PI vs PA Resources: Key Differences

PA (Provider Aggregatable) space is carved from an LIR's allocation, registered by that LIR, and goes back to it when your contract or lease ends. PI (Provider Independent) space is assigned by the RIPE NCC to your organization, through a sponsoring LIR or a direct contract, and stays registered to you when you change transit provider or LIR (ripe-637). In the RIPE region new PI exists only in IPv6: the RIPE NCC no longer assigns PI in IPv4 except to Internet Exchange Points (ripe-826).

What is the difference between PI and PA address space?

Provider Independent (PI) addresses are registered by the RIPE NCC to your organization and stay yours whichever transit provider you use, as long as a sponsoring LIR contract or a direct contract with the RIPE NCC is in place (ripe-637).

Provider Aggregatable (PA) addresses are allocated to Local Internet Registries (LIRs), most of them ISPs, which then sub-allocate or assign them to their customers.

PI trades an extra routing-table entry for the right to keep the block; PA keeps the routing table small and ties the block to one LIR.

For the definition and the policy background, see Understanding Provider Independent (PI) Resources.

Source and Assignment Authority

Provider Aggregatable (PA) Addresses

Source: PA addresses come from allocations given to Local Internet Registries (LIRs).

ripe-826 section 7.0 says: "LIRs are allocated Provider Aggregatable (PA) address space. They sub-allocate and assign this to downstream networks."

Assignment process:

1. RIPE NCC allocates large blocks to LIRs (typically ISPs)
2. LIRs maintain these allocations in their pools
3. LIRs assign portions to their customers based on demonstrated need
4. LIRs register assignments in the RIPE Database

Registration: the RIPE NCC's PA and PI FAQ puts it this way: "PA addresses are assigned from an LIR's allocation and are registered in the RIPE Database by the LIR."

Provider Independent (PI) Addresses

Source: PI addresses are assigned separately, not from any LIR's allocation pool.

The same FAQ: "PI address space is assigned separately and not from an LIR's PA allocation. All PI assignments are registered in the RIPE Database by the RIPE NCC at the time they are assigned."

Assignment process:

1. End user requests PI assignment (directly or through sponsoring LIR)
2. RIPE NCC evaluates request against PI assignment policies
3. Upon approval, RIPE NCC assigns space from dedicated PI pools
4. RIPE NCC registers the assignment in the RIPE Database

The key distinction: PA space flows through the LIR hierarchy, while PI space comes directly from the RIR to the end user.

In the RIPE Database: an IPv6 PA assignment is an inet6num with status: ASSIGNED (or AGGREGATED-BY-LIR) under the LIR's ALLOCATED-BY-RIR block; a PI assignment carries status: ASSIGNED PI and a sponsoring-org: attribute that only the RIPE NCC sets (RIPE Database documentation). IPv4 inetnum objects use ASSIGNED PA and ASSIGNED PI (ripe-826 section 7.0).

Portability and Provider Independence

PA Address Portability

Non-portable: PA addresses are tied to your contract with the LIR that assigned them.

ripe-826 requires the LIR to give the End User this warning: "Assignment of this IP space is valid as long as the criteria for the original assignment are met and only for the duration of the service agreement between yourself and us. We have the right to reassign the address space to another user upon termination of this agreement or an agreed period thereafter."

Implications of changing ISPs:

• You must return PA addresses when you terminate service
• Your network requires complete renumbering
• All DNS records need updating
• Firewall rules, ACLs, and security policies require revision
• Certificates and services tied to IP addresses must be reconfigured
• Downtime during the transition period

Use case fit: PA addresses work well when you:

• Have a stable, long-term relationship with a single ISP
• Can tolerate renumbering if you change providers
• Want to minimize costs and administrative overhead

PI Address Portability

Portable: PI stays registered to your organization when you change transit provider or sponsoring LIR, as long as the sponsorship contract and RIPE policies are respected.

The condition is a contract with a sponsoring LIR, or with the RIPE NCC directly (ripe-637 section 2.0). Without a contract the resources return to the RIPE NCC by default.

