for a company overseeing network design of a large industrial system. For our purposes, it's a backbone network that other stakeholders have their own L3VPNs defined on. It is a network with its own private cabling infrastructure, and as such is not connected to the internet or any public infrastructure except on a few specific VLANs through a customer firewall. Everything is IPv4.

In reviewing their IP addressing, I've found that the contractor in charge of the design has assigned public ranges to every subnet. We raised this issue to them, and they have readdressed the network to be within the private RFC1918 range. We are definitely making sure that the VLANs accessing the internet are on private address space. However, since they are determining the address space for other stakeholders in the project, there is an issue where those stakeholders now have to make significant changes to their equipment that was already commissioned/installed in difficult locations(there's a lot of endpoints) and there is now some question of whether we can "get away with" having those subnets remain within these public ranges.

To be clear, I know this is bad practice. I'd rather bite the bullet and readdress everything now but it's not completely up to me.

However, if we can guarantee that the devices in question will never have to access the public internet, are there any other issues that could arise?

Improve this question
1
  • 8
    Working for a huge organization that has been and still is largely ignoring proper public and private addressing, my stern advice is to comply with RFC 1918 and save yourself a truckload of constant pain later on - when either Internet access does become necessary all of a sudden, or there's some need to access both the network in question and the public Internet at the same time. As there's no immediate need I'd plan for a slow but closed-end renumbering schedule.
    – Zac67 ♦
    Jun 24, 2021 at 9:42

1 Answer 1

Reset to default
13

If those devices will actually never access the Internet, then the devices themselves will be fine, however there's still some potential issues:

  • what about other system that must communicate with those internal publicly-addressed devices and the Internet at the same time?

  • some security devices (firewall) have default rules to block traffic between public and private IP address. It's unlikely you will have an issue with this, and those rule can be deactivated, but it is such a corner case that somebody may well spend hours to find what's going on.

Finally, the main issue is that you cannot guarantee that those devices will never access the Internet. Some design can survive a very long time and you cannot know what will be the requirement in 3, 5 or 10 years.

Improve this answer
2
  • Thank you for your reply, upvoting for being insightful. I think your second point about firewalls is an excellent one - if we proceeded this way we will have to make sure that any firewall config takes this into account. I'll leave this up for a little longer in case anyone else wants to weigh in.
    – mb_
    Jun 24, 2021 at 8:22
  • 4
    It's also an excellent point to prepare for any future connectivity. I've seen several installations that did require Internet connectivity at some point or other but weren't planned for that in ages.
    – Zac67 ♦
    Jun 24, 2021 at 9:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.