Multiple IP address affected to L3 interface

[Gregoux]

Hello All

Somebody know why

When You add 2 ip address from the same subnet to the same interface Layer 3 ex ;

ip 1 : 12.52.36.2/29

ip 2: 12.52.36.3/29

you obtain an error lijke subnet overlaping

to solve that you need to declare one IP in the subnet /29 and the other in subnet /32

like IP 1: 12.52.36.2/29

and IP 2: 12.52.36.3/32

thank

[kadak · Accepted solution]

Hello Greg,

That is an expected behavior. Actually, the only way to assign two IP addresses from the same over lapping subnet is by having their respective interfaces in different virtual routers. Let alone a single interface.....

"Normally" you don't need to configure multiple IP adress on your outside interface, if you've got a router connected on it, with gratuitous arp, all your traffic should be redirected to your outside fw interface. Exept if second IP will be used for GP portal / Gateway

Regards,

Kunal Adak

[ukhapre]

Hello Greg, when you assign IP with /29 mask - the interface will be listening for all IPs in that range.

Hence /32 is required if you want to put  another IP from same subnet.

If you simply need to use second IP for natting - there is no need to configure IP to the interface but only NAT, security policy should be enough

[Gregoux]

I found other method to configure that

you could use a loopback address with de /32 addresse affected

or the best for me

is to use this untagged subinterface

https://live.paloaltonetworks.com/docs/DOC-1884