If your sponsoring LIR stops sponsoring the block or closes, the RIPE NCC gives you 10 working days, then 10 more after its own notice, to sign with a new sponsor before deregistration starts (ripe-815). You can change your sponsoring LIR at any time without renumbering: only the sponsoring-org: attribute changes.

Provider independence benefits:

• Switch ISPs without renumbering your network
• Maintain all services, configurations, and DNS during provider changes
• No downtime related to address changes
• Freedom to negotiate with multiple providers
• Use competition between ISPs for better rates

Multi-homing capability: PI addresses enable connecting to multiple ISPs simultaneously for:

• Redundancy and failover protection
• Load distribution across links
• Traffic engineering and path optimization
• Increased resilience

Use case fit: PI fits when you:

• Need stable addressing for public-facing services
• Want freedom to change providers without disruption
• Operate data centers or hosting services
• Bring your own addresses to a cloud: BYOIP at AWS, Azure or Google needs space registered to your organization

Routing and Internet Reachability

PA Address Routing Advantages

Aggregation efficiency: The fundamental advantage of PA addresses is aggregation.

The RIPE NCC FAQ: "The advantage of PA addresses is that the routing information for many customers can be aggregated once it leaves the provider's routing domain."

How aggregation works:

• An ISP receives a /19 allocation (8,192 addresses)
• They assign /24 blocks to 32 different customers
• The ISP announces only the /19 to the global Internet
• One routing table entry covers all 32 customer assignments

Global routing impact: This aggregation keeps down the size of the global routing table. Without PA aggregation, the Internet routing infrastructure would face severe scalability challenges.

Routing acceptance: a PA assignment travels inside the LIR's aggregate, so no network has to accept a separate prefix for it.

Can PA be multihomed? Yes. The simplest case is a block leased from an LIR that is not one of your upstreams, announced from your own ASN to each transit. What PA cannot do is move with you when the lease or contract with that LIR ends.

PI Address Routing Considerations

Lack of aggregation: PI assignments typically require individual routing table entries.

The FAQ again: "PI assignments are usually small; they cannot be aggregated into larger blocks."

Routing table impact: Each PI assignment adds to the global routing table:

• More memory required in Internet routers
• Longer BGP convergence times
• Increased routing protocol overhead
• Scalability concerns for Internet infrastructure

Routing acceptance challenges: Not all networks guarantee to route PI addresses.

The FAQ continues: "The disadvantage of this is that networks operators throughout the Internet may choose not to route them."

Practical considerations:

• PI in IPv6 comes from a designated block "to facilitate filtering practices" (ripe-738 section 7) and is assigned as a /48 minimum
• A ROA for your prefix and origin ASN, and a route6 (or route) object
• Working with well-connected ISPs helps

Who signs the ROA: for PA, the LIR creates the ROA from its own RPKI certificate; on a /48 leased from us we create and maintain it. For PI, the RIPE NCC issues the certificate to the End User: ROAs are created in the End User's own hosted CA, which requires the signed End User Assignment Agreement and a RIPE NCC Access account authorized to maintain the organization object (RIPE NCC, RPKI for PI End Users). The sponsoring LIR's certificate never covers PI space. In the RIPE region, 77% of IPv4 space and 45% of IPv6 space were covered by ROAs in August 2026 (RIPE NCC member update). Step by step: how to create RPKI ROAs at the RIPE NCC; check a prefix with the RPKI checker.

Routing is never guaranteed: "There is no guarantee that any address allocation or assignment will be globally routable" (ripe-738 section 4.2). This holds for PA and PI alike.

Ownership and Control

PA Address Control

The LIR holds the allocation: you receive an assignment from that allocation.

What the LIR controls:

• No direct relationship with RIPE NCC for the addresses
• The LIR controls the RIPE Database entries
• Reverse DNS delegated by the LIR inside its zone (on our leased blocks you submit the nameservers from the dashboard)
• Transfer rights remain with the LIR, not the assignment holder

Dependency relationship: Your right to use PA addresses derives from your contract with the LIR.

