¶ Overview
Exium’s SASE CyberMesh utilizes a structured approach for IP address allocation within the 172.16.0.0 – 172.31.255.255 (172.16.0.0/12 prefix) IP address space to optimize performance and maintain security. This solution brief outlines the allocation strategy and recommendations for private IP usage.
¶ IP Address Allocation
Exium allocates IP addresses across three distinct subnet pools to ensure efficient management and operation of the CyberMesh architecture:
¶ Remote User Clients:
- A designated subnet pool is reserved specifically for allocating IP addresses to remote user clients. This setup supports secure and efficient connectivity for users accessing resources within the CyberMesh.
¶ CyberMesh Control Plane:
- Another subnet pool is reserved for the CyberMesh control plane. This layer manages the overall orchestration and management functions within the SASE framework, ensuring consistent performance and reliability.
¶ CyberMesh Data Plane:
- A separate subnet pool is allocated for the CyberMesh data plane, which handles the data traffic flow.
- Within this pool, specific IP addresses are earmarked for critical functions:
- An IP address ending in .100 serves as the DNS server for remote users, facilitating name resolution for access to various services.
- An IP address ending in .200 is dedicated to displaying the webpage block/splash page for users when necessary.
¶ Recommendations for Customer Private Networks
Exium advocates for the use of specific RFC1918 subnets within customer private networks to ensure compatibility and minimize potential conflicts:
- 10.0.0.0 – 10.255.255.255 (10/8 prefix)
- 192.168.0.0 – 192.168.255.255 (192.168/16 prefix)
These private IP ranges are widely accepted for internal network architecture and help to maintain secure segmentation.
¶ Avoiding IP Overlap
In scenarios where utilizing the 172.16.0.0 – 172.31.255.255 (172.16.0.0/12 prefix) subnet is unavoidable, Exium strongly recommends avoiding IP address overlap with those used by the CyberMesh. Proper planning and allocation within this private range are crucial to ensure seamless operation and prevent connectivity issues.
¶ Accessing Private IPAM:
- Navigate to the MSP admin console : Go to "Companies" and select the desired company name, or access the Customer/ Client Workspace Sign In directly.
- Click on “Configurations” followed by “Private IPAM”
- Check all the subnets used by the CyberMesh as shown in the screenshot below.
- In rare cases where you have no choice but to use one of the subnets used by Exium for your internal private network, contact Exium at support@exium.net.
¶ Conclusion
By adhering to these IP address allocation guidelines and recommendations from Exium, organizations can ensure a robust, secure, and efficient networking environment within their private infrastructure, aligning with the operational capabilities of Exium’s SASE CyberMesh. Careful planning and implementation of these standards will foster enhanced connectivity for remote users while safeguarding critical resources.
To learn more about implementing SASE, XDR, IAM/ MFA, and GRC for your organization and explore tailored solutions that meet your unique requirements, contact Exium at partners@exium.net for a consultation or demonstration. If you are ready to get started, check out our testing and onboarding process.