How to Add Multiple IP Addresses to a Firewall in AWS

In some cases, you may need multiple IP addresses on a single network interface, for example to host multiple services running on the same port behind the firewall. For each private IP address on the instance, an Elastic IP address is associated. The maximum number of private IP addresses depends on the instance type.

Before You Begin

• Deploy a firewall instance in AWS. For more information, see Amazon AWS Deployment.

Step 1. Add Private IP Addresses to the Network Interface

Depending on the instance type, you can add multiple additional private IP addresses to the network interface.

1. Log into the AWS console.
2. Click Services and select EC2.
3. In the Instances section of the left menu, click Instances. 
   
4. Select the firewall instance.
5. Click the Networking tab for the firewall instance.
   
6. Locate the Interface ID and click on the entry.
   
7. The filtered list of network interfaces is displayed. Right-click the network interface and select Manage IP addresses.
   
8. Click Assign new IP
9. (optional) Enter a unique Private IP. Leave empty for a free IP address in the subnet to be automatically assigned.
   
10. Click Save.

Step 2. Create and Associate Elastic IP Addresses with the Private IPs

1. Log into the AWS console.
2. Click Services and select EC2.
3. In the Network & Security section of the left menu, click Elastic IPs.
   
4. Click Allocate Elastic IP address.
   
5. Click Allocate.
6. The Elastic IP addresses window opens. Select the new elastic IP address.
7. Expand the Actions menu and select Associate Elastic IP address.
   
8. Select the instance and private IP address:
   
   • Resource Type – Select Instance. 

   • Instance – Select the firewall instance from the list

   • Private IP address – Select the secondary IP address added in Step 1 from the list.

   • (optional) Reassociation – Select the check box if the Elastic IP Address is already associated with another instance.
     
9. Click Associate.

Step 3. Add the Additional IP Address as Shared IPs

Add the custom private IP addresses of both firewalls for the additional network interfaces to the shared IP addresses. If multiple IP addresses are used in a High Availability cluster, you must add both the private IP addresses from the primary and the secondary firewall as a shared IP address.

1. Log into the firewall
2. Go to CONFIGURATION > Configuration Tree > Box > Network.
3. Click Lock.
4. In the left menu, click IP Configuration.
5. In the Shared Networks and IPs section, double-click on the corresponding entry.
6. In the Shared IPs in this Network section, click + to add the additional private IP addresses.
   
7. Click Send Changes and Activate.
8. Go to CONTROL > Box.
9. In the Network section of the left menu, click Activate new network configuration. The Network Activation window opens.
10. Click Failsafe.

The firewall instance is now reachable through multiple public IP addresses.

Next Steps

Adapt access rules to use the additional private IP addresses.