PI Address Control

Direct registration: the assignment is registered in your organization's name. Addresses are registrations, not property: ripe-738 section 4.1 says address space is "licensed for use rather than owned".

Greater control:

• Direct or sponsored relationship with RIPE NCC
• Control over RIPE Database objects (through maintainer)
• Your own domain object for reverse DNS in the RIPE Database
• Can transfer the assignment to another organization under ripe-807, for IPv4 and IPv6 assignments alike; the receiver needs its own sponsoring LIR or a RIPE NCC contract. RIPE NCC transfers are free of charge and in most cases complete within one or two business days (RIPE NCC transfers page). IPv6 has no 24-month transfer restriction.

Contractual relationship (ripe-637 section 2.0): "End Users of provider independent resources are responsible for maintaining a contractual link to the RIPE NCC either through a sponsoring LIR or else directly to the RIPE NCC for the purposes of managing these resources."

Cost Comparison

PA Address Costs

Included in service: PA addresses are typically provided as part of your ISP service contract.

No direct fees: You don't pay RIPE NCC directly for PA addresses.

ISP costs: Address costs are incorporated into:

• Monthly service fees
• Setup charges
• Port costs
• Bandwidth pricing

Lower barrier to entry: No upfront costs or separate contracts for address space.

PA leased from an LIR that is not your ISP: we lease /48 PA blocks from our own RIPE NCC allocation at €40 per year (as of September 2026), see leased IPv6 blocks. The block activates together with your ASN, we manage its RPKI and reverse DNS, and it returns to the pool if you end the lease. More on this model in IPv6 Leasing Benefits for ISPs.

PI Address Costs

RIPE NCC fees (Charging Scheme 2026, ripe-848):

• Each PI assignment, IPv4 or IPv6: €75 per year
• ASN (needed to announce PI yourself): €50 per year

Under the 2027 scheme (ripe-867, adopted May 2026) the €75 per independent assignment is unchanged; the first ASN registered to an LIR account is included in the €1,894 LIR fee and each additional ASN stays €50.

Through a sponsoring LIR: the sponsor passes on the RIPE NCC fee and adds its own service fee. Our IPv6 PI /48 costs €300 setup plus €135 per year (€75 RIPE NCC fee plus €60 service fee), so €435 the first year and €135 per year after that.

Additional costs:

• BGP-capable router hardware
• Technical staff expertise

Cost-benefit analysis: While PI resources have direct costs, they can provide savings through:

• Elimination of renumbering costs
• ISP negotiating flexibility
• Reduced downtime from provider changes
• Multi-homing without NAT complexity

Availability: IPv4 vs IPv6

IPv4 Availability

PA addresses: from blocks ISPs and LIRs already hold. An LIR that never received IPv4 gets exactly one /24, once, from a waiting list: 791 LIRs were queued on 25 September 2026 and the first in line had waited 485 days (RIPE NCC IPv4 waiting list).

PI addresses: No longer available as new assignments from RIPE NCC.

The policy text (ripe-826 section 7.0): "The RIPE NCC no longer allocates or assigns PI address space, except for assignments to Internet Exchange Points as described in section 6.1."

Your options in IPv4:

• Transfer market: buy an existing IPv4 PI or PA block. Prices ran about $23.50 per address for /22 to /24 blocks in August 2026 according to broker IPv4.Global (monthly averages, online and private sales mixed, priced at agreement date). RIPE NCC transfers are free (ripe-807).
• Leasing: Rent IPv4 space (typically PA from brokers)
• IPv6 deployment: Transition to IPv6 as primary addressing

IPv6 Availability

Both PA and IPv6 PI readily available: The vast IPv6 address space means both options remain accessible.

PA addresses: LIRs receive minimum /32 allocations and can assign to customers as needed.

PI addresses: a /48 minimum (ripe-738 section 7.1), larger only with the address-usage or routing justification of section 5.4.2, no multihoming requirement. Proposal 2024-01 (nibble-boundary PI up to /36, version 3.0 of 25 August 2026) closed its Review Phase on 23 September 2026 and stays a proposal until the RIPE community adopts it (proposal page).

