Attempting to set up a new NVR for an existing AV client, I did not immediately see all the existing cameras populate. Looking into the network, all the devices in this AT&T network have public IP addresses, starting with 76.xxx.

Is this commonly done, and what are the pros and cons?

And those addresses are in the same range as the gateway address?

The NVR needed port forwarding, or is it a virtual NVR? Are the cameras security-protected in any way?

Whose products (brand/model) are these?

DOes not make any sense at all. I cant believe at&t would allow multiple WAN Addresses on a private network.

What Router/Gateway is it? What is the address of that? Who installed the cameras?

Agree with everyone above.
What you are typing doesn't make any sense. Need a LOT more information about what is going on here and the setup.

AT&T gateway, looks like the standard home gateway that normally is at 192.168.1.254.

Finged the network and 6 or 7 devices started with 76.xx…

I left when the client was unavailable to give me network and NVR passwords.

You said the AT&T gateway is 'normally' at 192.168.1.254.
You scanned the network, what 'was' the AT&T router at? Was it default or was it also in the 76.xx range?

Where did you take your port scan from? Was it wireless on the AT&T WAP built into the router? Or a wired connection from somewhere?

I'm assuming you looked and there are no additional switches or extenders anywhere, since you did not mention that. NVR is wired directly to the AT&T router then.

Assuming you got all the details right, I would conclude the router has been grossly misconfigured. After you get the passwords for everything, I would factory reset the AT&T gateway/router and go from there (start from scratch). Should be a small reset button somewhere you hold for a minute or two.

On-site now.

AT&T business says customer is paying for a static IP address.

I did a wireless scan. NVR of course is wired through a simple 8 port Luxul switch.

Details to follow.

Because he's paying for a Static IP address, they are doing no NAT what-so-ever? And handing out WAN IPs to everything that connects to the network?
1st, WTF!
2nd, could the people at AT&T become any more stupid!

I'm not sure what has been discussed with your client. What you are actually being hired to do. And what kind of pricing has been discussed.
But now that the discovery part of the job is over, a sit down and discussion about what needs to happen and the price (estimate) has to begin.
1) Network: He needs to purchase an actual usable network from you. Router, switch, WAP, etc.
2) The CCTV: You didn't say if you are selling the NVR and what brand and brand of cameras are involved. If it is stuff you have not worked with before and/or a mix of brands; you should be aware that even if something is ONVIF compliant, doesn't mean it WILL work with a particular product. You could be walking into a "gotcha" if you're not careful.

that doesnt sound right either. if they have WAN addresses on every cameras.. that would be hundreds of dollars a month just in static fees.

Static just means your WAN address to the modem never changes. I've never seen them issues static WAN Addresses for individual devices on the network.

you said you were replacing an NVR? what was the address of the old one? Do the cameras plug directy into the NVR or are the into a switch?

I've seen Comcast do this before on a business account that was paying for Static IP.
When I called about the customer's account, Comcast said they get up to 10 static addresses for the service. And for whatever reason, they handed out 9 public IP addresses for the 9 devices the customer had at the time.
I educated the customer a little on DDNS services. We dropped the static IP service, saving him a ton of money. And I set up a new network for him that got everything working the way he needed with all the new devices and equipment.
Comcast has some really dumb people working at their tech departments too.

When did ISPs start handing out addresses to devices behind the router?

That customer was about 10-12 years ago. It was the 1st time I had seen them do that and the last time.
(at that time) The person on the phone from Comcast had indicated they did that all the time for business customers paying for static IP. I think it was something just them and a few others were doing. Until someone in Comcast management noticed and a hammer came down on them for setting systems up like this. And some re-education took place.

This is a classic can you help a friend situation. After I talked to AT&T, the gateway (unreachable via its IP address) began passing local addresses starting with 172.16.1.xxx. The LTS/Hikvision passed its own addresses to each camera. LTS tech-support is phenomenal, and was able to remote in and get all the cameras working.

I got him up and running but know I don’t have good troubleshooting skills for this.