topic Re: giving the outside interface multiple ip? in General Topics

giving the outside interface multiple ip?

chuckles — Sun, 12 May 2019 10:59:49 GMT

im facing issue where a firewall with a outside interface is not receiving public ip adresses from the isp router , the isp router is showing it is own interface which is connected to the firewall as the arp destination for the public ip subnet instead of the router , so i was wondering can i add multiple ip addresses to the PA layer3 outside interface?

Re: giving the outside interface multiple ip?

Remo — Sun, 12 May 2019 12:12:38 GMT

Hi @chuckles

Are the additional addresses in the same subnet as your external interface or do you have another subnet with additional addresses?

Re: giving the outside interface multiple ip?

chuckles — Sun, 12 May 2019 15:29:03 GMT

they are in the same subnet

Re: giving the outside interface multiple ip?

Remo — Sun, 12 May 2019 17:26:07 GMT

@chuckles for what do you want to use the additional IP addresses? If you need them for making internal/dmz servers available to the internet or for source NAT IPs for outgoing connections then you actually only need to configure the required NAT rules - that's it. This way your firewall automatically responds to ARP requests for these IPs

Re: giving the outside interface multiple ip?

OtakarKlier — Mon, 13 May 2019 15:21:00 GMT

Hello,

Or to make your life easier, is it possible to have the ISP just route all of the IP's assigned to you out its 'your device' facing interface?

Just a thought.

Re: giving the outside interface multiple ip?

Remo — Mon, 13 May 2019 15:26:20 GMT

@OtakarKlier

There's probably not much that can be routed as it is already the directly connected interface.

Re: giving the outside interface multiple ip?

OtakarKlier — Mon, 13 May 2019 15:28:39 GMT

Guess I'm thinking of it a bit differently. Say an ISP assigns you x.y.w.z/27, I should not have to assign my external interfaces that subnet. The ISP should route that subnet out its interface that I connect to. That is how all of our ISP's are setup currently.

hope that makes sense.

Re: giving the outside interface multiple ip?

Remo — Mon, 13 May 2019 15:36:57 GMT

@OtakarKlier I also know it that way you describe, but @chuckles wrote the additional IPs are in the same subnet as the external interface.