Link to home
Start Free TrialLog in
Avatar of smart Z
smart Z

asked on

IP block move

Dear experts, 


I am at a client location and the client has old building with internet connection and has a block of public IP. The client is building a new site but once the new data center is built the idea is to move the servers gradually to the new site. For sometime the both old building and the new building will coexists. What is the usual practice in this case ? The ultimate goal is for the client to shutdown the old building and use the same IP block.


Thank you,  

Avatar of noci
noci

First ensure you have a connection between old / new site (VPN as an internal connection) as an extended LAN.
Then migrate stuff system by system as you see fit, when the majority is over migrate the main connection to the other site.
The temporary connection between sites should preferably not use the existing connection to prevent congestion.

Avatar of smart Z

ASKER

That is a good point but what if they need internet access at the new site? what can the ISP do in this case?
The ISP for the new building will provide you with an additional block of IPs. When you move a server over to the new location you’ll configure traffic to point to the new IP.

What services are you running? Email, website, etc..? You’ll do this through DNS. If you’re moving a website over you’ll do this where the site is registered.
For sometime the both old building and the new building will coexists. What is the usual practice in this case? 
You'll need to purchase an additional firewall for the new location. Configure as soon as you get internet access.

The ultimate goal is for the client to shutdown the old building and use the same IP block 
You can't use the same IP block, well at least at the same time. Is there a reason why the client is requesting this? Common practice is get static IPs from the ISP at the new building, plug these into your firewall, the one located at the new building. Then use DNS to point all traffic to the new IPs at the new building. 
Avatar of smart Z

ASKER

It is the same ISP actually, Can the ISP increase the block range and client could use the available IP for the new building? is that possible. 

It is the same ISP actually, Can the ISP increase the block range and client could use the available IP for the new building? is that possible. 
Possibly but highly unlikely. When you ask for new services they will check what IP range is available. If it so happens they're an extension of your current IP range I imagine they would provide. I've never requested an extension.

Why do you need your current range extended? Why can't you use the new IPs that are autogenerated?   
With new IPs extended or not you still have to change DNS, you're aware of this, correct? Unless I'm missing something. 
If it is within one ISP contact them and ask what is possible....
in the case you have a tunnel between sites, then  all external traffic would go through the place where there main block is connected.
... if one of the sites is on the extended LAN. and Halfway through the main connection shifts from one to the other.
if it is the same isp and they own the addresses, at least it will likely be possible. ask them though. some isps use regionalised blocks. the more appart the building, the more chances they end up in different regions.

splitting between sites is not entirely impossible. it will work reasonably fine for services you host. for internet access, expect each site to see a fraction of the internet

pptp tunbels can help as mentionned but you will either need a dedicated link, or a temporary address block and some kind of ptp link between sites.

in many cases, migrating to a new block is easier
@noci, an issue I see with VPN is they want to do away with the old site. VPN is dependent on the old building, they will still have to switch IPs to the new location or deal with it at some point prior to shutting down the old building.

VPNs are often slow too, extending the incoming traffic to the second building will be more of a burden likely creating bandwidth issues. IMO better to have full internet speeds to both buildings prior to making the split, last thing you want with a new data center is bandwidth issues while bringing up servers in the new location. Going the VPN  route creates a point of failure that isn't really necessary. There will be a lot of things with a new building to worry about and test, I don't recommend creating another point of "possible" failure.

@skullnobrains just an FYI, PPTP is not considered a secure protocol anymore. The flaws include hashing of passwords which makes it vulnerable to man-in-the-middle (MITM) attacks. There's also the possibility to decrypt data being sent through the protocol.
i mean A ptp protocol. this does not presume on which protocol. vpns, ipsec, l2tp, .... are all ptp.

additionally, i believe any protocol including a gre tunnel would not be significantly less secure if the firewall on both sides only allow each other's ip. i probably would use l2tp or gre over ssl with client cert auth.


Ehm a VPN is a private network, not a VPN from nordvpn at. al.
I mean a IPSEC, Wireguard, or other VPN from router on site1 -> router on site 2, or as skullnobrains calls it a ptp tunneling connection.
GRE can be a solution  if confidentiality is not relevant.

Yes the routing move will still need to happen at SOME point, it's inevitable unless you can change the public  address range from site 1 -> site 2
Any internal range is not realy relevant it can be solved with NAT where needed.
Avatar of smart Z

ASKER

Alot of you have asked me why do I need to extend the range and the answer is below.
1) the current IP block is fully in use in current building. I want this IP block to be extended so I can get some static IPs to configure the new firewall in the new building. This will solve the internet access for the new building, the other issue I want to solve is making sure the DNS does not change atleast if we are on the same block of IPs, we will just move the servers from old dc to the new DC. I understand if I get a new block the IPs on the DNS will need to be updated. As per the comments I have asked the ISP to check on their end if they can extend the same range. There will be new circuit installed in the new building.
That is a good point but what if they need internet access at the new site? what can the ISP do in this case? 
How do you plan on getting internet to a building that doesn't have power and network installed? How do you expect VPN to work, you're going to run one long @## extension cord. Once power is on at the new building the ISP will install their equipment on what's called a D-Mark, its where ISP's connect their services and hand it off to their clients, in this case which is you.

Buy a firewall and configure and install on the D-Mark in the new building, every building has one it's regulated by the FCC so in cases like this so there's protection against 3rd parties installing equipment and creating a man-in-the-middle situation. It also protects IP addresses, this all started when companies would hijack cell numbers and in this case IPs to charge additional fees. Get with the building project manager and they'll tell you where the D-Mark can go. It's usually in the server room. Once power is on at the new site call your ISP and they will confirm they can provide internet services and ask to install their equipment on the D-Mark. At this point all you have to do is connect your firewall to the ISP router.

As you bring a server over from the old building change the IP in DNS to point to the new IP. 
@Noci I've been doing this for 19 years, I understand VPN, site to site, applications based. I'm not sure how your idea will work if there's no power to the building. If there is power why not call the ISP and have them install their services. We don't even know if the network portion of the build is complete.

@Zak, what status is the building at regarding the buildout? I would get with your ISP to schedule an installation ASAP. As soon as the project manager gives you the go ahead and confirms network, electricity, and the d-mark location first order of business should be getting your ISP installation complete.

Even if you go the VPN route, which I highly do not recommend, you'll need a firewall, the same one that will connect the new ISP to configure route to route VPN, but you can't do this without your ISP....sooooo just go the IP route. You need an IP address for VPN to work. 
the extension most likely won t work as you expect unless both buildings are side by side. having contiguous ranges does not mean there is no routing in between. nor will it allow you to move servers around as you want. you are talking public addresses here.
Read my comments about DNS. 
Please :-) ...FYI everything I post is meant for the sake of constructively communicating and educational purposes. Sometimes the way I write this can easily be taken out of context. 
ASKER CERTIFIED SOLUTION
Avatar of noci
noci

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial