memory: ESH static WAN follow-ups landed — FortiGate trusthost3 → 128.177.138.182 (verified from ESH), esh-ana IPsec rebound to wan1, UDP 41641 forward → esh-scale peers direct

2026-09-08 13:45:13 -07:00
parent 7d5de53565
commit a19b7f62d9
2 changed files with 11 additions and 7 deletions
@@ -14,7 +14,7 @@ follow-ups in `docs/pfi/headscale-mesh-plan.md` § CUTOVER EXECUTED. Headlines:
  orchestrated). Routes PRE-STAGED + shadowed; DERP path 9ms ready. **Operator disables it in
  the UniFi UI**, then the mesh takes over. Told the operator "mesh is online" → he does it.
 - **FortiGate WAN SSH safety net (TEMPORARY):** wan1 allowaccess ping+ssh; admin infra-ops
-  trusthost2/3 = NH3 70.230.226.88 + ESH 23.164.40.160 (not 0.0.0.0). Reach it at
+  trusthost2/3 = NH3 70.230.226.88 + ESH **128.177.138.182** (static since 09-08; was CGNAT 23.164.40.160) (not 0.0.0.0). Reach it at
  `ssh infra-ops@38.120.12.42`. Config backed up flash `pre-wan-ssh-cutover-20260906`. Remove
  when the edge (being replaced by OPNsense/R420) is retired.
 - ⚠ **Method lesson:** tunnel + mesh static route for the same /16 on one gateway = asymmetric