Alibaba Cloud BYOIP: your own /23 or larger as Elastic IP addresses

You point the route object for your range at Alibaba Cloud's ASN and submit a ticket. Once the ticket is approved, Alibaba Cloud advertises the range from the region you named in it.

What Alibaba Cloud accepts

From Alibaba Cloud's documentation, on the day we checked:

• Size. A /23 or larger: "Prefixes longer than /23, such as /24, are not supported." IPv4 only.
• Registry. The range "must be registered with a Regional Internet Registry (RIR)". Alibaba Cloud publishes nothing on PA, PI or legacy status, or on whose name the range must be in.
• Who originates. Alibaba Cloud, from AS45102. "You cannot use your own ASN."
• Regions. US (Silicon Valley), US (Virginia), China (Hong Kong), Singapore, Malaysia (Kuala Lumpur), Japan (Tokyo), Indonesia (Jakarta), Germany (Frankfurt) and UK (London). Not the Chinese mainland.
• History. Alibaba Cloud may investigate a range and reject one with "adverse records and a history of malicious activity" (keeping a block clean).
• Price. "The BYOIP feature is free of charge." The EIP configuration fee, for holding an Elastic IP address, is waived, and you pay for bandwidth.
• Timing. About one month, "depending on the time it takes for Alibaba Cloud to apply for and advertise the IP addresses".

Before you start

A route object with origin AS45102. Alibaba Cloud asks you to set the origin for your range to AS45102 in the routing registry, following your registry's own instructions, and to check the result in RADb. In the RIPE Database it looks like this; the documentation ranges are all /24s, so the prefix is a placeholder:

route:    <your-prefix>/23
descr:    Example B.V.
origin:   AS45102
mnt-by:   EXAMPLE-MNT
source:   RIPE

A valid ROA. Alibaba Cloud makes this your responsibility: if the ROA becomes invalid, networks that do route origin validation drop the route, and Alibaba Cloud may stop advertising it. Its page does not spell the ROA out. A route from AS45102 is only valid if a ROA names AS45102 for the prefix as it is announced, so create that one (RPKI and ROAs).

What the ticket needs. The range, the region, and confirmation that the origin is now AS45102. "No other information is required at this time." Alibaba Cloud asks for no certificate, token or letter of authorization.

Step by step

1. Update the routing registry. Create or change the route object so its origin is AS45102, then confirm it in RADb, for instance with whois -h whois.radb.net <your-prefix>/23.
2. Create the ROA for AS45102 at your registry.
3. Submit a ticket asking for BYOIP, with the range, the region and the confirmation of the origin change. If you want BGP (Multi-ISP) Pro advertisement, say so in the same ticket.
4. Wait for the assessment. A representative contacts you if more is needed, and "to discuss and finalize the terms", so keep your contact details current. After approval, Alibaba Cloud advertises the range from the region with AS45102 and adds it to its security protection list.
5. Allocate EIPs. In the Elastic IP Address console, select the region and click Apply for Specific EIP. You can also add the range to an IP address pool and allocate from that. The pool feature is off by default, and your account manager enables it.
6. Check from outside. RIPEstat's validator should call the range valid for AS45102:

curl "https://stat.ripe.net/data/rpki-validation/data.json?resource=45102&prefix=<your-prefix>/23"

Pitfalls

• A /24 is not enough. Two /24s qualify only if they are the two halves of one /23, and the route object and ROA then cover the /23.
• The pool quota is half a /23. By default, IP address pools hold "a combined maximum of 256 IP addresses across all pools in the region". Ask your account manager for more before you add the whole range to pools.
• An EIP sits behind NAT. Alibaba Cloud's own FAQ says an EIP is not a native public IP: when an ECS instance uses one, its traffic passes through NAT. Software that needs to see its public address on the instance has to allow for that.
• Bandwidth billing only. EIPs from your range are pay-as-you-go by fixed bandwidth, and can join only Internet Shared Bandwidth instances billed the same way.
• Leaving takes a month too. Withdrawing a range takes about as long as bringing it, so plan the exit with the entry.

If you lease the block

Alibaba Cloud publishes no rule on whose name the range must be registered in, and asks for no letter of authorization. What it needs sits in the registry, so the holder does it. The holder creates the route object with origin AS45102, which needs the holder's maintainer, and the ROA for AS45102, kept valid for the whole lease. Only then can you confirm the origin change in your ticket. The lease also has to cover a /23 at least.

Where RTM Networks fits

We lease /24s and larger from our own RIPE NCC address space, the /23 Alibaba Cloud asks for included (lease IPv4), and sell blocks in the RIPE NCC, ARIN and APNIC regions. For space leased from us, we create the route object and the ROA for AS45102. If you need fewer than 512 addresses on an ECS instance, we announce a block ourselves and deliver it over GRE or WireGuard, in any size down to a single address (GRE and WireGuard tunnels). Other providers: BYOIP guides.