>
    Strata Copilot
    Configure a Secondary IP Address
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma SD-WAN
    3. Prisma SD-WAN Administrator’s Guide
    4. Prisma SD-WAN Sites and Devices
    5. Prisma SD-WAN Ports and Interfaces
    6. Configure a Secondary IP Address
    Download PDF
    Prisma SD-WAN

    Configure a Secondary IP Address

    Table of Contents

    Configure a Secondary IP Address

    Prisma SD-WAN allows to configure secondary IP address. L3 LAN interface capabilities to include the secondary IP addresses to provide multiple logical subnets for an interface.
    Where Can I Use This?What Do I Need?
    • Prisma SD-WAN (Managed by Strata Cloud Manager)
    • Prisma SD-WAN
    Prisma SD-WAN extends the Layer 3 LAN interface capabilities to include the secondary IP addresses to provide multiple logical subnets for an interface. Configure a secondary IP address on the branch site devices that are on 5.5.1 and later versions. If you have secondary IP address configured on any LAN interface, downgrading to a lower version is not allowed.
    DHCP server is not supported for secondary IP addresses on interfaces.
    1. Select ConfigurationPrisma SD-WANION DevicesClaimed, select the device you want to configure.
    2. On the Basic Info screen, toggle Yes for Enable L3 Direct Private WAN Forwarding and Enable L3 LAN Forwarding, then Save.
    3. On the device's interface configuration page, select the Interfaces+ Add Interface to add any interface. Select a port that connects to the LAN.
    4. In the General section,
      1. Enter a Name and (Optional) Description, and add Tags for the port channel interface.
      2. For Admin Up, select Up or Down. Make them Admin Up by selecting Up.
    5. In the Network Setting section,
      1. Select Bypass Pair as the Interface Type.
        Interface type must be physical or sub-interface or bypass pair for configuring secondary IP addresses.
      2. For Use These Ports For, select LAN.
      3. Choose DHCP for the IPv4 Configuration field.
        If DHCP Relay functions are required, change Add DHCP Relay from No to Yes.
        If Configuration selected is Static, enter an IP address and mask for the interface. Enter a Default Gateway for the interface. Wherever applicable, enter DNS servers. Up to three DNS servers may be configured.
        Configuration will not be applicable for Private Layer 2.
      4. Select Enable IPv6 On This Interface to configure IPv6.
      5. For IPv6 Configuration, select AutoConf or Static.
        Autoconf indicates the Global IP address is derived using stateless address autoconfiguration (SLAAC).
        Choose Static if the IP address is fixed and is manually assigned. Additionally specify the IPv6 Address/Mask, Default Gateway (IPv6), and DNS server(s)(IPv6).
      6. Toggle Scope as Global or Local for Internet and Private WAN.
    6. Toggle Scope as either Local or Global.
    7. Select IPv4 Configuration as Static.
      Primary IP address must be static.
    8. (Optional) Specify Secondary IPs.
      You can add a maximum of 8 entries to assign a secondary IP address per Layer 3 LAN interface manually.
      Network context is standard for all secondary IP addresses and is the same as Primary IP addresses.
      Each secondary IP can have its own scope configured.
      When secondary IP is configured on the LAN interface, you cannot disable LAN forwarding.
    9. Save.

    © 2026 Palo Alto Networks, Inc. All rights reserved.