Create a public advertised prefix

You can bring your own IP addresses (BYOIP) to Google Cloud. After we validate that you own the IP range, and the IP addresses are imported to Google Cloud, you can assign them to supported resources.

Warning: Google does not support overlapping BYOIP route announcements. For example, importing 203.0.112.0/23 is not supported if 203.0.112.0/23 or a subset of this prefix, such as 203.0.112.0/24, is advertised outside Google. If Google and another network advertise the same route with matching or mismatched prefix lengths, you might experience unexpected routing and packet loss.

The first step in using bring your own IP is to create a public advertised prefix. The following options are available:

Configuration	Regional (v2)	Regional (v1)	Global (v1)
Availability	Recommended regional configuration	Not recommended for new regional configurations	Must request adding your project to an allowlist
Public advertised prefix provisioning time	Approximately 2 weeks	Approximately 4 weeks	Approximately 4 weeks
Public delegated prefix provisioning time	A few minutes	4 weeks Can overlap with public advertised prefix provisioning time	4 weeks Can overlap with public advertised prefix provisioning time
Sub-prefix provisioning time	A few minutes	A few minutes	A few minutes
BGP announcement	The public advertised prefix is not automatically announced when it is provisioned. You decide when to announce or withdraw advertisement.	By default, the public advertised prefix is automatically announced after provisioning completes. BGP announcement control is available only through live migration (available through allowlist).	The public advertised prefix is automatically announced after provisioning completes.
Public advertised prefix size	/16 to /24	/16 to /24	/16 to /24
Public delegated prefix size	/16 to /28 Can be the same size or smaller than the public advertised prefix.	/17 to /28 Must be smaller than the public advertised prefix.	/17 to /28 Must be smaller than the public advertised prefix.

Before you begin

• Bringing your own IP addresses to Google Cloud requires careful planning. For more information, see Planning for bring your own IP addresses.
• Consider using an organization, and creating a dedicated project for managing BYOIP addresses. For more information, see Project architecture.
• Check if any part of the prefix that you want to import is already publicly advertised. If it is, you must make sure that Google Cloud does not advertise it while it is being advertised from another source:
  • If you are creating a v2 public advertised prefix for regional addresses, you have control over the advertisement of the prefix. You can create the public advertised prefix and public delegated prefixes, but you must ensure the prefix is not advertised anywhere else before you announce it from Google Cloud.
  • If you are creating a v1 public advertised prefix for regional addresses, you can create the public advertised prefix, but you must use live migration when you create all public delegated prefixes and you must ensure the prefix is not advertised anywhere else before you advertise it from Google Cloud.
  • If you are creating a v1 public advertised prefix for global addresses, the prefix is automatically advertised as soon as public delegated prefix provisioning is complete. Don't create public delegated prefixes until the prefix is no longer being advertised from another source.

Roles

To get the permissions that you need to complete the tasks in this guide, ask your administrator to grant you the Compute Public IP Admin (roles/compute.publicIpAdmin) IAM role on your project. For more information about granting roles, see Manage access.

You might also be able to get the required permissions through custom roles or other predefined roles.

Validate ownership of your prefix

When you create a public advertised prefix, you complete two tasks which together let Google validate that you own this prefix:

• Creating a Route Origin Authorization (ROA) for your prefix.
• Creating a PTR record for an IP address in your prefix.

The details of these validation tasks are outlined in the following sections.

After validation is complete, it takes approximately four weeks for the public advertised prefix configuration to complete.

Create a ROA request

To prove that you have ownership of a prefix, create a Route Origin Authorization (ROA) request.

Submit a ROA request with your regional registry for the prefix that you want Google to advertise. The request includes the prefix, the prefix length, and Google's ASN: 396982.

When you create the public advertised prefix, the ROA for this prefix must exist and point to Google's ASN and remain in effect for some time after you delete the public advertised prefix. For more information, see Remove a ROA.

We recommend that you submit another ROA request for the same prefix and prefix length but use your own ASN as the origin. If you ever need to advertise the prefix, the ROA with your ASN prevents networks that use Resource Public Key Infrastructure (RPKI) from considering the prefix to be invalid because it is also advertised with Google's origin ASN.

Your local regional internet registry processes ROA requests. For more information, see the link for your location:

• AFRINIC (Africa)
• APNIC (Portions of Asia and Oceania)
• ARIN (North America and some Caribbean Islands)
• LACNIC (Latin America)
• RIPE NCC (Europe, Central Asia, Middle East)

Create a public advertised prefix

Warning: Google does not support overlapping BYOIP route announcements. For example, importing 203.0.112.0/23 is not supported if 203.0.112.0/23 or a subset of this prefix, such as 203.0.112.0/24, is advertised outside Google. If Google and another network advertise the same route with matching or mismatched prefix lengths, you might experience unexpected routing and packet loss.

You can create a public advertised prefix for the prefix that you want to bring to Google.

A public advertised prefix name can't be changed without deleting and recreating the resource. For this reason, we recommend that you create generic names that won't need to change—for example, pap-203-0-113-0-24, where pap denotes the resource type and 203-0-113-0-24 denotes the specific prefix and prefix length.

If you want to use the public advertised prefix to create global public delegated prefixes, your project must be added to an allowlist. For more information, see Global public delegated prefixes.

