>
    Strata Copilot
    Layer 3 Interfaces
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. Configure Interfaces
    4. Layer 3 Interfaces
    Download PDF
    Next-Generation Firewall

    Layer 3 Interfaces

    Table of Contents

    Layer 3 Interfaces

    Description of Layer3 interfaces and duplicate IP address support.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by PAN-OS or Panorama)
    In a Layer 3 deployment, the firewall routes traffic between multiple ports. Before you can Configure Layer 3 Interfaces, you must configure the virtual router or logical router that you want the firewall to use to route the traffic for each Layer 3 interface.
    If you’re using Security Group Tags (SGTs) in a Cisco TrustSec network, it’s a best practice to deploy inline firewalls in either Layer 2 or virtual wire mode. However, if you need to use a Layer 3 firewall in a Cisco TrustSec network, you should deploy the Layer 3 firewall between two SGT exchange protocol (SXP) peers, and configure the firewall to allow traffic between the SXP peers.

    Duplicate IP Address Support

    Beginning with PAN-OS® 11.1.4 and later releases, duplicate (overlapping) IP address support allows you to use the same IP address on multiple firewall interfaces when the interfaces use different logical routers and also use one of the following combinations:
    • Different zones and the same virtual system.
    • The same zone and different virtual systems.
    • Different zones and different virtual systems.
    It's important to understand these requirements because if you attempt to configure duplicate addresses on multiple interfaces in the same zone and on the same virtual system, there is no commit failure that prevents the misconfiguration.
    Multiple interfaces on the same logical router can't use the same IP address.
    PA-1400 Series, VM-Series firewalls, and Panorama template stack support overlapping IP addresses.
    Overlapping IP address support requires the Advanced Routing Engine. You enable Advanced Routing; you can then enable Duplicate IP Address Support. Follow the standard procedure to commit and reboot the firewall before you configure duplicate IP addresses.
    You can then proceed to Configure Layer 3 Interfaces with duplicate IP addresses. The example topology illustrates the same IP address (192.0.2.5/24) on two interfaces (Ethernet1/3 and Ethernet 1/6) that belong to different logical routers (lr1 and lr6), the same virtual system (VSYS-1), and different zones (l3zone and zone6).
    The interfaces can also share IPv6 addresses. The resulting configuration example from the sample topology would be similar to this:
    A separate configuration example shows Ethernet1/4 and Ethernet1/8 with overlapping IP addresses configured for different logical routers, different virtual systems, and different zones:
    The General Information on the Dashboard displays the firewall setting: Duplicate IP Enabled or Duplicate IP Disabled.
    Overlapping IP addresses support both static and dynamically assigned IPv4 and IPv6 addresses. All Layer 3 interface types (Ethernet, VLAN, tunnel, loopback, Aggregate Ethernet [AE], and AE subinterfaces) support overlapping IP addresses. The support includes gateway interfaces.
    The management interface does not support overlapping IP addresses.
    Overlapping IP addresses are not supported if HA active/active mode is enabled. Such a commit fails with the error message, Duplicate IP is not supported in HA Active/Active mode.
    Interfaces that have duplicate IP addresses configured support the following services: Ping, SSH, Telnet, HTTP, and HTTPS. When Duplicate IP Address Support is enabled, the ping and traceroute commands require you to specify a logical router, which differentiates the source IP address among the duplicate addresses. Thus, the response comes back to the correct IP address. Use the CLI operational commands:
    • ping source ip host ip logical-router logical-router-name
    • traceroute source ip host ip logical-router logical-router-name
    You can access Interface Management Profile services through interfaces that have overlapping IP addresses.
    Inter-vsys routing supports overlapping IP addresses so that you can route between virtual systems.
    Additional CLI commands related to duplicate IP address support are:
    • set deviceconfig setting duplicate-ip <yes|no>
      Enable or disable duplicate IP address support.
    • show system info
      View the Duplicate IP setting (Enabled or Disabled).
    • show counter global name session_duplicate_ip_alt_srcnat_xlat
      View counters for duplicate-ip alt source NAT translation.
    The first topic linked below describes how to configure Layer 3 interfaces. The latter topic link describes how to use Neighbor Discovery Protocol (NDP) to provision IPv6 hosts and view the IPv6 addresses of devices on the link local network to quickly locate devices.

    © 2026 Palo Alto Networks, Inc. All rights reserved.