{"id":692,"date":"2026-07-13T10:13:04","date_gmt":"2026-07-13T10:13:04","guid":{"rendered":"https:\/\/ip4.market\/blog\/692-2\/"},"modified":"2026-07-13T10:13:06","modified_gmt":"2026-07-13T10:13:06","slug":"rpki-and-roa-setup-for-leased-ipv4","status":"publish","type":"post","link":"https:\/\/ip4.market\/blog\/rpki-and-roa-setup-for-leased-ipv4\/","title":{"rendered":"RPKI and ROA Setup for Leased IPv4"},"content":{"rendered":"
\nIn this article:<\/strong><\/p>\n
    \n
  1. Understanding RPKI and ROA Fundamentals<\/a><\/li>\n
  2. Specific Challenges with Leased IPv4 Subnets<\/a><\/li>\n
  3. Preparation and Prerequisites<\/a><\/li>\n
  4. Step-by-Step ROA Creation Guide<\/a><\/li>\n
  5. Verification and Maintenance<\/a><\/li>\n
  6. Choosing the Right Leasing Partner<\/a><\/li>\n<\/ol>\n<\/div>\n

    If you are running network operations today, you know that securing the routing table isn’t optional anymore. It is an operational necessity. Between BGP hijacks and route leaks threatening stability constantly, implementing a solid RPKI and ROA setup<\/strong> has become the standard defense. It is not just theory. When you deal with leased IPv4 address space, though, things get tricky. You are not the owner, which creates a specific administrative headache regarding rights and authorization. This guide walks you through securing that leased infrastructure using Resource Public Key Infrastructure (RPKI) and Route Origin Authorizations (ROA).<\/p>\n

    Understanding RPKI and ROA Fundamentals<\/h2>\n

    Before touching any configuration files, you need to grasp the mechanics. RPKI is essentially a security framework linking cryptographic keys to IP address blocks. It uses a distributed system of repositories to hold these certificates. The goal is simple: allow Autonomous Systems (AS) to cryptographically sign exactly which prefixes they are allowed to advertise.<\/p>\n

    A Route Origin Authorization (ROA) is a specific digital object within this framework. It tells the world three things:<\/p>\n

      \n
    • The IPv4 Prefix:<\/strong> The specific address block (e.g., 192.0.2.0\/24).<\/li>\n
    • The Origin AS:<\/strong> The Autonomous System number allowed to originate this prefix.<\/li>\n
    • Maximum Length:<\/strong> The longest prefix allowed, which stops more specific hijacks.<\/li>\n<\/ul>\n

      When an ISP creates a ROA, routers performing RPKI validation can verify that the BGP announcement matches the record. If an unauthorized AS tries to announce that prefix, it gets marked as “Invalid”. It gets dropped.<\/p>\n

      Specific Challenges with Leased IPv4 Subnets<\/h2>\n

      Deploying RPKI and ROA setup<\/strong> on address space you own is straightforward. You have the keys. You have the rights. With leased subnets, the “Right of Use” is distinct from ownership. This creates a dependency chain that must be managed carefully, or you risk losing connectivity.<\/p>\n

      When you lease IP space, the lessor keeps the ultimate administrative rights in the Regional Internet Registry (RIR) database\u2014think ARIN, RIPE NCC, or APNIC. You generally cannot create ROAs directly in the RPKI system unless the lessor has delegated specific RPKI permissions to you.<\/p>\n

      \nWarning:<\/strong> Never create a ROA for a leased prefix if you have not confirmed the routing rights with your lessor. Conflicting ROAs (where both lessor and lessee create overlapping records) will render your prefix “Invalid”. The result? Severe network outages.\n<\/div>\n

      Preparation and Prerequisites<\/h2>\n

      To secure leased subnets successfully, you need a clear chain of trust. Do not touch any configuration files until you handle these preparatory steps.<\/p>\n

      1. Verify the LOA and Contract<\/h3>\n

      Your Lease Agreement or Letter of Authorization (LOA) must explicitly grant you the right to advertise the IP prefixes. If the contract is silent on BGP announcements, go back and request an amendment. Without this, you have no standing to request ROA creation.<\/p>\n

      2. Coordinate with the Lessor<\/h3>\n

      There are two common ways to handle ROAs on leased space:<\/p>\n