This page shows you how to configure and manage static internal IPv4 or IPv6addresses for your Compute Engine virtual machine (VM) and bare metalinstances.

If an instance requires a fixed internal IP address thatdoes not change, you can obtain a static internal IP address for that instanceby using one of the following options:

• You canreserve a static internal IP address,and thenspecify the reserved address when creating an instance.
• You can also create the instance with an ephemeralinternal IP address and thenpromote that ephemeral IP address to astatic internal IP address.

To learn how to manage secondary internal IP addresses, readAlias IP ranges.

In Compute Engine, each VM instance can havemultiple network interfaces.Each interface can have one external IP address, one primary internal IP address,andone or more secondary internal IP addresses.To learn about IP addresses,read theIP addresses documentation.

With static internal IP addresses, you can always use the same IP address for aVM, even if you have to delete and recreate the VM.

To configure a static external IP address instead of an internal IP address, seeConfigure static external IP addresses.

Before you begin

• Read aboutIP addresses.
• If you haven't already, set upauthentication. Authentication verifies your identity for access to Google Cloud services and APIs. To run code or samples from a local development environment, you can authenticate to Compute Engine by selecting one of the following options:

  Select the tab for how you plan to use the samples on this page:

  Console

  When you use the Google Cloud console to access Google Cloud services and APIs, you don't need to set up authentication.

  gcloud

  1. Install the Google Cloud CLI. After installation,initialize the Google Cloud CLI by running the following command:

     gcloudinit

     If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

     Note: If you installed the gcloud CLI previously, make sure you have the latest version by runninggcloud components update.
  2. Set a default region and zone.

  Terraform

  To use the Terraform samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.

  Install the Google Cloud CLI.

  If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  Note: If you installed the gcloud CLI previously, make sure you have the latest version by runninggcloud components update.

  If you're using a local shell, then create local authentication credentials for your user account:

  gcloudauthapplication-defaultlogin

  You don't need to do this if you're using Cloud Shell.

  If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity.

  For more information, see Set up authentication for a local development environment.

  REST

  To use the REST API samples on this page in a local development environment, you use the credentials you provide to the gcloud CLI.

  Install the Google Cloud CLI.

  If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  Note: If you installed the gcloud CLI previously, make sure you have the latest version by runninggcloud components update.

  For more information, seeAuthenticate for using REST in the Google Cloud authentication documentation.

Required roles

To get the permissions that you need to configure and manage static IP addresses, ask your administrator to grant you the following IAM roles on your project:

• To create and update VMs:Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1)

For more information about granting roles, seeManage access to projects, folders, and organizations.

These predefined roles contain the permissions required to configure and manage static IP addresses. To see the exact permissions that are required, expand theRequired permissions section:

You might also be able to get these permissions withcustom roles or otherpredefined roles.

Limitations

• The number of static internal IP addresses that you can reserve cannot exceedyour project's quota. For more information, see the per-projectquotas in the VPC documentation.

• Only one resource at a time can use a static internal IP address.

• Reserving a static internal IP address is only supported forVPC networks. It is not supported for legacy mode networks.

• Deleting a resource does not automatically release a static internal IPaddress. You must manually release static internal IP addresses when youno longer require them.

• Each VM can have multiple network interfaces,and each interface can have the following IP addresses assignedaccording to itsstack type:

  • IPv4-only interfaces:
    • An internal IPv4 address (required)
    • An external IPv4 address (optional)
  • Dual-stack (IPv4 and IPv6) interfaces:
    • An internal IPv4 address (required)
    • An external IPv4 address (optional)
    • A/96 IPv6 address range, either internal or external, but not both (required)
  • IPv6-only interfaces:
    • A/96 IPv6 address range, either internal or external, but not both (required)

• You can't unassign or change the following:

  • The internal IPv4 address of an existing resource. Forexample, you can't assign a new static internal IP address to a running or astopped VM instance.
  • The internal IPv6 address of a VM with an IPv6-only network interface.

  You can, however, promote an ephemeral internal IPaddress of a resource to a static internal IP address so that the addressremains reserved even after the resource is deleted.

• You cannot change the name of a static IP address.

• Static internal IP addresses are regional, meaning they are restricted tothe region in which they are reserved. For example,if there is a reserved static internal IP address inRegion A, youcan only use the IP address inRegion A.

How to configure a static internal IP address

You can reserve a static internal IP address, and then specify the reservedaddress when creating an instance. You can also create the VM with an ephemeralinternal IP address and then promote that ephemeral IP address to astatic internal IP address.

To use a static internal IP address, you must have a VPC network inplace for your project. To view the VPC networks in your project, seeView VPC networks.

Reserve a static internal IPv4 or IPv6 address and then associate itwith a specific VM

In this scenario, you separately reserve a static internal IP addressand then assign it to an instance:

1. Choose a subnet in yourVPC network. For IPv6 addresses, make sure that it is asubnet with an internal IPv6 address range.

2. Reserve an internal IP addressfrom the subnet's primary IP range. This stepcreates a named internal IP address resource that contains that specificinternal IP address. Reserving the IP address prevents Google Cloud fromautomatically allocating that address as an ephemeral address.

3. Use the reserved internal IP address by associating it with an instancewhen you create the VM resource.

Specify an ephemeral internal IPv4 or IPv6 address for an instance andthen promote the address

In this scenario, you promote an ephemeral internal IPv4 or IPv6 address that isstill attached to an instance:

1. Choose a subnet in yourVPC network. For IPv6 addresses, make sure that it is asubnet with an IPv6 address range.

2. Create an instance with either an automatically allocated ephemeralIPv4 or IPv6 address or a custom IPv4 or IPv6 address.

