Techniques for protecting source IPs in a network fabric are described. A binding database may receive an indication of an overlay address-to-underlay address binding for a client device connected to the network fabric. The indication is received in a secure message from a fabric edge node through which the client device is connected. The overlay address-to-underlay address binding indicates a first overlay address and an underlay address associated with the fabric edge node. One or more additional overlay addresses are allocated and associated with the overlay address-to-underlay address binding. Each of the one or more additional overlay addresses is mapped to the first overlay address. A second overlay address is assigned, from the one or more additional overlay addresses, to the client device for an IP flow. The fabric edge node intercepts packet of the IP flow and translates a source IP from the first to the second overlay address.