Internal Private IP Address Range, Need Advice!

[Guest]

Hi.

 

Need some advice guys.

 

I work for the local LEA in a school. as you can image we are on a 10.X.X.X private address range and on a subnet of 255.255.255.0 giving me 254 IP addresses for our school.

 

Now here is the problem I'm having:

I have implemented a new wireless solution but the problem is with various gadget and devices that are connecting to my network taking up most of these addresses.

I want to know if there is anyone out there who is in a similar situation as me,

I really do not want to ask our LEA networks team for another IP address range giving me another 254 address

 

I want to be able to manage my own IP and subnet range instead of going back to my LEA, can I create my own private IP address range on a subnet, say for instance 255.255.0.0, giving me more scope for IP address?

 

what I don't want to do is create a private address that will cause conflict not only for us but for the LEA too. can this be done? or will I have to go through the LEA Networks team.

 

btw im running a W2k8 R2 Server environment with with a dedicated server dishing out DHCP & DNS

Windows 7 clients with mixed android and ipad devices

 

any help appreciated

 

thanks

[foofighterjim]

In order to run your own address range without causing disruption you need to implement NAT. You LEA may or may not support this, you may have to request a new IP range, I would also suggest getting off the 255.255.255.0 subnet and onto at least 255.255.248.0 to cover for future expansion. You can calculate what subnet would suite here.

[Michael]

The odds are you're connected to some form of intranet, so I wouldn't change anything without consulting them first. Worse case scenario is you create a conflict with another network bringing yours down (depending how everything's controlled/managed).

 

In your case probably the simplest way is to tweak the subnet mask to either:

 

255.255.254.0 giving you 510 IPs or 255.255.252.0 giving you 1024 IPs.

[Guest]

that's exactly what I thought Michael.

 

I know within our LEA some of the schools I've been to have a similar IP address and subnet range, so didn't want to conflict with others

sorry to sound dumb, but if I did change the subnet wouldn't that (disrupt / conflict) my network / internet??

 

networking isn't my strong point btw lol

[IrritableTech]

If your LEA has allocated IPs with a view to schools expanding, you may be able to do what @Michael suggested with their approval. It means you change the subnet mask, but you don't have to re-ip everything.

 

My former LEA provider did not do this, and we had to re-ip everything when we ran out of addresses. Not a massive issue as long as you plan well.

[Guest]

@Michael, I totally get what you mean now! thanks to @IrritableTech

 

More than likely I will see if I can change the subnet mask with my LEA. failing that it looking more like another IP address range and super scoping them both together!

[Michael]

Anything that's DHCP'ed (as it were) will pick up the new subnet mask you configure. Everything with static entries are more of an issue, but could easily be achieved out of hours.

[localzuk]

You may be able to retain your old IP range and get a new range too. We have that here, both ranges assigned by our LEA. They just updated the edge router to accept the traffic from both ranges.

[Patrick]

I'm in the same boat. /24 subnet mask and starting to run out of addresses. Noob question. Why do we have to use countys internal IP range? Why can't the router have the 10.0.x.x etc address and then NAT to the whole school and use what ever address scheme we want?

[Michael]

I'm sure if you go through the right channels, additional IPs can be allocated by simply tweaking the subnet mask (easiest way).

 

As I say, for most Primary schools a 255.255.252.0 subnet offering 1024 IPs should be suffice.

[foofighterjim]

Why do we have to use countys internal IP range? Why can't the router have the 10.0.x.x etc address and then NAT to the whole school and use what ever address scheme we want?

 

This is exactly what we had at my previous school, we could run any IP and subnet we wanted because it was all internal and NAT took care of the external. I had quite a shock when I came back into the Birmingham way of things!

[Michael]

This is exactly what we had at my previous school, we could run any IP and subnet we wanted because it was all internal and NAT took care of the external. I had quite a shock when I came back into the Birmingham way of things!

 

Well yes and no, have you run out of IPs at a Birmingham school? I haven't as yet, not even close.

[Patrick]

Why use their addresses internally anyway? There must be a reason why they don't use one public address then NAT with private internal addresses. Is it for easier remote access to servers? Edited July 10, 2014 by Patrick

[localzuk]

Here we use the provided addresses so that our local SIMS team can remotely connect in using their tools to support our SIMS users. Switching to a different range would make things more difficult. Its the same in various other areas.

[Guest]

i would have thought it be something to do with remote gateway to access the servers remotely

[Guest]

I'm sure if you go through the right channels, additional IPs can be allocated by simply tweaking the subnet mask (easiest way).

 

As I say, for most Primary schools a 255.255.252.0 subnet offering 1024 IPs should be suffice.

