Cherry Servers BYOIP: your own IP prefix, from Cherry's ASN or yours

Without an ASN of your own, you provide a route object, a ROA and a letter of authorization that name Cherry's ASN. With your own ASN, Cherry validates it and your ROAs, and your servers announce the prefix over BGP to Cherry's routers.

What Cherry Servers accepts

From Cherry Servers' documentation, on the day we checked, for both routes:

• Size. "/24 (256 IP addresses) to /20 (4,096 IP addresses)", up to six prefixes per request. Cherry recommends aggregating into /23, /22, /21 or /20 blocks; for more than six prefixes, contact support.
• Registry. Not stated. You make the changes at the registry or routing registry where the prefix, or your ASN, is registered.
• PA, PI or legacy. Not mentioned.
• Who originates. Cherry's ASN for the location, or your own ASN with Cherry's as your upstream. Cherry says "each Cherry Servers data center operates under a distinct ASN".
• Where. Šiauliai, Frankfurt, Amsterdam, Stockholm, Singapore, Tokyo and Chicago.
• Price. €200 or $229 once per request, "not per subnet". Custom work, such as changing configured subnets or custom routing, may cost more.
• Timing. Validation up to 24 hours. Provisioning "can take several business days", with requests handled from 08:00 to 17:00 EET on Lithuanian business days.
• Reputation. Prefixes should not be on public blocklists for botnets or spam, since ISPs may filter them (keeping a block clean).

Before you start

A route: Cherry's ASN or yours. Without an ASN of your own, Cherry announces the prefix. With one, your servers announce it over BGP. If you want your own ASN and do not have one, a sponsoring LIR can arrange it.

Cherry's ASN for your location. The route object and the ROA name it on the route without your own ASN, and your aut-num names it on the other:

A ROA on every prefix, for Cherry's ASN or for yours: "IP prefixes must have valid ROA records". Set the maximum length to what will be announced (RPKI and ROAs).

A route object. Without your own ASN, Cherry asks for one with its ASN as origin. Its page for your own ASN does not ask for one; create one anyway, with your ASN as origin, because many networks build their filters from the routing registries.

A letter of authorization. Cherry requires it on the route without your own ASN, and recommends it on the other. For the first route, Cherry lists what it must hold: the date, Cherry Servers and its ASN for the location, the range, a statement that the owner authorizes Cherry to announce it, and the owner's name and address as registered with the registry, signed.

There is no token or certificate to add to the registry record.

Step by step

Without your own ASN

01Tell support. Cherry asks you to let its support engineers know that you intend to bring your own IP range.

02Create the route object and the ROA for Cherry's ASN at your location. For Amsterdam, in the RIPE Database:

route:   203.0.113.0/24
origin:  AS59642
mnt-by:  YOUR-MNT
source:  RIPE

03Submit for validation: the prefixes, the ROA records and the letter of authorization. Cherry then announces the range and routes it to your servers.

With your own ASN

01Tell support. Cherry asks you to let its support engineers know that you intend to bring your own ASN and IP range.

02Update your aut-num with Cherry's ASN for the location. For Amsterdam, with 64500 as your ASN:

import:  from AS59642 accept ANY
export:  to AS59642 announce AS64500

03Submit for validation: your ASN, the prefixes, the ROA records and, as recommended, the letter of authorization. Cherry says verification can take up to 24 hours.

04Set up BGP. After validation, Cherry assigns your ASN to your project. Activate Local BGP for the project in the client portal (Network, Local BGP, Activate). The server's own Network, Local BGP page then gives the BIRD setup commands, with the local ASN, the remote ASN and the peer addresses. Add your prefix as a static route, as Cherry documents for BIRD 1.6, with 192.0.2.10 standing for your server's main IP:

protocol static stat_my_pfx {
  table master;
  route 203.0.113.0/24 via 192.0.2.10;
}

Cherry gives no configuration for Windows, which may need a third-party BGP client.

On either route

Wait and check. Allow up to 24 hours for networks worldwide to pick up the route. Cherry suggests Hurricane Electric's BGP Toolkit (bgp.he.net) and RIPEstat. The RPKI state should read valid for the ASN that originates the route, Cherry's or yours, in place of <ASN>:

curl "https://stat.ripe.net/data/rpki-validation/data.json?resource=<ASN>&prefix=203.0.113.0/24"

Mistakes that cost a day

• Paying twice. The fee is per request, so put every prefix, up to six, in one.
• A Friday afternoon request. Requests are handled from 08:00 to 17:00 EET, so one sent late on a Friday usually starts on Monday.
• The ASN of another site. Each data center has its own ASN, and your ROA and route object, or your aut-num, must name the one where your servers are.
• Gateway mode for virtual machines. Ranges are set up as a static route by default. Virtual machines on servers in different network segments may not be able to share a gateway subnet, so ask for your servers in one segment, or for the range split, for example into four /26s.
• Anycast across sites. Some routers reject a route that carries your ASN twice in its path, so traffic between your own locations can fail. Cherry does not promise that anycast traffic follows the path you intend.

If you lease the block

Cherry's page for the route without your own ASN allows for leased space: it notes that an IP renting service may create the route object and the ROA for you, and let you download the letter of authorization. Neither of Cherry's pages asks for the block to be registered in your name or for you to be an LIR. The holder does the registry side for the prefix: the route object and the ROA, for Cherry's ASN or for yours, and the letter of authorization, whose owner details must match the registry record. With your own ASN, the import and export lines go on your ASN's own record, which you or your sponsoring LIR maintain.

Where RTM Networks fits

We lease /24s and larger from our own RIPE NCC address space, and sell blocks in the RIPE NCC, ARIN and APNIC regions. For space leased from us, we create the ROA and the route object for Cherry's ASN or for yours, and sign the letter of authorization (lease IPv4). If you want to announce from your own ASN and do not run an LIR, we sponsor AS numbers (ASN sponsorship). For fewer than 256 addresses, we announce the block ourselves and deliver it to your Cherry Servers machine over GRE or WireGuard, in any size down to a single address (GRE and WireGuard tunnels). More providers are in our BYOIP guides.