cannot ping to alias ip address of portA

very simple the alias has to be in a different IP range.

Ian

Wrong! 
 Alias IP Addresses are usually in the same subnet network. 
The most common issue with having problems on Alias IP addresses is the arp and mac addresses table issues on switches.
Try to run an arp ping from the Sophos Device itself using the cli:

```system diagnostics utilities arp ping source 10.10.1.40 interface PortA 10.10.1.1
```

assuming that the 10.10.1.1 is the host from where you are trying to ping the Alias address.

Thanks I will try again

I think you are mistaken, most aliases are in seperate address ranges.

Most aliases are on external interfaces using a different IP address range to provide server access, not on internal interfaces where nothing is really achieved because you are using the same bandwidth to connect on of you think you are improving performance by load balancing which the XG does not do.

Ian

yeah, just for education, we do run a number of alias addresses on the same interface with 255.255.255.255. works well for us.

Yes, but they are in different subnets not /24.

 Not sure why you would run alias on internal networks with a /24?

ian

ahh to be fair i never read the details of the post, we run it on WAN for multiple inbound https requests where port redirection isn't practical 

Because some devices in the network might have static configuration for different gateway IPs (in same subnet)? 
Its a common situation when we replacing old network equipment....

Another usecase is when you are segmenting the network and want to move some services in different subnet without worrying about changing every old school configured desktop app ? I'm doing that with DNATs entirely in the local segment.  

Do not tell me that you have never seen multiple secondary addresses from the same subnet on internal (LAN) or DMZ interface ? 

Because some devices in the network might have static configuration for different gateway IPs (in same subnet)? 
Its a common situation when we replacing old network equipment....

Another usecase is when you are segmenting the network and want to move some services in different subnet without worrying about changing every old school configured desktop app ? I'm doing that with DNATs entirely in the local segment.  

Do not tell me that you have never seen multiple secondary addresses from the same subnet on internal (LAN) or DMZ interface ? 

When using VLANs with different address ranges, but never in the same /24. That is a lot of configuration work with many NAT rules.

Ian