topic Re: Multiple IP address affected to L3 interface in General Topics

Multiple IP address affected to L3 interface

Gregoux — Fri, 04 Oct 2013 08:21:28 GMT

Hello All

Somebody know why

When You add 2 ip address from the same subnet to the same interface Layer 3 ex ;

ip 1 : 12.52.36.2/29

ip 2: 12.52.36.3/29

you obtain an error lijke subnet overlaping

to solve that you need to declare one IP in the subnet /29 and the other in subnet /32

like IP 1: 12.52.36.2/29

and IP 2: 12.52.36.3/32

thank

Re: Multiple IP address affected to L3 interface

kadak — Fri, 04 Oct 2013 18:18:13 GMT

Hello Greg,

That is an expected behavior. Actually, the only way to assign two IP addresses from the same over lapping subnet is by having their respective interfaces in different virtual routers. Let alone a single interface.....

"Normally" you don't need to configure multiple IP adress on your outside interface, if you've got a router connected on it, with gratuitous arp, all your traffic should be redirected to your outside fw interface. Exept if second IP will be used for GP portal / Gateway

Regards,

Kunal Adak

Re: Multiple IP address affected to L3 interface

ukhapre — Fri, 04 Oct 2013 22:21:40 GMT

Hello Greg, when you assign IP with /29 mask - the interface will be listening for all IPs in that range.

Hence /32 is required if you want to put another IP from same subnet.

If you simply need to use second IP for natting - there is no need to configure IP to the interface but only NAT, security policy should be enough

Re: Multiple IP address affected to L3 interface

Gregoux — Mon, 07 Oct 2013 09:49:19 GMT

I found other method to configure that

you could use a loopback address with de /32 addresse affected

or the best for me

is to use this untagged subinterface

https://live.paloaltonetworks.com/docs/DOC-1884