What each type requires from you

PA Address Technical Requirements

Minimal complexity:

• Standard customer edge router
• Static routing or basic dynamic routing
• ISP handles all BGP and Internet routing
• Simple configuration and management

ISP support: Your ISP manages:

• BGP routing and announcements
• Route filtering and policies
• Peering relationships
• Traffic engineering

Lower expertise needs: Basic networking knowledge sufficient for most PA deployments.

PI Address Technical Requirements

Higher complexity:

• BGP-capable edge routers (enterprise-grade)
• An ASN of your own: through our ASN registration it costs €130 per year (as of September 2026)
• BGP routing protocol expertise
• Route policy configuration
• RPKI implementation

Independent management: You or your team handles:

• BGP configuration with multiple ISPs
• Route announcements and filtering
• Traffic engineering policies
• Monitoring and troubleshooting
• RIPE Database maintenance

Expertise requirements:

• BGP protocol understanding
• Internet routing knowledge
• RIPE policy familiarity
• Network security best practices

Alternative: a sponsoring LIR or a managed service provider can run the BGP side for you.

PA Address Compliance

ISP responsibility: The LIR maintains primary responsibility for policy compliance.

End user obligations:

• Use addresses as specified in service agreement
• Don't redistribute or sublease addresses
• Provide accurate information to ISP

RIPE oversight (ripe-826): "The LIR is contractually responsible for ensuring the address space allocated to it is used in accordance with the RIPE community's policies."

PI Address Compliance

Direct obligation: PI holders bear direct responsibility for policy compliance.

Requirements from RIPE policy:

• Maintain contractual relationship with RIPE NCC
• No sub-assignment of prefixes to other organizations. Single addresses on your own links (guest Wi-Fi, a customer's server on your LAN, point-to-point links) are allowed (ripe-738 section 2.6).
• Keep RIPE Database information current
• Respond to RIPE NCC inquiries and audits
• Pay annual fees on time

Resource types covered (ripe-637 section 1.1): "Provider independent resources include autonomous system numbers, provider independent IPv4 address assignments, anycast assignments, provider independent IXP IPv6 address assignments, and all future provider independent resource assignments to End Users." IPv6 PI falls under the same contract through ripe-738 section 7.

Registration data: the sponsoring LIR must keep your registration data current and may ask you for updated documents (ripe-637).

Decision Framework: Which is Right for You?

Choose PA Addresses When:

• One ISP is enough and will stay enough
• You want the lowest direct cost
• You want the ISP to handle routing
• You expect to stay with one LIR for the long term
• You can renumber if you change provider

Choose PI Addresses When:

• You need several upstreams and want to change them freely
• You must not be locked to one provider
• Your infrastructure depends on addresses that never change
• Your business model involves switching ISPs
• You or a consultant can run BGP
• You are building infrastructure for years ahead
• You run hosting services that need stable addressing
• Your Internet presence cannot go down during a provider change

Weighing your own RIPE NCC membership against sponsored PI instead? See LIR vs PI: Which is Right for You?.

Hybrid Approaches

Some organizations use both PA and PI addressing:

• PA for general use: Standard office networks, non-critical services
• PI for public-facing services: Data centers, key applications

Three Examples

Example: PA for a Regional Office

Scenario: A 50-person regional office of an international company.

Requirements:

• Internet access for staff
• VPN connectivity to headquarters
• Standard office applications
• Single ISP connection

Decision: PA addresses

• Cost-effective solution
• ISP handles all routing
• No multi-homing needs
• Renumbering acceptable if changing ISPs

Example: PI for a Hosting Provider

Scenario: A hosting company offering dedicated servers and colocation.

Requirements:

• Stable IP addressing for customer servers
• Multi-homing for redundancy
• Provider independence
• Professional network operations

Decision: IPv6 PI for its own infrastructure and for single addresses on server links (ripe-738 section 2.6 allows these). Any prefix it delegates to a customer is a sub-assignment, which PI forbids, so customer prefixes come from PA space. IPv4 comes from blocks it already holds or buys on the transfer market.