Choose an unused IP address for DNS validation. Verification requires that you configure a new PTR record for this IP address, and you don't know the hostname until after you create the public advertised prefix.

Console

1. In the Google Cloud console, go to Bring your own IP.

   Go to Bring your own IP

2. Click Add PAP.

3. For Name, enter a name for the public advertised prefix.

4. For Description, enter an optional description for the public advertised prefix.

5. For Prefix, enter the prefix that you want to import.

6. Click Next.

7. Select a Scope for the public advertised prefix: Regional or Global.

   Note: if the Global option is not available, you are not part of the allowlist for global public advertised prefixes.

8. Click Next.

9. Review the information that you entered. To confirm that you own this prefix, click Confirm.

10. For IP address, enter an unused IP address from the prefix that you are adding. This address is used for DNS validation, and in a later step, you must create a PTR record for it that uses a hostname provided by Google.

11. Click Create. The Validation screen shows you the validation status of this request.

gcloud

Use the public-advertised-prefixes create command.

• To create a public advertised prefix (v1) for global addresses, run the following command:

  gcloud compute public-advertised-prefixes create PAP_NAME \
      --range=PAP_IP_RANGE \
      --dns-verification-ip=VERIFICATION_IP_ADDRESS
  

  Important: You must request that your project be added to an allowlist before you can create global public delegated prefixes from this public advertised prefix.

• To create a public advertised prefix (v2) for regional addresses, run the following command:

  gcloud compute public-advertised-prefixes create PAP_NAME \
      --range=PAP_IP_RANGE \
      --pdp-scope=REGIONAL \
      --dns-verification-ip=VERIFICATION_IP_ADDRESS
  

• Creating a public advertised prefix (v1) for regional addresses is not recommended. Create a v2 public advertised prefix instead. If you must create a v1 public advertised prefix for regional addresses, run the following command:

  gcloud compute public-advertised-prefixes create PAP_NAME \
      --range=PAP_IP_RANGE \
      --dns-verification-ip=VERIFICATION_IP_ADDRESS
  

Replace the following:

• PAP_NAME: a name for the public advertised prefix that you're creating.

• PAP_IP_RANGE: an IP range for the public advertised prefix.

• VERIFICATION_IP_ADDRESS: an unused IP address chosen from the PAP_IP_RANGE. This address is used for DNS validation, and in a later step, you must create a PTR record for it that uses a hostname provided by Google.

Find the name to use for the PTR record

When you create a public advertised prefix, Google generates a name for you to use as a hostname for the PTR validation step.

Console

1. In the Google Cloud console, go to Bring your own IP.

   Go to Bring your own IP

2. Click Check status for the prefix that you want to update.

3. The name and IP address to use for PTR validation are displayed in the DNS validation section.

gcloud

1. To get the name from the sharedSecret field, use the public-advertised-prefixes describe command.

   gcloud compute public-advertised-prefixes describe \
       PAP_NAME --format='value(sharedSecret)'
   

2. If needed, you can retrieve the IP address you provided for DNS validation.

   gcloud compute public-advertised-prefixes describe \
       PAP_NAME --format='value(dnsVerificationIp)'
   

In both commands, replace PAP_NAME with the name of the public advertised prefix.

Create the PTR record

In your DNS server, add a PTR record using the following values:

• IP address: the verification IP address that you used when you created the public advertised prefix.
• Hostname: the name (sharedSecret) that Google provided.

If you are using Cloud DNS for this IP address, see add a record.

For example, if you are importing prefix 203.0.113.0/24, and your verification IP address is 203.0.113.144, and the name provided by Google is 55kk88tt00, the required PTR record would look like this:

$ dig +noall +answer -x 203.0.113.144

144.113.0.203.in-addr.arpa. 21599 IN PTR 55kk88tt99.example.net

Validate the PTR record

After you have created the PTR record, update the public advertised prefix to trigger validation of the PTR record.

Console

1. In the Google Cloud console, go to Bring your own IP.

   Go to Bring your own IP

2. Click Check status for the prefix that you want to update.

3. In the DNS validation section, select the I have created this PTR record checkbox and click Validate.

gcloud

To change the status of the public advertised prefix to PTR-CONFIGURED, use the public-advertised-prefixes update command.

The status change triggers validation of the PTR record. If it is successful, the status changes to VALIDATED. If it fails, the status changes to REVERSE_DNS_LOOKUP_FAILED.

gcloud compute public-advertised-prefixes update PAP_NAME --status=PTR-CONFIGURED

Replace PAP_NAME with the public advertised prefix that you have created a PTR record for.

Check the status of a public advertised prefix

It takes approximately four weeks for Google to provision the public advertised prefix. You can check the status to see if provisioning is complete.

Console

1. In the Google Cloud console, go to Bring your own IP.

   Go to Bring your own IP

2. Click Check status for the prefix that you want to check.

3. View the Validation section.

gcloud

To describe the public advertised prefix and get its status, use the public-advertised-prefixes describe command.

After the prefix is validated, the status field changes from VALIDATED to PREFIX_CONFIGURATION_COMPLETE.

gcloud compute public-advertised-prefixes describe PAP_NAME --format='value(status)'

Replace PAP_NAME with the public advertised prefix that you want to get status information for.

What's next

• Create public delegated prefixes