Networks

Ask something
Discussion Locked

Why Static IPs?

0 helpful
13 replies

by mezdor

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Okay, Here the scoop. We have 2 internal networks. net1 = gov. access. net2 =is local administration.(NOT gov.) I understand the need for static IPs on the Gov side, But why static IPson the other network(the last admin is MIA) and no real documentation. I would like to set the nongov side to have internet access, and only wireless is available. net2 runs peer-to-peer. My question is, could I change all systems to get IPs from DHCP? this would help to get the wireless up. oh net2 static ip is not 192.168.x.x or 10.x.x.x. Its confusing. I thought internal nets should be hidden from the internet. Any suggestions? thanks.

13 replies

by mshavrov

It looks like you are very confused. There are not too big difference, do you use static or DHCP address. Only case when you may need static IP addresses is when you need to have full control on them. It may be security requirement (like on GOV agencies). But in general, you may assign static IP addresses only to servers, and provide users with DHCP addresses. Sure, in case you need to determin whose PC is using one or another IP address you will take a few extra steps.

About using "privateIP addresses" like 10.x.x.x, 172.16.x.x, or 192.168.x.x. Mostly it depends on company. Most of GOV agencies and organizations have big IP networks and they don't need to use "private addresses". The reason to use NAT (Network Address Translation) and private IP ranges is when your company has more users than public IP addresses. Some big companies may have, for example, 16 public IP addresses and 1000 employees. So, they will use 1000 private IP addresses inside and 1-2 translated public address for Internet. Also this "hides" your network infrastructure from outside world.

And now about translation. It may be done on routers or firewalls. So, if you have, for example, wireless network, you may use private IP network range for wireless devices and then translate them to corporate IP addresses.

Good luck.

by mshavrov

Some comments to #2:

When I worked for .GOV, we had STATIC PUBLIC IP addresses for every workstation, server, router link, dial-up connection, local printer, etc. Organization had Class "C" network for every location, even if there was only one-two people with dial-up access. And we supplied this list of addresses to central office. And all of this just because because of security regulations. So, consider using public IP addresses in local LAN as fact.

And now, working for private company, we have 16 IP addresses, we have web servers, mail servers, different appplication servers, etc. But all 1500 inside users are represented in the Internet by only one IP address (using firewall). Inside we have all kind of Private addresses (10.x.x.x, 172.16.x.x, and 192.168.x.x). So, it depends on on your situation and company regulations.

If you have quistions, you may e-mail me.

by curlergirl

Well - I disagree with almost everything answer #1 says, so you can take that for what it's worth.

First, let's be sure we're talking the same language. A static IP address can be either private or public - all "static" means is that it is assigned manually, is specific to that machine and does not change (except maybe once in a very blue moon when you can't get around it).

Private IP addressing is utilized to segregate a private network from a public one. That is, when you don't want the machines in your network to be exposed to the public network (Internet), you use private IP addressing and NAT to achieve this goal. Usually this is done for security reasons, primarily, not necessarily because the company has run out of available IPs in their subnet. This would only happen in the case of a huge web installation, or some type of Internet service provider situation. Other than that, private IP addressing, at least in the U.S., is pretty widespread.

That said, the primary reason to use a static IP address vs. a DHCP-assigned one is to ensure that a specific machine is always quickly identifiable by other machines that need to reach it. In the case of a private IP network, this usually pertains to servers and network-related hardware such as routers, bridges and gateways of various kinds. In the case of a public IP address, this pertains to any machine that you have to be able to reach by name. As a practical matter, basically all servers that are connected publicly to the Internet usually have static IP addresses, unless they are connected simply for the purpose of Internet browsing and are not acting as servers for any kind of web-based applications. Most machines connected to the Internet simply for web browsing are being assigned their IP addresses by a DHCP server run by their ISP.

by curlergirl

As far as your situation, I'm not sure what you mean by saying that the only wireless is available for the Gov side to have Internet access. Not being familiar w/wireless, I can't comment on that specifically. Without more specific info on the exact IP addressing schemes of your two networks, it's hard to say specifically what you should do. But I'd say you can probably use DHCP and private IP addresses for most of these machines, use a NAT router for Internet access, and use static IPs onlyfor the router and any servers that need either private or public IP addresses.

If you don't understand any of this or need further explanation, feel free to contact me by email - synergy@synoffsys.com. Hope this helps!

by isys

My first presumption is you have a firewall up. If so, your internal IP numbering is inconsequential. If not, then your Internet router must be set to not pass net2 addresses.
My second assumption is that both networks share a common physical layer. If so, a DHCP server would provide service to both networks. You probably would not want this to happen.
So far as Internet access, configure your Internet router to net2 and connect it to your wireless AP. Or am I missing something?

by jose_12650

As to whether you can change the IP set up and utilize your DHCP to assign IP addresses for the networks, the answer is YES. If your server is W2K Server, you can configure two subnets and embed them into a superscope. One scope would serve the IP needs of the first network and the other scope, for your second network. In the case of clients with statically assigned IPs, you have to visit each client and configure the system for automatic IP assignment. If you have a router that connects the two networks, make sure that it is RFC-1542 compliant, otherwise, you have to install a DHCP relay agent so your DHCP can serve the other node of the network

by tim.doyle

Two big reasons to use static IP's on any network are speed and security. You will get marginally faster connect times between machines when the IP tables are static, nothing to rebuild on any machines. Another potential reason is physical security...if your switches support it you can enable port security so that only a specific MAC/IP pair can be used from a particular port...if you then lock your workstation down it helps to prevent potential internal security violations since nobody can plug their laptop in and start wailing on your network from the inside.

I'm not sure what to say about the internet solution except that if you use static IP's to help enhance security on the GOV network, good luck getting soemthing like wireless in there.

Internal networks should be hidden from the internet, absolutely. Your firewall (or at least router) should be running NAT which means you have a couple of public IP addresses live on the interent and all the rest of your workstations run an internal "private" ip scheme...these internal IP addresses can be virtually anything with very few exceptions...you can make it 100.0.0.x if you like or 192.186.250.x if thats your preference...it doesn't matter so long as you're running NAT.

This discussion is closed to new replies.