Configure Proxy ARP on a Layer 3 Interface (PAN-OS & Panorama)

1. Select an interface.

   Select NetworkInterfaces, then select Ethernet (and Interface Type as Layer 3), VLAN, or Aggregate Ethernet (and Interface Type as Layer 3).

   For a sub-interface, expand the parent interface and select the sub-interface.
2. Enable Proxy ARP in the Layer 3 interface.

   Select AdvancedProxy ARP and enable Proxy ARP.

3. Add the IP addresses for which the firewall intercepts and responds to ARP requests.

   In the Address table, click Add and enter one of the following:

   • An individual IP address, for example 192.168.100.10
   • A subnet in CIDR notation, for example 192.168.100.0/24
   • An IP address range, for example 192.168.100.10-192.168.100.50

   Repeat to add an entry for each device, subnet, or range on the VLAN.
4. (Optional) To prevent the firewall from responding to ARP requests for a specific address, enable Negate for that entry. Configure more specific negate entries, such as individual /32 addresses, before broader range entries to ensure correct longest-prefix-match behavior.
5. Select OK and then Commit.