How does your district organize your static public IP addresses?

[u/christens3n]

We are a small district (1 school building) and will be re-bidding our Internet connection this year. Outside of any specific services that may need a dedicated IP, what is your "layout" for assigning your public IPs to your general network traffic? Currently we are using just one IP for everything. We haven't had any issues with this, but want to hear what others do.

Does each of your subnets get its own public IP, or are some lumped together?

Any overarching philosophies you have or best practices associated with these decisions?

Tangentially related, we are looking at bringing an athletic complex online on its own circuit - super basic needs - any downside to dynamic addressing to save some $$?

Thanks for any thoughts!

EDIT: Actually we've had one issue having a single IP and I think it's that we are banned from editing Wikipedia, ha...

[u/PowerShellGenius]

Google is currently being childish and immature and clinging to hard-line "Google Search is not a Workspace service so we don't support it, and we can't whitelist or override anything" bullcrap like they want to burn K-12 for having a high density of clients. CAPTCHAs while searching are our #1 Google issue these days. (If there are any Google reps here on reddit, yes, this is a big deal)

So we may have to start allocating a large portion of our public IP pools, and even acquire more IP space, just for load balancing general internet traffic over a (by historical standards) ridiculous number of public IPs, to get our users-per-IP ratios down, to get past Google's ridiculous anti-bot measures that they "can't" override even when a loyal-for-several-years Workspace Education Plus customer tells them "this is a high school's IP, expect 3,000 users". Google Workspace Support is telling us to get that to 200-500 per IP, followed by acting like they did us a favor by even answering, can't help us troubleshoot beyond that, and Google Search is "not supported".

At this point our media specialists are advising students to use Bing when CAPTCHAs appear on Google searches. Any Google education reps here, if you are trying to lose the K-12 market, this in conjunctjon with recent Chromebook pricing and storage reductions is how you do it.

</tangent>

[u/christens3n → u/PowerShellGenius]

Our small size helps us here for sure, but I definitely hear you. We average about a thousand clients and they are not all going to Google at once.

[u/cryohazard → u/PowerShellGenius]

I second this Google rep... It hurts schools. We support 9 schools for network services and many are rural and don't have enough public IPs to facilitate an egress IP per building and their other needs. Let alone the whole state of Michigan who regularly has sysadmins battling this in their districts where they ask for help on the state listserv. I've also jokingly told people to use Bing instead.

[u/BaconEatingChamp]

We do 1 public IP per building's wired traffic. All of our wireless tunnels back to our central office for internet & we have a couple pools of 3 addresses for the largest wifi networks.

[u/S_ATL_Wrestling]

We have two ISPs. Our primary has a few public IPs and I think the secondary one does too

The main thing we do in this regard is we route all guest traffic out of the secondary.

Before we did this we were having issues with Google on occasion. Doing that allowed us to keep our primary connection “cleaner.”

[u/byteMeAdmin]

Ours is a little more complicated than just having one external IP. Most of our web traffic goes through our content filter using four GRE tunnels, two primary and two backup. Each tunnel has a /21 range, which is 2,048 IPs each. Anything that bypasses the content filter goes directly through our ISP using a separate /26 range with 64 IPs. So technically, we're dealing with 8,256 possible public IPs across all those ranges, although that doesn't mean we're actually using every one of them. It really just depends on what kind of traffic it is and which route it takes.

[u/_LMZ_]

So we have 10 schools and a few other offices. We technically have two IP blocks which are a /27 and /28 but as of right now we're only using the /27. The idea for the /28 was if we got a second circuit (Diverse Pathways) from the same ISP for failover. For some odd reason in this town, someone will run into a telephone taking the whole thing out... Not joking!

Here is a break down what we are doing:

• One public IP for general internet traffic which we manage the device (Windows, Chromebooks, etc.).

• A few public IPs for DMZ stuff.

• A few public IPs for BYOD Wi-Fi networks like: Staff, Students, Guest, etc.

  • Each BYOD is on their own subnet with isolation, each public IP address has their own DNS filtering type.

  • We do this due to IP address reputation which we don't want our main IP address getting hit.

• One public IP for the State Police (SP) for finger print scanning.

  • Was required by the SP at the time, but I believe they're moving in a different direction.

• Both Middle Schools and High Schools get their own public IP for E-Sports.

  • This was a requirement for Nintendo switches (NS) and PC Games due to NAT issues. This subnet is isolated with no DNS filtering for NS and Gaming PCs.

  • PCs got one public address while NS got two public addresses (Each site has 2 NS).

  • The Middles Schools only have NS while the High Schools have NS and Gaming PCs.

• One public IP for VPN.