3. Promotethe ephemeral internal IP address to a static address.

View available static internal IP addresses

To view all your existing static internal IP addresses, complete the followingsteps.

gcloud compute addresses list

GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/addresses

GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/aggregated/addresses

How internal IP addresses are assigned

The network interfaces for an instance are assigned IP addresses from the subnetthat they are connected to. Each IPv4-only or dual-stack network interface hasone primary internal IPv4 address that is assigned from the subnet's primaryIPv4 range. Each IPv6-only or dual-stack network interface connected to a subnetwith an internal IPv6 address range is assigned an internal IPv6 address.

Internal IPv4 addresses can be assigned in the following ways:

• Compute Engine assigns a single IPv4 address from the primary IPv4 subnetrange automatically.
• You can assign a specific internal IPv4 address when you create aninstance, or you canreserve a static internal IPv4 addressfor your project and assign that address to network interface of aninstance.

Internal IPv6 addresses can be assigned in the following ways:

• Compute Engine assigns a single/96 range from the IPv6 subnet rangeautomatically.
• You can assign a custom/96 range from the subnet's internal IPv6 rangewhen you create an instance, or you canreserve a static internal IPv6 address rangefrom the subnet's internal IPv6 range and assign it to the networkinterface of an instance.

Use reserved static internal IP addresses when creating resources

After you reserve a static internal IP address, you can assign the reservedaddress when creating an instance or an internal load balancer.

The following procedures describe how to use static internal IPaddresses when creating resources:

• Create an instance with a reserved internal IPv4 or IPv6 address
• Use a static internal IPv4 or IPv6 address for a secondary network interface

Create an instance with a reserved internal IPv4 or IPv6 address

When you create an instance that is connected to a dual-stack or IPv6-only subnet withan internal IPv6 range, and you don't specify a custom ephemeral internal IPv6address or reserved static internal IPv6 address, Compute Engineautomatically assigns the instance an ephemeral internal IPv6 address from thesubnet's IPv6 range.

If you delete an instance with an ephemeral IP address, the address goes backinto the unallocated address pool. If you need an internal IP addressto persist beyond the life of the instance, you canreserve a static internal IP address.

Assign a static internal address to an instance's secondary network interface

When you create an instance with multiple network interfaces, you can usea reserved static internal IPv4 or IPv6 address for both primary and secondarynetwork interfaces.

To use a static internal IPv4 or IPv6 address for a secondary network interface,seeCreate instances with multiple network interfaces.

Change or assign an internal IPv6 address to an existing instance

You can change or assign an internal IPv6 address for an existing dual-stackinstance. If the instance is IPv4-only and you want to assign an IPv6 address,you must first change its stack type to dual-stack.

If the instance already has an internal IPv6 address assigned to it, you mustfirstunassign that address. Then, assign a new address tothe instance by using the instance's network interface.

To change or assign a static internal IPv6 address to an existing instance,complete the following steps.

gcloud compute instances network-interfaces updateINSTANCE_NAME \    --network-interfaceNIC \    --ipv6-network-tier PREMIUM \    --stack-typeSTACK_TYPE \    --internal-ipv6-addressINTERNAL_IPV6_ADDRESS \    --zoneZONE

 POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME  {      ...      "networkInterfaces": [{          "accessConfigs": [{              "type": "ONE_TO_ONE_NAT",              "name": "External NAT",          }],          "stackType": "STACK_TYPE"          "ipv6Address": "IPV6_ADDRESS",          "internalIpv6PrefixLength": 96          "subnetwork": "regions/REGION/subnetworks/SUBNETWORK",      }],      "disks": [{          "autoDelete": "true",          "boot": "true",          "type": "PERSISTENT",          "initializeParams": {              "sourceImage": "projects/debian-cloud/global/images/debian-11-bullseye-v20241009"          }      }] }

Manage static internal IP addresses

The following procedures let you manage static internal IPaddresses for your instances:

• Determine if an internal IPv4 or IPv6 address is ephemeral or static
• List static internal IPv4 or IPv6 addresses
• Unassign a static internal IPv6 address
• Release a static internal IPv6 address

Determine if an internal IPv4 or IPv6 address is ephemeral or static

Static and ephemeral internal IP addresses behave and appear the same in mostcontexts. However, with static internal IP addresses, you can use the same IPaddress for the same resource even if you delete and re-create the resource.In general, an ephemeral IP address is released if you stop or delete theresource.

To determine if an address is static or ephemeral, do the following:

1. In the Google Cloud console, go to theIP addresses page.

   Go to IP addresses

2. Find the address in the list and check theType column for the type ofIP address.

Unassign a static internal IPv6 address

You can unassign a static internal IPv6 address from a dual-stack instanceby updating the stack type for the instance's network interface or bydeleting the instanceto which the address is assigned.

When you unassign an internal IPv6 address, the system removes it from theresource but keeps the address reserved for your project. You can laterreassign the address to another resource.

To unassign a static internal IPv6 address from an instance, complete thefollowing steps.

gcloud compute instances network-interfaces updateINSTANCE_NAME \    --network-interface=NIC \    --stack-type=IPV4_ONLY \    --zone=ZONE

gcloud compute addresses list \    --filter="region=REGION AND name=INSTANCE_NAME"

Release a static internal IP address

If you no longer need a static internal IPv4 or IPv6 IP address, you can releasethe IP address by deleting the IP address resource. Deleting an instance doesn'tautomatically release a static external IP address. You must manually releasestatic external IP addresses when you no longer require them.

To release a static internal IP address, seeRelease a static internal IPv4 or IPv6 addressin the VPC documentation.

What's next

• IP addresses
• Configure a static external IP address
• Assignmultiple internal IP addresses using alias IP addresses