Routing and security guide
RPKI ROA for leased IPv4 and IPv6 prefixes
An RPKI Route Origin Authorization (ROA) tells route-origin validators which autonomous system may originate a prefix, including its authorised maximum prefix length. It supports routing security but does not connect or announce a network.
Who controls the ROA?
The RPKI resource certificate holder, or a party it authorises through the applicable system, can create and sign a ROA. A leased-resource customer normally asks the provider or holder to coordinate the record for the approved origin ASN. Elisteka reviews the requested ASN, network prefix, maxLength and upstream before coordinating an agreed change. An LOA does not grant RPKI signing authority.
ROA, route6 and BGP are different
- ROA: a signed prefix/origin-AS authorisation used in RPKI origin validation.
- route6 (or route for IPv4): an IRR database object indicating routing intent.
- LOA: a supporting letter some providers request before accepting a customer's announcement.
- Reverse DNS: delegated or coordinated PTR infrastructure, not a routing authorisation.
- BGP: the actual route advertisement made through a participating upstream or network.
How Elisteka coordinates leased space
- Submit an IPv6 or IPv4 enquiry and describe intended use, origin ASN and upstream.
- After business/technical review and a signed agreement, agree the exact prefix, origin ASN, ROA maxLength, IRR route or route6, LOA (where applicable) and rDNS scope.
- Coordinate the authorised record changes and confirm that upstream policies permit the route.
- Check the intended announcement against RPKI validation and IRR information; monitor any later ASN or prefix changes with the upstream.
All resource actions require human approval. Neither an LOA nor ROA guarantees worldwide routing or any provider's acceptance.
Lease prices and availability
IPv6 /32 leasing is €29 per month excluding VAT, with the first 3 months (€87) paid upfront. IPv4 /24 has a published rate of €105 per month, but all Elisteka IPv4 space is leased and new requests join a waiting list. Use the aggregate IPv6 inventory for current verified capacity; it is not a reservation.
Frequently asked questions
What is an RPKI ROA?
A Route Origin Authorization is a signed RPKI statement linking an IP prefix and maximum prefix length to an authorised origin ASN. Networks can use it for route-origin validation.
Who creates the ROA for leased space?
The resource holder or another authorised party with control of the relevant RPKI certificate creates or updates the ROA. A lessee cannot independently sign a ROA without that authority. Elisteka coordinates the agreed change.
Does a ROA announce my prefix?
No. BGP origination, upstream acceptance and propagation are separate operational steps. A ROA is validation information, not a BGP advertisement.
What is the difference between ROA and route6?
A ROA is signed RPKI route-origin data. A route6 object is an Internet Routing Registry record expressing IPv6 routing intent. They are separate and may both be needed for upstream policy.
Why does maximum length matter?
A ROA's maxLength sets the longest more-specific route that the stated ASN may originate without being RPKI-invalid under that ROA. It must be agreed carefully to avoid unexpected route rejection.
What happens if our ASN changes?
Contact the provider before moving origin to coordinate the revised ROA and routing objects. An old ROA can cause the new origin to be RPKI-invalid.
Is an LOA the same as a ROA?
No. A Letter of Authorisation is a document some upstreams request; a ROA is a cryptographically signed RPKI object.
Read the IPv6 routing checklist and acceptable-use requirements, or contact sales@elisteka.com.