claudetools/clients/tohono-oodham-doit/session-logs/2026-05-27-session.md

Session Log: 2026-05-27 — Tohono O'odham Nation DoIT

User

• User: Mike Swanson (mike)
• Machine: GURU-5070
• Role: admin

Session Summary

Created Syncro ticket #32328 for Tohono O'odham Nation - Department of Information & Technology (DoIT) — "Request for Starlink Static IP options" — to track a site-to-site VPN design question. The client runs 2× Check Point 1550 appliances, each behind its own Starlink Roam Unlimited connection (Starlink in bypass mode, so each 1550 pulls the WAN IP directly). They asked about getting a Starlink static IP to enable a site-to-site VPN between field sites and the main office.

Researched the design (web-verified). Findings: Starlink Roam offers no static IP on any plan and is CGNAT by default; bypass mode removes Starlink's own NAT but still hands the 1550 a CGNAT 100.64.x.x address, not a public IP. The Check Point 1550 (Gaia Embedded) supports native IPsec site-to-site but cannot run Tailscale/ZeroTier (closed appliance; doing so is unsupported and voids support) and has no built-in overlay/relay for CGNAT traversal.

Mid-session Mike clarified two facts that reframed the design: the field Starlinks are in bypass mode (no Starlink NAT), and the main office is NOT on Starlink — it has public static IP(s) (office gateway hardware unconfirmed, assumed Check Point). That makes this not a dual-CGNAT problem — it's CGNAT field spokes dialing into a reachable public hub, which is solvable cleanly.

Posted a customer-visible, emailed note (comment 413414183) to #32328 presenting two options: (A) native Check Point IPsec hub-and-spoke — field 1550s initiate IPsec outbound to the office public IP, using existing hardware, no overlay; cleanest if the office gateway is also Check Point; and (B) Tailscale overlay — a subnet-router node behind the office firewall plus a small node (GL.iNet Beryl AX/Flint 2, or pfSense/Linux) at each field site, traversing CGNAT via NAT-traversal + DERP relays. Both avoid the expensive Starlink High Performance / Priority upgrade. Documented the dependency: office internal IT must approve/build the entrypoint, and the office gateway make/model must be confirmed.

Key Decisions

• Posted both options rather than committing to one — Mike's call; lets DoIT's IT weigh the lighter-touch native IPsec path vs. the more flexible Tailscale overlay.
• Customer-visible + emailed (not internal) — Mike chose to send the options directly to DoIT (technical audience; primary contact Shannon Ramon).
• Recommended skipping the Starlink HP/Priority upgrade — a reachable office hub means a static Starlink IP isn't needed for either option.
• do_not_email: true on ticket creation but email on the options comment — avoided notifying the customer at create time while we formulated the response, then emailed the substantive note once ready.

Problems Encountered

• Initial assumption was dual-CGNAT (both ends behind Starlink), which would have forced an overlay-only (Tailscale/ZeroTier) answer. Mike's clarification that the office has public static IPs reframed it to CGNAT-spoke → public-hub, which also enables a native IPsec hub-and-spoke option. Note rewritten to present both.

Configuration Changes

• No repo code changes for this client. This session log seeds the new clients/tohono-oodham-doit/ folder (no prior client folder or wiki article existed).

Credentials & Secrets

• No new client credentials. Syncro API used Mike's per-user key (already vaulted at msp-tools/syncro.sops.yaml).

Infrastructure & Servers

• Customer: Tohono O'odham Nation - Department of Information & Technology (DoIT). Syncro customer_id 33069069. Primary contact: Shannon Ramon (shannon.ramon@tonation-nsn.gov). No prepaid block.
• Field sites (x2): Check Point 1550 appliance each, behind Starlink Roam Unlimited, Starlink in bypass mode → 1550 holds the WAN IP directly, but it's CGNAT 100.64.0.0/10 (no public/static IP on Roam). Verify on-site: each 1550's WAN IP should read 100.64.x.x.
• Main office: NOT Starlink — public static IP(s). Gateway hardware unconfirmed (assumed Check Point, model TBD). This is the reachable VPN hub.
• Other Tohono O'odham Syncro accounts (do not confuse): Legislative Branch (35323240), Farming Authority (33405788), Sif-oidak District (7694718). This work is the DoIT account only.
• Design building blocks: Tailscale traverses CGNAT via NAT-traversal + DERP relays (443). Candidate field nodes: GL.iNet Beryl AX (GL-MT3000) / Flint 2 (GL-MT6000) with native Tailscale, or pfSense/OPNsense (Tailscale package + subnet routing).

Commands & Outputs

• Customer lookup: GET /customers?query=Tohono → DoIT = id 33069069.
• Ticket create: POST /tickets (customer_id 33069069, problem_type "Service Request", priority "2 Normal", user_id 1735, do_not_email true) → #32328, id 111209848, status New.
• Options note: POST /tickets/111209848/comment (hidden false, do_not_email false) → comment id 413414183. Bot alert posted.

Pending / Incomplete Tasks

• Ticket #32328 left in status New — asked Mike whether to set "Waiting on Customer" (pending his answer).
• Awaiting DoIT internal IT: approve and build the VPN entrypoint — either configure the office gateway as the IPsec hub (Option A) or stand up/permit the Tailscale node (Option B).
• Confirm office gateway make/model.
• On-site verification: confirm each field 1550's WAN IP is 100.64.x.x (CGNAT). If a 1550 shows a real public IP, they may already have a Starlink public-IP add-on, which changes the calculus.

Reference Information

• Ticket: #32328 (id 111209848) — https://computerguru.syncromsp.com/tickets/111209848 — comment id 413414183.
• Research sources: CheckMates "Tailscale on GAiA" thread; Starlink CGNAT / static-IP explainers (StarlinkInsider, HostiFi); Tailscale NAT-traversal + DERP + site-to-site docs; pfSense/OPNsense Tailscale subnet-router docs.
• Skill used: /syncro (.claude/commands/syncro.md).

---

Update: 11:04 PT — #32328 status

Set #32328 to Waiting on Customer (PUT confirmed; bot alert posted) after posting the customer-visible options note. Now awaiting DoIT internal IT's decision on the VPN entrypoint (Option A native Check Point IPsec hub-and-spoke vs Option B Tailscale overlay) and the office gateway make/model.