Mike Swanson
0c3c659903
- Quantum (new client log): pulled Sheila's email via Graph, posted Intermedia->M365 migration update (emailed), set #32323 In Progress - Root: /mailbox skill (ACG M365 read + gated send-as) built, verified, distributed (f8c00d3); autotask.md gitignored (b22de6c) - Tohono: #32328 -> Waiting on Customer Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
69 lines
6.3 KiB
Markdown
69 lines
6.3 KiB
Markdown
# Session Log: 2026-05-27 — Tohono O'odham Nation DoIT
|
||
|
||
## User
|
||
- **User:** Mike Swanson (mike)
|
||
- **Machine:** GURU-5070
|
||
- **Role:** admin
|
||
|
||
## Session Summary
|
||
|
||
Created Syncro ticket **#32328** for Tohono O'odham Nation - Department of Information & Technology (DoIT) — "Request for Starlink Static IP options" — to track a site-to-site VPN design question. The client runs **2× Check Point 1550** appliances, each behind its own **Starlink Roam Unlimited** connection (Starlink in **bypass mode**, so each 1550 pulls the WAN IP directly). They asked about getting a Starlink static IP to enable a site-to-site VPN between field sites and the main office.
|
||
|
||
Researched the design (web-verified). Findings: Starlink **Roam offers no static IP on any plan** and is **CGNAT by default**; bypass mode removes Starlink's own NAT but still hands the 1550 a **CGNAT `100.64.x.x`** address, not a public IP. The **Check Point 1550 (Gaia Embedded)** supports native IPsec site-to-site but **cannot run Tailscale/ZeroTier** (closed appliance; doing so is unsupported and voids support) and has no built-in overlay/relay for CGNAT traversal.
|
||
|
||
Mid-session Mike clarified two facts that reframed the design: the field Starlinks are in **bypass mode** (no Starlink NAT), and the **main office is NOT on Starlink — it has public static IP(s)** (office gateway hardware unconfirmed, assumed Check Point). That makes this **not** a dual-CGNAT problem — it's CGNAT field spokes dialing into a **reachable public hub**, which is solvable cleanly.
|
||
|
||
Posted a **customer-visible, emailed** note (comment `413414183`) to #32328 presenting **two options**: (A) native Check Point IPsec hub-and-spoke — field 1550s initiate IPsec outbound to the office public IP, using existing hardware, no overlay; cleanest if the office gateway is also Check Point; and (B) Tailscale overlay — a subnet-router node behind the office firewall plus a small node (GL.iNet Beryl AX/Flint 2, or pfSense/Linux) at each field site, traversing CGNAT via NAT-traversal + DERP relays. Both avoid the expensive Starlink High Performance / Priority upgrade. Documented the dependency: office internal IT must approve/build the entrypoint, and the office gateway make/model must be confirmed.
|
||
|
||
## Key Decisions
|
||
|
||
- **Posted both options rather than committing to one** — Mike's call; lets DoIT's IT weigh the lighter-touch native IPsec path vs. the more flexible Tailscale overlay.
|
||
- **Customer-visible + emailed** (not internal) — Mike chose to send the options directly to DoIT (technical audience; primary contact Shannon Ramon).
|
||
- **Recommended skipping the Starlink HP/Priority upgrade** — a reachable office hub means a static Starlink IP isn't needed for either option.
|
||
- **`do_not_email: true` on ticket creation** but **email on the options comment** — avoided notifying the customer at create time while we formulated the response, then emailed the substantive note once ready.
|
||
|
||
## Problems Encountered
|
||
|
||
- **Initial assumption was dual-CGNAT** (both ends behind Starlink), which would have forced an overlay-only (Tailscale/ZeroTier) answer. Mike's clarification that the office has public static IPs reframed it to CGNAT-spoke → public-hub, which also enables a native IPsec hub-and-spoke option. Note rewritten to present both.
|
||
|
||
## Configuration Changes
|
||
|
||
- No repo code changes for this client. This session log seeds the new `clients/tohono-oodham-doit/` folder (no prior client folder or wiki article existed).
|
||
|
||
## Credentials & Secrets
|
||
|
||
- No new client credentials. Syncro API used Mike's per-user key (already vaulted at `msp-tools/syncro.sops.yaml`).
|
||
|
||
## Infrastructure & Servers
|
||
|
||
- **Customer:** Tohono O'odham Nation - Department of Information & Technology (DoIT). Syncro `customer_id 33069069`. Primary contact: Shannon Ramon (shannon.ramon@tonation-nsn.gov). No prepaid block.
|
||
- **Field sites (x2):** Check Point 1550 appliance each, behind Starlink **Roam Unlimited**, Starlink in **bypass mode** → 1550 holds the WAN IP directly, but it's **CGNAT `100.64.0.0/10`** (no public/static IP on Roam). Verify on-site: each 1550's WAN IP should read `100.64.x.x`.
|
||
- **Main office:** NOT Starlink — **public static IP(s)**. Gateway hardware unconfirmed (assumed Check Point, model TBD). This is the reachable VPN hub.
|
||
- **Other Tohono O'odham Syncro accounts (do not confuse):** Legislative Branch (35323240), Farming Authority (33405788), Sif-oidak District (7694718). This work is the **DoIT** account only.
|
||
- **Design building blocks:** Tailscale traverses CGNAT via NAT-traversal + DERP relays (443). Candidate field nodes: GL.iNet Beryl AX (GL-MT3000) / Flint 2 (GL-MT6000) with native Tailscale, or pfSense/OPNsense (Tailscale package + subnet routing).
|
||
|
||
## Commands & Outputs
|
||
|
||
- Customer lookup: `GET /customers?query=Tohono` → DoIT = id 33069069.
|
||
- Ticket create: `POST /tickets` (customer_id 33069069, problem_type "Service Request", priority "2 Normal", user_id 1735, do_not_email true) → `#32328`, id `111209848`, status New.
|
||
- Options note: `POST /tickets/111209848/comment` (hidden false, do_not_email false) → comment id `413414183`. Bot alert posted.
|
||
|
||
## Pending / Incomplete Tasks
|
||
|
||
- **Ticket #32328 left in status New** — asked Mike whether to set "Waiting on Customer" (pending his answer).
|
||
- **Awaiting DoIT internal IT:** approve and build the VPN entrypoint — either configure the office gateway as the IPsec hub (Option A) or stand up/permit the Tailscale node (Option B).
|
||
- **Confirm office gateway make/model.**
|
||
- **On-site verification:** confirm each field 1550's WAN IP is `100.64.x.x` (CGNAT). If a 1550 shows a real public IP, they may already have a Starlink public-IP add-on, which changes the calculus.
|
||
|
||
## Reference Information
|
||
|
||
- Ticket: #32328 (id 111209848) — https://computerguru.syncromsp.com/tickets/111209848 — comment id 413414183.
|
||
- Research sources: CheckMates "Tailscale on GAiA" thread; Starlink CGNAT / static-IP explainers (StarlinkInsider, HostiFi); Tailscale NAT-traversal + DERP + site-to-site docs; pfSense/OPNsense Tailscale subnet-router docs.
|
||
- Skill used: `/syncro` (`.claude/commands/syncro.md`).
|
||
|
||
---
|
||
|
||
## Update: 11:04 PT — #32328 status
|
||
|
||
Set #32328 to **Waiting on Customer** (PUT confirmed; bot alert posted) after posting the customer-visible options note. Now awaiting DoIT internal IT's decision on the VPN entrypoint (Option A native Check Point IPsec hub-and-spoke vs Option B Tailscale overlay) and the office gateway make/model.
|