{"id":2169,"date":"2026-10-28T06:51:28","date_gmt":"2026-10-28T06:51:28","guid":{"rendered":"https:\/\/ip4.market\/blog\/?p=2169"},"modified":"2026-10-28T06:51:28","modified_gmt":"2026-10-28T06:51:28","slug":"loa-and-roa-setup-after-ipv4-leasing-a-complete-guide","status":"publish","type":"post","link":"https:\/\/ip4.market\/blog\/loa-and-roa-setup-after-ipv4-leasing-a-complete-guide\/","title":{"rendered":"LOA and ROA Setup After IPv4 Leasing: A Complete Guide"},"content":{"rendered":"

LOA and ROA setup<\/strong> is the most commonly mishandled step after acquiring leased IPv4 space. Providers announce your prefix, but without the right authorization documents on file, upstream networks may filter your routes, RPKI validators will mark them invalid, and IP reputation checks can flag your space. This guide explains exactly how to configure both LOAs and ROAs after leasing IPv4 addresses, so your traffic flows cleanly from day one.<\/p>\n

\n

In this article:<\/strong><\/p>\n

    \n
  1. Why LOAs and ROAs Matter After Leasing<\/a><\/li>\n
  2. Writing a Correct LOA<\/a><\/li>\n
  3. Creating a ROA in the RPKI System<\/a><\/li>\n
  4. Post-Lease Authorization Checklist<\/a><\/li>\n
  5. Common Mistakes to Avoid<\/a><\/li>\n
  6. FAQ<\/a><\/li>\n<\/ol>\n<\/div>\n

    Why LOAs and ROAs Matter After Leasing IPv4 Space<\/h2>\n

    When you lease IPv4 addresses rather than own them, the numbering resources remain registered to the lessor (or their holding organization), typically under ARIN, RIPE NCC, APNIC, LACNIC, or AFRINIC. That creates a trust gap: your upstream ISP or transit provider sees you announcing space that does not belong to your organization. Two mechanisms close that gap:<\/p>\n

      \n
    • LOA (Letter of Authorization):<\/strong> a human-readable document signed by the lessor granting you (or your chosen provider) the right to announce specific prefixes.<\/li>\n
    • ROA (Route Origin Authorization):<\/strong> a cryptographically signed object in the RPKI system that binds a prefix to a specific origin ASN.<\/li>\n<\/ul>\n

      Since major carriers began enforcing Route Origin Validation (ROV) in 2023\u20132024, a missing or incorrect ROA can render your prefixes unreachable across large portions of the internet. Meanwhile, many tier-1 and tier-2 transit providers still require a signed LOA before accepting BGP announcements for delegated space. You need both.<\/p>\n

      Key insight:<\/strong> ROAs handle machine validation; LOAs handle human verification. They serve different audiences and one cannot replace the other.<\/div>\n

      Writing a Correct LOA<\/h2>\n

      A LOA that gets rejected usually fails on details. A compliant LOA should include:<\/p>\n

        \n
      1. Lessor’s legal entity name<\/strong> exactly as registered with the RIR.<\/li>\n
      2. Lessee’s organization name<\/strong> and, where required, its ASN.<\/li>\n
      3. Exact prefix(es)<\/strong> covered \u2014 including prefix length (e.g., 23.45.120.0\/22, not “all assigned space”).<\/li>\n
      4. Authorized announcement parties<\/strong> \u2014 the ASN(s) permitted to originate the prefix.<\/li>\n
      5. Validity period<\/strong> matching your lease term, including renewal conditions.<\/li>\n
      6. Signature block<\/strong> with name, title, date, and contact details of an authorized signatory at the lessor.<\/li>\n
      7. On company letterhead<\/strong>, ideally with the lease agreement referenced by number or date.<\/li>\n<\/ol>\n

        Signed PDFs are standard; some providers now also accept digital signatures. Always keep the original on file \u2014 transit providers may re-request it during audits, and IXP onboarding teams frequently ask for LOAs covering their member ASN.<\/p>\n

        Warning:<\/strong> Never self-issue a LOA as the lessee. Only the registered resource holder can validly authorize announcements. A lessee-drafted LOA carries no authority and will be rejected by most NOCs.<\/div>\n

        LOA vs. Lease Agreement: Know the Difference<\/h3>\n

        Your lease agreement defines commercial terms \u2014 price, duration, liability. The LOA is strictly an operational authorization. Some lessors bundle a LOA template with the contract; if yours doesn’t, request one before signing, and confirm it covers sub-announcements by downstream ASNs<\/em> if you plan to resell connectivity.<\/p>\n

        Creating a ROA in the RPKI System<\/h2>\n

        ROAs are created through the RIR that holds the prefix. The lessor (as resource holder) typically creates the ROA, though many lessors grant lessees access via a hosted RPKI portal or API. The two parameters that trip people up:<\/p>\n