Oracle Cloud BYOIP: bring your own IPv4 addresses to OCI

You import the block, prove you hold it with a token in its registry record and a ROA for Oracle's ASN, and advertise it when you are ready.

What Oracle Cloud accepts

From Oracle's documentation, on the day we checked:

• Size. IPv4 blocks of "a minimum of /24 and a maximum of /8".
• Registry and status. Only these:

• Ownership. "You must have ownership" of the block, registered with a supported registry.
• History. A clean one: Oracle may reject a range containing an address associated with malicious behavior (keeping a block clean).
• Who originates. Oracle, from AS31898, except in Serbia Central (Jovanovac), which uses AS14544. Your own ASN is possible through BYOASN.
• Where. One Oracle region per block, and one compartment at a time.
• How many. Oracle's BYOIP page allows "up to 20 IPv4 CIDR blocks or IPv6 prefixes" for your account, and its limits table sets that limit per region.
• Which accounts. Not the Free Tier, and pay-as-you-go customers must request it.
• Price. Oracle's BYOIP documentation names no price.
• Timing. Up to a day for the registry changes to take effect, then up to 10 business days.

Before you start

A ROA for Oracle's ASN, AS31898 or AS14544 in Serbia Central, with an expiry date at least six months in the future (RPKI and ROAs). Without it, Oracle cannot advertise the block.

The OCITOKEN in the registry record. The console shows it ready to paste, as OCITOKEN::203.0.113.0/24:<validationToken>. Through the API or CLI you build that string yourself from the returned token. Where it goes:

No letter of authorization or route object. Oracle asks for neither, and it creates the route object in RADb itself, under its own ASN.

Step by step

01Start the import. In the region you want, open Networking, then IP management, then BYOIP, and select Import BYOIP CIDR block/prefix with a name, a compartment and the block. With the OCI CLI:

oci network byoip-range create --compartment-id <compartment-ocid> \
  --cidr-block 203.0.113.0/24 --display-name byoip-203-0-113-0-24

02Add the token to the registry record, as in the table above. It can take up to a day to take effect.

03Create the ROA for AS31898 at your registry.

04Finish the import once both are visible, with Finish Import on the request's details page, or:

oci network byoip-range validate --byoip-range-id <byoip-range-ocid>

Allow up to 10 business days. The work request shows the progress.

05Fill a public IP pool. Add the block to a pool (Manage BYOIP CIDR block, then Add to public IP pool) and reserve addresses from it. A pool takes ranges from /28 to /24, so a /24 goes in whole and a larger block as /24s or smaller subranges:

oci network public-ip-pool create --compartment-id <compartment-ocid> --display-name pool-203-0-113-0-24
oci network public-ip-pool add --public-ip-pool-id <pool-ocid> \
  --byoip-range-id <byoip-range-ocid> --cidr-block 203.0.113.0/24
oci network public-ip create --compartment-id <compartment-ocid> \
  --lifetime RESERVED --public-ip-pool-id <pool-ocid>

06Advertise. The block must be provisioned first. Select Advertise on its details page, or:

oci network byoip-range advertise --byoip-range-id <byoip-range-ocid>

Oracle's page says nothing about the same block being announced elsewhere at the same time, so plan the cut-over so that only one network announces it.

Your own ASN

With bring your own ASN (BYOASN), Oracle announces the block with your ASN as origin and its own behind it as a transit ASN. You import the ASN with a token on the ASN's registry record, which takes up to 10 business days, create ROAs for both your ASN and Oracle's, and choose Update Origin ASN on the block, with up to 20 prepends if you want them. Oracle keeps the RADb route object under its own ASN and adds yours to an AS-SET, so if a network filters strictly, update RADb with your ASN as origin. Oracle warns that some networks take up to 24 hours to pick up the change.

Mistakes that cost a day

• Finishing the import too early. Selecting Finish Import before the token and the ROA have taken effect can delay the process by up to a day.
• The token on the organization. Oracle is explicit: the token goes on the address range's record, not on the record of the organization that holds it.
• A status Oracle does not list. ASSIGNED PA at the RIPE NCC and reassignments at ARIN are not on the list. Check the record before you lease or buy.
• Withdrawing is not leaving. A withdrawn block keeps its entries in Oracle's geolocation and RADb records until you delete the BYOIP range as well. A deleted range needs the whole import again.

If you lease the block

Oracle says you must have ownership of the block, registered with a supported registry, and publishes nothing specific about leased space. The holder does the registry side: the OCITOKEN on the range's record, which only the holder's maintainer can edit, and the ROA for Oracle's ASN, plus one for your ASN if you use BYOASN. Before you sign, check the status of the record the token goes on: leased space in the RIPE NCC region is usually registered as ASSIGNED PA, which is not on Oracle's list. Oracle asks for no letter of authorization.

Where RTM Networks fits

We lease /24s and larger from our own RIPE NCC address space, and sell blocks in the RIPE NCC, ARIN and APNIC regions. Because Oracle does not list ASSIGNED PA, a block for OCI is usually better bought than leased: transferred into your own LIR account, it is registered as ALLOCATED PA, which Oracle lists (buy IPv4). For PI or legacy space we sponsor, we add the OCITOKEN and create the ROA for Oracle's ASN, and we sponsor the AS number BYOASN needs (sponsoring). For fewer than 256 addresses on an OCI instance, we announce a block ourselves and deliver it over GRE or WireGuard, in any size down to a single address (GRE and WireGuard tunnels). Other providers: BYOIP guides.