LOA and ROA Setup After IPv4 Leasing: A Complete Guide

LOA and ROA setup is the most commonly mishandled step after acquiring leased IPv4 space. Providers announce your prefix, but without the right authorization documents on file, upstream networks may filter your routes, RPKI validators will mark them invalid, and IP reputation checks can flag your space. This guide explains exactly how to configure both LOAs and ROAs after leasing IPv4 addresses, so your traffic flows cleanly from day one.

Why LOAs and ROAs Matter After Leasing IPv4 Space

When you lease IPv4 addresses rather than own them, the numbering resources remain registered to the lessor (or their holding organization), typically under ARIN, RIPE NCC, APNIC, LACNIC, or AFRINIC. That creates a trust gap: your upstream ISP or transit provider sees you announcing space that does not belong to your organization. Two mechanisms close that gap:

• LOA (Letter of Authorization): a human-readable document signed by the lessor granting you (or your chosen provider) the right to announce specific prefixes.
• ROA (Route Origin Authorization): a cryptographically signed object in the RPKI system that binds a prefix to a specific origin ASN.

Since major carriers began enforcing Route Origin Validation (ROV) in 2023–2024, a missing or incorrect ROA can render your prefixes unreachable across large portions of the internet. Meanwhile, many tier-1 and tier-2 transit providers still require a signed LOA before accepting BGP announcements for delegated space. You need both.

Writing a Correct LOA

A LOA that gets rejected usually fails on details. A compliant LOA should include:

1. Lessor’s legal entity name exactly as registered with the RIR.
2. Lessee’s organization name and, where required, its ASN.
3. Exact prefix(es) covered — including prefix length (e.g., 23.45.120.0/22, not “all assigned space”).
4. Authorized announcement parties — the ASN(s) permitted to originate the prefix.
5. Validity period matching your lease term, including renewal conditions.
6. Signature block with name, title, date, and contact details of an authorized signatory at the lessor.
7. On company letterhead, ideally with the lease agreement referenced by number or date.

Signed PDFs are standard; some providers now also accept digital signatures. Always keep the original on file — transit providers may re-request it during audits, and IXP onboarding teams frequently ask for LOAs covering their member ASN.

LOA vs. Lease Agreement: Know the Difference

Your lease agreement defines commercial terms — price, duration, liability. The LOA is strictly an operational authorization. Some lessors bundle a LOA template with the contract; if yours doesn’t, request one before signing, and confirm it covers sub-announcements by downstream ASNs if you plan to resell connectivity.

Creating a ROA in the RPKI System

ROAs are created through the RIR that holds the prefix. The lessor (as resource holder) typically creates the ROA, though many lessors grant lessees access via a hosted RPKI portal or API. The two parameters that trip people up:

• Origin ASN: must exactly match the ASN that will originate the prefix in BGP. If your upstream announces on your behalf, use their ASN if they originate, or yours if they transit — confirm with their NOC.
• Max prefix length: the most permitted specific announcement. Setting it to the exact leased prefix length (max length = prefix length) is the most secure option, but if you legitimately announce more specifics (e.g., a /22 as four /24s), set max length accordingly.

Referenced RPKI adoption data shows over 60% of routed IPv4 prefixes now have ROAs, and the majority of large networks drop invalid routes. Best practices:

1. Create the ROA before announcing — a valid BGP announcement without a ROA is “not found,” not invalid, but a ROA covering a narrower prefix makes your broader announcement invalid.
2. Never create overlapping ROAs with conflicting ASNs — that’s a common cause of accidental invalidation.
3. Set ROA validity to match the lease term and renew in parallel with the lease to avoid validation lapses at renewal.
4. Verify propagation using RPKI validators (e.g., Routinator, rpki-client) or public checkers such as RIPEstat and bgp.tools.

Post-Lease Authorization Checklist

1. Check that the prefix registration is clean in the RIR database — correct org, no stale route objects lying around.
2. Get a signed LOA that covers your full lease term and the authorized ASNs.
3. Create (or request) the ROA with the right origin ASN and max prefix length. Double-check both.
4. Update your IRR route/route6 objects to match the announcement. Plenty of networks still filter on IRR, even in 2024.
5. Verify with RPKI and IRR validators — but give it a 24-hour propagation window first. Don’t panic at hour two.
6. Submit the LOA to your transit providers and IXPs wherever they ask for it.
7. Set calendar reminders for the lease and ROA renewal dates. Together. Same day if you can.

Common Mistakes to Avoid

• Wrong origin ASN in the ROA — this is, by a wide margin, the leading cause of “invalid” route status after a lease. I’ve seen it more times than I can count.
• Max length set too narrow or too wide — too narrow and you block legitimate specifics; too wide and you’ve essentially handed hijackers an invitation to your space.
• Missing IRR updates — ROV adoption is high these days, sure, but IRR-based filtering is still alive and well among European and Asian networks.
• Expired LOA/ROA at renewal — the sneaky one. Routes drop weeks after renewal because nobody updated the objects. Nobody noticed until traffic vanished.
• Leasing from sellers with dirty prefixes — blacklist history or a prior hijack record will haunt your deliverability no matter how spotless your paperwork is.

FAQ

Conclusion

Getting your LOA and ROA setup right after leasing IPv4 space isn’t optional paperwork. It’s the foundation of clean, globally accepted BGP announcements — full stop. Secure a properly signed LOA from your lessor, create precise ROAs with the correct origin ASN and max length, sync your IRR objects, and align every expiration date with your lease term. Do that, and you’re protecting your deliverability, your reputation, and your investment all at once. And when you’re sourcing leased space? Work with a trusted marketplace like IP4 Market, where verified sellers, clean prefixes, and streamlined LOA/RPKI support come standard — so you can spend your time on routing, not remediation.