• Customer services require stable IPs
• Cannot renumber its own infrastructure
• Multi-homing needed for uptime
• Technical expertise available in-house

Example: Hybrid for an Enterprise

Scenario: Large enterprise with headquarters, regional offices, and data center.

Requirements:

• Public-facing services in the data center
• Standard connectivity for offices
• Cost optimization
• Operational efficiency

Decision: Hybrid approach

• PI addresses for the data center (multihomed, public-facing services)
• PA addresses for office locations (cost-effective, manageable)

Summary: Key Differences at a Glance

Frequently Asked Questions

Can I convert my PA addresses to PI addresses?

No, you cannot convert PA to PI. They're fundamentally different types of assignments. To move from PA to PI, you must obtain a PI assignment and renumber your network. Organizations sometimes start with PA and move to IPv6 PI once they need a block that follows them between LIRs; the move is a renumbering either way.

From PA to PI:

1. Obtain the PI assignment (new in IPv6; by transfer in IPv4)
2. Configure parallel infrastructure with PI addresses
3. Update DNS records with parallel entries
4. Gradually migrate services to PI addressing
5. Decommission PA addresses after full migration
6. Return PA space to ISP

From PI back to PA:

1. Arrange PA addresses with your ISP or LIR
2. Plan service migration timeline
3. Update configurations, DNS, and dependencies
4. Terminate the PI contractual relationship

Do I need an ASN to use PI addresses?

Not required by policy: ripe-738 asks for no multihoming and no ASN for IPv6 PI. In practice you announce PI from your own ASN. Most benefits of PI addressing come from using your own ASN for BGP routing. Static routing PI addresses through a single ISP negates most PI advantages.

Which is more expensive long-term?

In IPv6, a leased PA /48 costs €40 per year and an IPv6 PI /48 €435 the first year, then €135 per year (our prices, September 2026). Either one needs an ASN (€130 per year through our sponsorship) to be announced from your own network. PI costs more because the RIPE NCC charges €75 per year for each PI assignment (ripe-848) and reviews the application. What PI buys is the right to keep the block when you change LIR.

Can I use PI addresses with just one ISP?

Yes, but you lose most PI benefits. Single-homed PI addresses provide stable addressing and provider switching flexibility but don't enable multi-homing benefits.

What if my ISP won't route my PI addresses?

Another upstream can carry it; that is the point of PI. Before you switch, check that a ROA from your End User hosted CA authorizes your ASN and that a route6 object exists: a route that is RPKI-invalid is dropped by networks doing route origin validation, and APNIC Labs measured 26.92% of users behind such networks on 29 July 2026 (APNIC blog).

Can I still get IPv4 PI in 2026?

No. The RIPE NCC no longer assigns IPv4 PI to End Users, only to Internet Exchange Points (ripe-826). An existing IPv4 PI block can be bought on the transfer market (about $23.50 per address for /22 to /24 in August 2026, IPv4.Global) and registered to you through a sponsoring LIR; a block you already hold can move to another sponsoring LIR without renumbering.

Do I own my PI addresses?

No one owns IP addresses, the RIPE NCC included. ripe-738 section 4.1 says address space is licensed for use rather than owned. PA and PI are both registrations held under contract and RIPE policy; PI is registered to your organization, PA to the LIR.

Next Steps

PI costs more and needs BGP from your own ASN, so it pays off only when the block must follow you. If you need a block that moves with you between LIRs, apply for PI in IPv6: a /48 costs €435 the first year and €135 per year after that (as of September 2026). If you need a /48 announced from your ASN now and can give it back when the lease ends, lease PA. If you already hold IPv4 PI or IPv6 PI and your LIR is closing or dropping you, move it to a new sponsoring LIR without renumbering. Questions about your own case go through the contact form.

Related reading:

• IPv4 PI Eligibility Requirements (2026): Who Still Qualifies and What Holders Must Keep
• IPv6 PI Allocation Sizes Explained
• RIPE PI Resource Application Process