Create a public advertised prefix

You can bring your own IP addresses (BYOIP) to Google Cloud. After wevalidate that you own the IP range, and the IP addresses are imported toGoogle Cloud, you can assign them tosupportedresources.

You can import IPv4 and IPv6 address ranges. IPv4addresses can be used with most Google Cloud resources that supportexternal IP addresses. IPv6 addresses can be used with external passthrough Network Load Balancer only. Formore information, seeSupport for BYOIPaddresses.

The first step in using bring your own IP is to create a public advertisedprefix. The following options are available:

Before you begin

• Bringing your own IP addresses to Google Cloud requires carefulplanning. For more information, seePlanning for bring your own IPaddresses.
• Consider using an organization, and creating a dedicated project formanaging BYOIP addresses. For more information, seeProjectarchitecture.
• Check if any part of the prefix that you want to import is already publiclyadvertised. If it is, you must make sure that Google Cloud does notadvertise it while it is being advertised from another source:
  • If you are creating a v2 public advertised prefix for regionaladdresses, you havecontrol over the announcement of theprefix. You can create the publicadvertised prefix and public delegated prefixes, but you must ensure theprefix is not advertised anywhere else before you announce it fromGoogle Cloud.
  • If you are creating a v1 public advertised prefix for global addresses,the prefix is automatically announced as soon as public delegatedprefix provisioning is complete. Don't create public delegated prefixesuntil the prefix is no longer being announced from another source.

Roles

To get the permissions that you need to complete the tasks in this guide, ask your administrator to grant you theCompute Public IP Admin (roles/compute.publicIpAdmin) IAM role on your project. For more information about granting roles, seeManage access to projects, folders, and organizations.

You might also be able to get the required permissions throughcustom roles or otherpredefined roles.

Validate ownership of your prefix

When you create a public advertised prefix, you complete two tasks whichtogether let Google Cloud validate that you own this prefix:

• Creating a Route Origin Authorization (ROA) for your prefix.
• Creating a PTR record for an IP address in your prefix.

The details of these validation tasks are outlined in the following sections.

After validation is complete, it takes approximately four weeks for the publicadvertised prefix configuration to complete.

Create a ROA request

To prove that you have ownership of a prefix, create a Route OriginAuthorization (ROA) request.

Submit a ROA request with your regional registry for the prefix that you wantGoogle Cloud to advertise. The request includes the prefix, the prefix length, andthe ASN for Google Cloud:396982.

When you create the public advertised prefix, the ROA for this prefix must existand point to the ASN for Google Cloud and remain in effect for some timeafter you delete the public advertised prefix. For more information, seeRemovea ROA.

We recommend that you submit another ROA request for the same prefix and prefixlength but use your own ASN as the origin. If you ever need to advertise theprefix, the ROA with your ASN prevents networks that use Resource Public KeyInfrastructure (RPKI) from considering the prefix to be invalid because it isalso advertised with the origin ASN for Google Cloud.

Your local regional internet registry processes ROA requests. For moreinformation, see the link for your location:

• AFRINIC (Africa)
• APNIC (Portions of Asia and Oceania)
• ARIN (North America and some Caribbean Islands)
• LACNIC (Latin America)
• RIPE NCC (Europe, Central Asia, Middle East)

Create a public advertised prefix

You can create apublic advertised prefix forthe prefix that you want to bring to Google Cloud.

A public advertised prefix name can't be changed without deleting and recreatingthe resource. For this reason, we recommend that you create generic names thatwon't need to change—for example,pap-203-0-113-0-24, wherepapdenotes the resource type and203-0-113-0-24 denotes the specific prefix andprefix length.

If you want to use the public advertised prefix to create global publicdelegated prefixes, your project must be added to an allowlist. For moreinformation, seeGlobal public delegatedprefixes.

Choose an unused IP address for DNS validation. Verification requires that youconfigure a new PTR record for this IP address, and you don't know the hostnameuntil after you create the public advertised prefix.

Find the name to use for the PTR record

When you create a public advertised prefix, Google Cloud generates a name for you touse as a hostname for the PTR validation step.

Create the PTR record

To verify that you own the IP address range that you are importing toGoogle Cloud, you must create a public PTR record in the DNS zone that isused for the IP address range that you are importing.

Use the following values in the PTR record:

• IP address: the verification IP address that you used when youcreated thepublic advertised prefix.
• Hostname: thename (sharedSecret) that Google Cloud provided.
• Domain name: the domain name associated with the DNS zone that is used forthe IP address range that you are importing.

Examples:

• IPv4: If your verification IP address is203.0.113.144, and the DNSdomain for203.0.113.0/24 isexample.net, and the name provided byGoogle Cloud is55kk88tt00, the required PTR record would look like this:

  $ dig +noall +answer -x 203.0.113.144144.113.0.203.in-addr.arpa. 21599 IN PTR 55kk88tt00.example.net

• IPv6: If your verification IP address is2001:db8::10, and the DNSdomain for2001:db8::/32 isexample.net, and the name provided by Google Cloudis55kk88tt00, the required PTR record would look like this:

  $ dig +noall +answer -x 2001:db8::100.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa21599 IN PTR 55kk88tt00.example.net.

Validate the PTR record

After you have created the PTR record, update the public advertised prefix totrigger validation of the PTR record.

gcloud compute public-advertised-prefixes updatePAP_NAME --status=PTR-CONFIGURED

Check the status of a public advertised prefix

It takes approximately four weeks for Google Cloud to provision the public advertisedprefix. You can check the status to see if provisioning is complete.

gcloud compute public-advertised-prefixes describePAP_NAME --format='value(status)'

After the prefix is validated, the status field changes fromVALIDATED toPREFIX_CONFIGURATION_COMPLETE.

What's next

• Create public delegated prefixes