WAN interface Multiple IP addresses or sub interfaces?

[stoff]

Hi - Looking for best practices advice on WAN interface. Currently the WAN interface has a /26 with multiple IP addresses for incoming web servers translated to different subnets behind the PAN.  Is there a default proxy arp working and is this the best practice or should the firewall have sub-interfaces?

Thanks 

[BPry]

@stoff,

There's no reason to create additional sub-interfaces for your untrust interface if you don't need them. Just leave the interface with the /26 like you have now and use your NAT rulebase to assign them where needed. 

[aleksandar.astardzhiev · Accepted solution]

Hi @stoff ,

I, personally, am trying to avoid multiple IP address on the same interface like a plague. In some rear cased it is reasonable to do it, but in most cases there is a better way to accomplish your goal. I also agree with @BPry also that you don't need separate interface for each IP.

When you use IP address in the NAT policy the firewall will automatically configure the proxy arp for that IP.

So my suggestion would be the same as @BPry :

- Configure your WAN interface with one IP from the /26 network

- Configure destination NAT policies with the rest of the addresses in the /26 network (or bi-directional static source nat, depending of your needs and nat policy). No need to have those addresses configured on firewall interface

[stoff]

Thanks that make sense. I am going to get this cleaned up now.