memory: ESH back on the Cityside static (confirmed four ways); lv-hemingway left as-is per operator

2026-09-17 15:53:11 -07:00
parent 3ac13c5351
commit 9a1c028b9f
2 changed files with 36 additions and 7 deletions
@@ -38,4 +38,31 @@ trusthost3 = `128.177.138.182`, so logins to ana-gw from ESH are refused. The do
 (`direct 23.164.40.174:41641`), which is why latency read 9 ms rather than a DERP figure. An
 expectation of relay-on-CGNAT was wrong.

+## RESOLVED 2026-09-17 ~12:30 PT — the static is back, confirmed on four axes
+
+Not one check, because egress alone cannot tell a static WAN from a carrier NAT that happens
+to answer (see auto-memory `feedback_egress_ip_cannot_detect_cgnat`):
+
+```
+config     UDM WAN1 `wan_type = static`, ip 128.177.138.182, mask /30, gw 128.177.138.181
+           — switched BACK from the DHCP the operator set at 20:11 during the outage
+active     stat/health: isp_name "Cityside Fiber", ASN 18731, num_disconnected 0.
+           WAN2 Verizon-5G is failover-only at priority 2 and idle.
+egress     esh-docker-vm sees 128.177.138.182 — EQUAL to the WAN ip, so not behind CGNAT
+perf       2005/2142 Mbps symmetric; colo -> ESH 5.0 ms, 0% loss over 4 hosts-worth of pings
+           (Cityside CGNAT read 9 ms, Verizon failover 33-37 ms)
+```
+
+⭐ **The FortiGate pin un-broke itself and that was verified, not inferred.** `infra-ops`
+trusthost3 is `128.177.138.182`; from esh-docker-vm, ana-gw `tcp/22` is OPEN and the
+FortiGate offers a password prompt rather than dropping the connection — a trusthost
+mismatch refuses outright, so reaching auth *is* the trusthost passing. The dormant
+`esh-ana` IPsec bind to wan1/static is correct again (still disabled, still no impact).
+
+⚠ **The crowdsec temporary allowlist entries are being LEFT to expire on their own**
+(2026-09-23): `97.190.18.88` Verizon and `23.164.40.174` Cityside CGNAT. Cityside failed
+twice in six hours on 09-17, so until the line has earned some confidence those two are
+cheap insurance against the exact false-ban blackout this rotation-fragility caused before.
+`128.177.138.182` stays never-expiry.
+
 Related: [[2026-09-06-headscale-cutover]], [[2026-09-08-esh-static-wan-followups-and-ytvc]].