Setting up a gateway with Comcast, non-static

[ChrisChivers]

I have a client that refuses to spend the $20 for a static IP through Comcast and they want me to install a fortigate 60f in their home office. I’ve set the Comcast XB-7T gateway device to bridge mode, but the Fortigate is not pulling an IP address when the Wan interface is set to DHCP. When the gateway device is not in bridge mode, I get a private IP address (10.0.0.x) on the wan port of the fortigate without a problem, but this puts devices behind the firewall in a double nat situation, which is causing massive network slowdowns (800mb drops to 20mb connection). He also wants to be able to use VPN to access his network from outside (planning on using a DDNS for when the IP changes) as needed, so I need to get this working fit them. I am open to suggestions on what I am doing wrong. I never have these problems when the client gets a static IP. Thank you in advance. - Chris

[lobstercreed]

Have you tried a packet capture to see what's happening in bridge mode?  I'd be going at this from the Comcast angle as their device should be able to hand DHCP downstream, but might need a reboot.  Is it PPPoE maybe?

[ChrisChivers]

They insist it is not PPPoE. Sniffing traffic is a good idea. I'll try that next. 

[jaycenornin]

Old thread is old but dangit this rankles my IT nerd hairs.

NEVER use bridge mode with Comcast.

Comcast/XFinity assigns each BYOD customer two IPv4 addresses, one for the modem (Gateway) and one for the router/firewall. If you purchased a static, Comcast will assign the Gateway IP to your modem and the 1 usable IP they give you is for your edge router. If you don't have a static and are on DHCP, your modem gets issued the gateway IP and relays your public IP to your edge router.

If you're using Comcast's modem, it's an AIO modem/router (which only needs one IPv4 IP and supports IPv6, so bonus points on IPv4 exhaustion). To configure it as a modem only and use your own edge router, you need to leave the Comcast modem in routed mode, but disable DHCP, NAT, and WIFI. If your edge router is a decent firewall, you should also disable the firewall in the Comcast modem. By leaving it in routed mode, you will still be able to access the modem's web UI via its 10.x.x.x LAN-side IP address (as long as you're on the native vlan and not using a conflicting subnet), and you can still run network diagnostics against the modem, but Comcast will issue your edge router a public IP address with your modem as gateway.

Most of these BYO-router-but-still-use-Comcast-modem situations are businesses, and if you're using FortiGate then you're also likely a business. Most business offices have a lot of good reasons to justify getting a static IP and not getting a static will cause a LOT of headaches for IT. If there is legitimately no business case for a static IP, but still a business case for bringing your own edge router instead of just using Comcast's AIO modem/router as your edge, then BYO modem too. An Arris Docsis v3+ modem is cheap and you can pick one up at your local best buy. Saves you the equipment rental fee from Comcast and makes configuration a LOT easier.

(Level 20 bonus feat: I have gotten bridge mode to work - ONCE and never again since. The customer had a static IP and by putting the modem in bridge mode we were able to get two usable IPs out of the /30 that Comcast issued them. This requires knowing the correct gateway address to assign, since the gateway IP Comcast issues you usually goes to the modem (Which comcast configures). If you configure the modem in routed mode first you can sometimes pull that information from the modem's config before you turn on bridge mode. But I emphasize, I only ever got this to work once and it was over a decade ago and I have no idea if it remained stable. Also, having the modem in routed mode allows you to use it for diagnostics - you cannot ping-test a bridged modem to determine if the modem is the point of failure in a service outage. Don't use bridge mode. And ignore Comcast tech support if they say otherwise.)