 

This is exactly what I'm after. will be contacting the LEA when I get back in to the office tomorrow and see if this is an option over another IP address range!

[Gibson335]

I'm in the same boat. /24 subnet mask and starting to run out of addresses. Noob question. Why do we have to use countys internal IP range? Why can't the router have the 10.0.x.x etc address and then NAT to the whole school and use what ever address scheme we want?

 

Quite. We just left a couple of servers on the internal range, used a bit of firewalling, and deployed a huge internal range that allowed us to section off areas as much as we liked - not sure our LEA would have liked that, but we did it when we went Academy...our ISP were not overly pleased, but once we set up the change requests for the NAT it all worked as we'd imagined.

[foofighterjim]

Well yes and no, have you run out of IPs at a Birmingham school? I haven't as yet, not even close.

 

Only because I am aware of the limitation and keep us within it.

Edited July 10, 2014 by foofighterjim

[RichCowell]

Could you add a Guest Wifi for the gadgets and keep the main wifi for official domain devices? (depending on the policy of whether you give out the wifi key or not I guess)...

 

Following some issues of it being given out, we no longer give out the main curric wifi key, but people use the guest wifi as required, that has a 192.168.0.0 range, so doesn't affect our main domain/dhcp range...

[Trapper]

Do your LEA provide a gateway? In Brum we have CISCO 2500s set up to route traffic out to the MAN, the core proxy servers and ultimately the internet.

 

If they provide all of this, your really don't want to be changing subnet masks - you may end up cutting your users off from LEA resources/the internet.

 

I'd also not arbitrarily pick a new IP range and add it to your DHCP - your LEA may have assigned that to another school and you could cause no end of headaches.

 

If you can't get the LEA to any of this, try VLANing.

[Trapper]

Jim: Brum have plenty of IP ranges left. I've have 5 full address ranges. Four are continuous and were assigned back when BGfL started. The fifth was for our remote site annex and they just pulled a range out for me.

[Guest]

Could you add a Guest Wifi for the gadgets and keep the main wifi for official domain devices? (depending on the policy of whether you give out the wifi key or not I guess)...

 

Following some issues of it being given out, we no longer give out the main curric wifi key, but people use the guest wifi as required, that has a 192.168.0.0 range, so doesn't affect our main domain/dhcp range...

 

we use ruckus wifi equipment. so we already do that. but im aware of us maxing out pretty soon on IPs.

[Guest]

Do your LEA provide a gateway? In Brum we have CISCO 2500s set up to route traffic out to the MAN, the core proxy servers and ultimately the internet.

 

If they provide all of this, your really don't want to be changing subnet masks - you may end up cutting your users off from LEA resources/the internet.

 

I'd also not arbitrarily pick a new IP range and add it to your DHCP - your LEA may have assigned that to another school and you could cause no end of headaches.

 

If you can't get the LEA to any of this, try VLANing.

 

well if the LEA gives us the new IP range then it shouldnt conflct, unless someone out there is using it unofficially. then id superscope them both together. if as you say subnetting will be more of a issue.

 

im not confident in using VLans, so thats not an option right now. will look into it in the near future

[HPlum78]

Just tweaking subnets on your Routers seems a risky business if your provider has not allocated them to you! If this is a truly managed network that they are providing for you I would also say that giving individual schools the keys to the realm seems an erroneous practice to me and if tech departments in and around Birmingham have just been allowed to participate in such activities then it must make for a very flaky network and I guess that this is really not the case.

NAT would seem the way to go here as this then frees you from the shackles of this type of setup, you know where your network starts and the Brum network ends. Anything you do on your side of the NAT is irrelevant to anything past the NAT. This also gives you more scope for managing and securing your own internal network. If indeed external companies need access to internal resources then you have a whole host of available IP’s that you can direct NAT to etc etc.

On the other hand I can see why this type of setup is installed as there is an extra layer of hardware needed in most cases by each school and someone in each school to be available to manage that, so as a cost approach the install is not the wrong way.

 

Note that I am guessing a bit here as I do not know the ins and outs of your individual networks, and it’s a bit like plumbing what makes sense to one don’t always make sense to another! But that does not make any solution wrong or right.

Edited July 11, 2014 by HPlum78

[Guest]

thank you all for your suggestions. i think taking into consideration of support from our LEA Networks team it might just be easier to have another ip range then super scope them together.

 

If we moved away from the LEA Network team support i think it would be plausible to run a NAT within my network. I don't want to over complicate things, and i dont think i would need any more than another 100 ips as for the size of the building and the amount of wireless hardware we have