IP address for NAT

[ghostrider]

Hello Experts

I was checking confiugration on my PA firewall and I foud for every source and destination NAT, the public IP for NAT with /32 was assigned to external interface of firewall. In my opinion there is no need to assign public IP /32 to external interface of firewall? Can any body explain to me this

[pulukas · Accepted solution]

Palo Alto NAT rules will automatically create the proxy-arp if the address is withing the subnet range of your existing external interface.  The address would not need to be added to the interface for this to work.

[ghostrider]

thank you but what we need to do if public pool range isin different range than external interface subnet range? Firewall will also do the proxy-arp for this

[pulukas]

If your ISP is routing the subnet to your PA interface as the next hop, then no proxy-arp will be needed.

If your ISP has added the second subnet to their interface and given you a second gateway address, then you need to add an address in this subnet and mask to your interface.  Then the necessary proxy arp will be created when you add the NAT rules.