"Connection Pro" LTE Failover, CGA4131COM, Static IP, Bridged Mode, & pfSense Router/FW

I'm interested in upgrading my existing Comcast Small Business service to a higher tier that supports "Connection Pro" LTE failover. I’m hoping someone here can help me understand what I’m getting into before I commit to anything.

My current sales person is telling me a tech will come out, plug in the LTE “Connection Pro” device to my CGA4131COM, a miracle will occur, and I’ll have LTE failover. I’ll gladly eat crow if this is true but I’m skeptical at best.

Very respectfully to the Comcast employees here, I was recently burned after retiring my old faithful SMC. When I upgraded to 150/15, sales definitively assured me the CGA4131COM could be put into "true bridge-mode” into my firewall/router with a static IP. That’s not how it panned out. Note that the tech who came on site was very helpful, patient, smart, friendly, and we just happen to attend the same church but he only understood what I was trying to accomplish at a high level and ultimately couldn’t implement the solution I was promised. It turned into a 5+ hour painful ordeal. My goal here is to avoid having this happen again.

Please note my background is IT security, not networking. Everything I know has been learned through trial and error. Please forgive any incorrect nomenclature and/or other ignorance. I’m open to any and all constructive criticism.

Here's my current architecture:

Internet –> CGA4131COM –> pfSense w/Static IP –> JGS524PE | JGS524Pev2/Unifi/VLANS | Dedicated Home Office Port/DMZ

And in more detail:

CGA4131COM – Set to "Disable all rules and allow all inbound traffic through", WAN DHCP disabled, 1-to-1 NAT disabled, firewall disabled, customer security enabled with "Disable entire firewall". Ethernet port 1 is connected to my firewall. Turning on “bridge mode” breaks everything, but that’s another conversation.
Static IP is assigned to My Firewall / Router – 4 Port Qualcom pfSense 2.4.5 with all the goodies (Suricata, pfBlockerNG, Squid Reverse Proxy…)

Port0 is WAN connecting to the CGA4131COM and is currently the only current route in/out of the network.
Ports 1 and 2 are broken up into approximately 15 vlans across a JGS524PE and JGS524Ev2.

The JGS524E powers 3 UniFi AP-AC-Pro WAPs

Port 3 is completely isolated, dedicated to a home office corporate connection and can’t be touched.

I suspect making the “Connection Pro” LTE device work will require a dedicated port on the pfSense box (I've got freeing up a port under control) and creating a new failover route more or less per the article below. Am I correct?

https://protectli.com/kb/how-to-configure-pfsense-ce-for-4g-lte-failover/

Thanks in advance for taking the time to look this over. Any advice or suggestions you could provide would be greatly appreciated. Knowledge is power.

Tagging Comcast_Phil as he's helped me in the past.

Responses

Comcast_JosephA

Official Employee

•

276 Messages

5 years ago

Hello, how are you? I hope your Monday night is going well. I appreciate your detailed message and I will be happy to help. Is your service now working properly with the new modem? Let me take a closer look at your service and equipment so I can provide you with accurate support. Are you able to send a private message with your name, address, and account phone number?

0

Timmay_CO

New Contributor

•

8 Messages

5 years ago

I sent overe my info. Regarding whether or not the current service is working properly, my primary concerns are double NAT and having another potential entry vector into my network. I provided more details in the PM.

0

Comcast_JosephA

Official Employee

•

276 Messages

5 years ago

I appreciate the heads up. I have looked for a private message and I apologize, I don't see a recent one with your account information in it. Our aim is to make sure we cover the Comcast service side of your questions and concerns. It sounds like your modem is configured properly for you to use your own personal firewall. If I can get your account information I can collaborate with your sales specialist so we can get you more details about installing Connection Pro and I will make sure your modem is online with a good connection. My support with how installing Connection Pro will affect your network will be a little more limited but I will assist you as thoroughly as I possibly can.

0

Timmay_CO

New Contributor

•

8 Messages

5 years ago

Hi Joseph - Would you please let me know what's going on with this? I haven't heard back from you in a couple of days.

0

Comcast_JosephA

Official Employee

•

276 Messages

5 years ago

Hello, I will be happy to assist you further. I will need a private message to take a closer look at your account.

0

Timmay_CO

New Contributor

•

8 Messages

5 years ago

I've sent you a few private messages. Would you please try to send me one?

https://imgur.com/a/rk6QXJ7

0

CC_RobertC

Problem solver

•

144 Messages

5 years ago

Hi there! I'm so sorry for the delay. During this time, we are doing our very best to make sure we respond to you as soon as possible. Thanks so much for reaching out. You've absolutely reached the right place, and are in good hands. I will own this Issue for you and ensure that I provide the best help I can today. Are you available to continue with the troubleshooting?

0

Timmay_CO

New Contributor

•

8 Messages

5 years ago

Sure. What info do you need?

0

CC_Gina

Gold Problem solver

•

421 Messages

5 years ago

Hey Timmay_CO! I sent a private message so I hope you are able to see it and respond there, but I also want to ensure that I am providing you and the rest of our forums members some information about this in a public thread.

True bridge mode cannot be used with a static IP and it sounds like static IP(s) are pretty vital to your current configuration, which may be an issue since Connection Pro will only work with devices that use a dynamic IP. You can still have a static IP, but devices that utilize one will NOT be supported by the 4G LTE network backup; it's really meant to support devices such as POS systems, credit card machines, etc. I will caveat by saying that we do have a specialized team for the Connection Pro product, so more in-depth questions might be best answered by them.

I hope this helps and to hear back from you in private message if you'd like for us to contact them for further information 🙂

0

Timmay_CO

New Contributor

•

8 Messages

5 years ago

Comcast_Gina - Between you and the last 2 Comcast_* people who've tried to help, I've sent 5 PMs. I don't know where the private messages are going or if there just being ignored because my request is going to create a mess. Whatever the case, this is getting very frustrating.

My interest in LTE is twofold:

1 - My current Alarm system provider is going out of business. Moving to a new provider will require purchasing new hardware. Most of the offerings want to sell me a solution that requires LTE backup. I like the idea of LTE backup for the alarm, so why not our whole network? I certainly don't want to pay for 2 LTE devices.

2 - My Comcast Business connection is primarily for my wife's home office and my (completely unrelated and separate) small business. My wife is 100% remote and she holds an important role in her company, I'd like her to be able to stay connected in an outage. As long as my wife is able to maintain a stable VPN connection during a failover and keep working, I don't care about the static for my mail server. It'll come back when the outage is over like normal.

0

CC_Gina

Gold Problem solver

•

421 Messages

5 years ago

I see the private message! I'm sorry it's been so frustrating but it looks like it's working now so I'll meet you there 🙂

0

Timmay_CO

New Contributor

•

8 Messages

5 years ago

Is anybody actually still working on this?

I'll concede this isn't a plain vanilla install, but it's not rocket science. It's more like rocky-road. Comon, Comcast. There's gotta be someone who can answer this?

Tim

0

CC_RobertC

Problem solver

•

144 Messages

5 years ago

Thanks for getting back to us, Tim. We want to make sure we resolve any concern you have. The last communication we had with you was 6 days ago, and I see you had mentioned that you're finally connected. Can you give me a brief summary if the issue that you still have concerns about? If you would like, you can send us a private note, and we can continue?

0