1

So in one of our newer facilities they have decided to rent some space to ancillary clinics to run private business’ in. One is moving in this week.

I understand that this is a “Fire Drill” and that we are going to provide internet access to this company…um, sure. So, I can setup a VLAN for them and simply hand them raw internet and pipe it out. They can get their own firewall (now we have a double-NAT due to the fact that we have only five external IP’s in the facility).

Where I get a question is - the contract. I was thinking simply take our contract from our ISP and change the verbiage. “If the internet is out hold harmless…blah blah blah…”.

I can only imagine they do not expect us to do content filtering, UTM or supporting their devices (though we will have to identify all of their Cat5 and put them all on the VLAN from our switches…).

Golf Course agreements…another reason I hate golf…

So, question is - who has a decent ToS contract for acting as an ISP for an internal renter???

9 Spice ups
2

FYI but most firewalls should have a way for you to push one or more IP’s directly through a given port so you don’t need to do any NAT or filtering for them, they can plug their kit into your provided port and then manage everything themselves.

I know Sonicwall can do this as we had to do this for a piece of vendor kit that had to get an external IP and could not go through NAT (stupid requirements and all).

1 Spice up
3

Not on my network. As far as I can see, if it rides on my network, I AM going to sniff it, take it apart, run UTM and web-blocker on it and be able to report on it. Until now…last thing I am going to do is have our team support an SSL cert on a renter who is getting internet (plus, I guess the cost of internet is $100mo built onto the rent). I am already considering bandwidth limiting the VLAN too :slight_smile:

Brave new world…plus, this does not in any way touch on HIPAA, SOx and on and on and on…

4

Get a block of 10 addresses and subnet it out. You can use 5 for the tenants and 5 for yourself. Proxy ARP will get around any uninvolved ISP routing.

This avoids double NAT for both you and your tenants.

Other than that you’ll have to have your tenants get a router that supports BGP or non-NAT routing… and setup routes between your gateway and there’s… Manually setting NAT for their subnets.

5

Another thing worth checking tbh is whether your current ISP contract even allows you to resell its services as it’s possible they forbid this.

3 Spice ups
6

While that may be true, I do not give a rip what the ISP thinks…we are not a “normal” it dept being as we do not always look for problems or reasons to not do something.

I just need verbiage to contractual agree with the tenant for a SLA for practical purposes. If there becomes an issue with NAT, well, they are free to get their own ISP.

The more I read the internal messages about this, I think they may have ordered internet. Typical lead time is +/- six weeks from the local fiber vendor. We may just be a stop gap. If that is the case, I think I still need some documentation as to end goals and cut off dates.

7

Seeing as you already stated that you don’t believe in keeping your end of an agreement, what do you need to do to protect yourself from a tenant like you?

BTW, depending on what country you are in, you may have to register with the government in order to resell internet.

However, all that is moot with the tenant providing their our line. So, from a bridge point of view, I would gift them with the access provided they pay your staff time to setup and tear down.

1 Spice up
8

Correct. I do not give a rip what our ISP thinks being as our primary ISP is our local Govt (mostly with dollars from the Federal Govt). From there we have Comcast and CenturyLink…neither of whom are exactly shining examples of proper business services…

1 Spice up
9

We have this setup with one of our clinics renting space to another practice. Our agreement stipulates that they provide all the equipment to run their clinic ie printers, PCs, wireless and IT services. We only provide the Internet connection for them. We set up a separate firewall that their machines go through and put them on a completely separate VLAN as well to segregate them. As far as we are concerned they aren’t responsible for any internet costs. We didn’t change anything ISP related to accommodate them. They are only using it 1 day a week so the impact is minimal for us.