topic Re: can I have multiple Def gateway IPs on single L3 interface? in General Topics

can I have multiple Def gateway IPs on single L3 interface?

SThatipelly — Mon, 21 Jun 2021 20:02:43 GMT

I have a Layer3 interface on the firewall that is connected to a zone that hosts multiple subnets spread across the remote sites. I would like the firewall to block the intra-zone traffic in this. To do this, I will need to give the Firewall IP as the Def gateway.

For e.g. Site A has 192.168.2.0/24 & site B has 192.168.4.0/24 , can I assign my firewall interface both 192.168.2.1 and 192.168.4.1 and block intrazone? if this possible, how many IPs can I assign to this Layer3 interface? I have 40 sites.

Thanks.

Re: can I have multiple Def gateway IPs on single L3 interface?

BPry — Tue, 22 Jun 2021 03:18:23 GMT

@SThatipelly,

Look into sub-interfaces. This will allow you to create multiple logical interfaces while only using a single physical interface and do anything you need from a zone perspective.

Re: can I have multiple Def gateway IPs on single L3 interface?

SThatipelly — Tue, 22 Jun 2021 14:26:01 GMT

@BPry I'm hesitant to do sub-interfaces as I will need to spin up 40 sub-interfaces for this.

Re: can I have multiple Def gateway IPs on single L3 interface?

S.Cantwell — Tue, 22 Jun 2021 17:46:45 GMT

Hello

I just created an interface with 40 different subnets on it, without issue. You are good with your design, if you decide to move forward with it. But... I do agree with my peer @BPry, that having different sub interfaces is probably a better design for security.

Thank you.