Why is ATT using RESIDENTIAL gateway equipment for businesses

[randomitguy]

So far...not so good.  Like many many many others on the forum, we are having one heck of a time with the 3801HGV installed for U-verse service.  To make a long story short, we are a business with equipment that needs to be accessible to users externally.  We ordered U-verse as a secondary (failover) connection.  We requested a 16 IP block during purchase of service.  ATT installed the beloved 2Wire 3801HGV and the technician admitted he was not trained on "routing" but the 3801 should do the job and that we could call tech support with any issues.  Cool, right?  We got internet service immediately and made plans to implement the connection in the network in the next few days.  When it was time to put it in production, we began to poke around in the 3801 and found that it only supports 1-to-1 routing (even in DMZPlus mode!).  We have made 3 calls to ATT over the last day and a half (each was over 2 hours long) to inquire about the likelihood of the solution working.  The technicians were surprised at the possibility that some one might not want the ATT "router" to handle security, routing, traffic monitoring, attack detection, DHCP, and so on.  To make matters worse, ATT tried 3 times to make me pay TECH360 (or whatever it is called) $99 by transferring me to "Tier 3" just to tell me if there was another device that could work or if I needed to find another solution.   I was also told to connect all of my devices directly to the 2Wire - all 50 of them!!  I reminded the tech that the 2wire 3801 only has 4 LAN ports and that this would be physically impossible, not to mention non-PCI compliant, non-HIPAA compliant, and not a good idea!  I inquired to why I was allowed to purchase a block of 16 IPs when the router could not handle more than 4 connections and I was corrected that the others could be wireless.  MY BAD!  I should connect all of my servers wirelessly.  I bet that fixes all productivity issues internally!!!!  I finally convinced the 6th technician I spoke with to allow me to try another router from ATT.  She said that it was only typically for business use!!  REALLY?!?!  She could not guarantee that it would work for me, but we could give it a try. 

If anyone out there has made the following scenario work, please let me know.  I would be eternally grateful.

Block of 16 Public IPs routed internally to existing network equipment (NOT 1 to 1 IP NAT - we need the entire subnet routed by our equipment)

ATT router --> internal FW (routing, filtering, NAT) --> Internal network devices

[SomeJoe7777 ACE - Geek]

The AT&T 2Wire routers do not have any provision to insert a static route, therefore there is no way to route the block to your existing equipment.

If you need a routed subnet, I suggest a different internet service than U-Verse.

[randomitguy]

Thanks for the response.  I appreciate your candor.  If you noticed in my post, I am aware of the 2Wire router's limitations which prompted the call to support.  Apparently, they offer a "business" device that supports IP passthrough.  The last technician I spoke with stressed that she has successfully installed this new device (I am assuimg Motorola) in customers with 8 or more IPs.  I should be receiving this device early next week.  If it does not work, I agree that another solution is going to be best.  I'll keep the post updated.  Thanks again.

[SnoWake]

Hmmm... I'm feeling fairly confused, and potentially misled, at this point.  As I sit here waiting for the uverse installer to arrive - upgrading my circa 1990s DSL connection - I have to wonder:

I, too, spent HOURS on the phone, just trying to get a straight answer about static IPs.  On my 4th handoff, I finally got to someone who seemed to understand what I was requesting, AND acknowledging that it should be available for residential service, for an additional $15/mo fee.  So far, so good...

Then I asked if this new AT&T gateway would give allow direct, pass-thru connectivity - I just want to connect an ethernet cable directly into the external interface on my firewall:  I'll do all the NAT, IDS, port forwarding, and deeper inside, wireless infrastructure, etc.

My assumption (and request) was that I get a block of 8 (5 usable) static IP addresses with full, unfiltered port connectivity.

I realize this is a little different than the OPs scenario:  I have fewer than 50 servers, but definitely a requirement for inbound (VPN, IMAPS, HTTP/S, SMTP, DNS, etc) connectivity.  Sure hope I don't regret the decision.

[randomitguy]

Well, I wish I had better news. The new " motorola" router arrived today. It was actually a new 2wire router! After giving it the old college try (and my 8th and 9th calls to support/ Tech360 - for pay!!!), I am resigned to the fact that this will not work for me.

By the way, I received a call from a rep from U-verse a couple of days ago who wanted to personally follow up with me and address my concerns. He asked that I call him as soon as the new router arrived. I did, but I never got any further than voicemail. We will have to see if my call is ever returned.

It is my humble opinion that AT&T really needs to revisit this solution for businesses. Shoot, even the box the router came in says, "Advance your home!". This is the only service I have ever encountered that did not allow internal routing if public ranges were ordered. Until this is addressed, I won't recommend the product to my client base for any size business. Might be great for the average home, though.

[TheChef]

> I reminded the tech that the 2wire 3801 only has 4 LAN ports and that this would be physically impossible,

More devices can be attached by using a switch, which is the same thing you are doing by adding the firewall (although there is a lot more functionality provided by a firewall than a switch)..

[TheChef]

> If anyone out there has made the following scenario work, please let me know.  I would be eternally grateful.

As you mentioned, at the current time, only a 1-to-1 relationship between static IP addresses and directly attached devices is supported.

Some users have no problem with this when their firewall itself is assigned one of the static IP addresses and performs NAPT to the other devices.

Which means you were going to do it in some manner anyway as, without NAPT, 16 addresses wouldn't support your 50 devices anyway.

[randomitguy]

Chef,

It will not work..at all.  I spoke with more than 10 ATT technicians, managers, Tech360 reps, etc... and finally they admitted that it cannot be done with either of the 2Wire routers.  Actually, it is not supported at all by ATT.  I made a call to the specialist that coordinated my install, and she stated that her manager told her that if I needed to route multiple IPs internally, I needed to purchase a T1 or an MPLS circuit (already have one, thanks ATT!).  I wanted U-verse for failover, but it had to be routable.  She stated that it was only supposed to be consumer quality and compete with Xfinity.  Unfortunately for ATT, Xfinity will let you route IPs!  I am sorry to be the bearer of bad news, but currently, it can't work.

16 address would more than support 50 machines.  1 address will not support 50 machines in my environment. 

[Wylbur7]

OK, I have the ablility to put a smart switch on this thing to extend to 32 ports. Did anyone stop to consider bandwidth?

If I ask for 8 static IP addresses, shouldn't I expect to get 100BaseT type bandwidth or only 10BaseT level per IP address? And then when I run all those addresses through the 2WIRE unit, am I not then limited to what it can do on one external connection?

Just askin'