Dear
Creating sub-interface means you need to vlan tag each sub-interface (called unit in junos language) , you can also create secondary address on the same old interface ,just assign an address from the new subnet to your interface , but be aware , that if you need to send traffic sourced from the device , it will use the primary address , see below definition of primary address:
- Whether this address is the primary address—Each interface has a primary local address. If an interface has more than one address, the primary local address is used by default as the source address when you send packets from an interface where the destination provides no information about the subnet (for example, some ping commands). By default, the primary address on an interface is the lowest-numbered non-127 (in other words, non-loopback) preferred address on the interface. To override the default and explicitly configure the preferred address, include the primary statement when configuring the address.
for proxy-arp , you can use it in case of using NAT , when NAT pool address (es) is/are part of the upstream interface subnet (untrust interface for your case) only, it depends what you want to do with this new subnet , if you want to use them for NAT (source/ destination / static) , you don't need to configure any address from new subnet on interface , just routing will do the job, if you want to assign the public IPs on your machine , in this case , you must configure the new address on your firewall.
Regards