Private ASN Ranges vs Your Own Public ASN: The Complete Guide

What is a private ASN? A private ASN is an Autonomous System number reserved for internal use only, taken from two ranges defined by RFC 6996: 64512 to 65534 for 16-bit numbers, and 4200000000 to 4294967294 for 32-bit numbers. You can use one for free, right now, with no registration. The catch is absolute: a private ASN must never appear in a route advertised to the global internet, and upstream providers strip or reject it. If you route entirely inside your own network or a cloud VPN, a private ASN is correct. The moment you want to announce your own IP space to two real internet peers, you need a public ASN instead.

The phrase "private ASN" hides two very different questions. Some people are asking about the reserved number ranges you can grab for a lab or an internal fabric. Others really mean "can I, as an individual, get my own AS number without running a company?" This guide answers both, with the exact ranges, the hard limits, a decision table, and the price of the public path.

What are the private ASN ranges?

IANA reserves two blocks of AS numbers for private use, and both are documented in RFC 6996, "Autonomous System (AS) Reservation for Private Use." These numbers work exactly like public ASNs inside BGP, but they carry no global uniqueness, so two different networks anywhere in the world can use the same private ASN at the same time without conflict.

A few numbers sit just outside these windows and are reserved for other purposes. AS 65535 and AS 4294967295 are reserved (RFC 7300), 64496 to 64511 and 65536 to 65551 are for documentation (RFC 5398), and AS 23456 is AS_TRANS, the placeholder that 2-byte-only routers see in place of a 4-byte ASN (RFC 6793). None of these belong in a lab config. For practical work, treat 64512-65534 and 4200000000-4294967294 as your private pools.

If you only need a handful of AS numbers for lab segments, the 16-bit range is plenty and easier to read. If you are building a large fabric where every leaf or every rack gets its own ASN, the 32-bit range gives you almost 95 million to spend, so you never have to recycle numbers.

What are private ASNs actually used for?

Private ASNs solve a real problem: you often need BGP semantics inside a network without wanting, or being allowed, to touch the public routing table. Here is where they show up every day.

Internal BGP and data-center fabrics. Large leaf-and-spine data centers run eBGP between switch tiers with private ASNs (RFC 7938): one ASN shared by the spine layer, one per pod of aggregation switches, one per top-of-rack switch. The 16-bit range holds only 1,023 numbers, so big fabrics either reuse numbers across pods or move to the 32-bit private range. None of this needs registration.

Cloud hybrid connectivity. When you connect on-premises networks to a cloud provider over a private link, private ASNs are the default on both ends. A few concrete examples:

• AWS Direct Connect uses 64512 as the default Amazon-side ASN for the Direct Connect gateway if you do not choose your own. A private ASN on your side is the common, default choice, though AWS does also permit a public ASN (it verifies your ownership of a public ASN before accepting it).
• Azure ExpressRoute uses Microsoft's public AS 12076 on its own edge routers, but the default ASN on an Azure VPN gateway is 65515, a private number, and Microsoft reserves 65515 to 65520 for internal use.
• Google Cloud runs its Cloud Router on a private ASN you pick from either range (16550 on Partner Interconnect). Your on-premises side can be private or public.

Labs, study, and certification prep. If you are learning BGP for a CCNP, JNCIP, or just building a home lab, private ASNs let you run realistic topologies with zero paperwork and zero cost.

Overlay and community networks. dn42 is a large decentralized network run by hobbyists that is explicitly not the public internet. dn42 participants self-allocate from a sub-range of the private 32-bit space, 4242420000 to 4242423999, and connect to each other over tunnels. It is a fantastic place to practice BGP with real peers, but nothing you announce there reaches the global routing table.

Why can a private ASN never touch the public internet?

This is the single most important limit to understand, and it is not a soft convention. RFC 6996 states that private-use ASNs must be removed from AS path attributes before a route is advertised to the global internet. Because these numbers are not globally unique, leaking one would create ambiguity: your prefix and someone else's could both claim to originate from AS 65001, and the internet has no way to tell them apart.

In practice, three things happen if you try to announce space using a private ASN to a real transit provider:

1. Your upstream's routers are configured to strip private ASNs from the path, or
2. Your upstream rejects the announcement outright with a route filter, or
3. If a leak somehow escaped, you would see intermittent, unexplained loss of connectivity as different networks disagreed about the origin.

Cloud edges do the same. On an AWS Direct Connect public virtual interface, AWS replaces your private ASN with its own AS 7224 before your prefixes reach other customers or the internet, and any prepending of your private ASN disappears too.

The rule is simple. If a packet needs to reach a destination on the public internet through your own AS, and you want to control that routing with BGP, a private ASN cannot do the job. That is where a public ASN comes in.

When do you actually need your own public ASN?

You need a public, globally unique ASN when all three of these are true:

• You want to announce your own IP prefixes (IPv4 or IPv6) to the internet under your own routing policy.
• You connect to more than one provider or peer, so your traffic is not simply following your single ISP's routing (this is called being multihomed).
• You need that policy to be visible and stable in the global routing table.

RIPE policy, documented in ripe-679, sets two requirements: a network must be multihomed to qualify for an AS number, and its routing policy must be provided when the number is requested. You describe that policy when you request the number. The goal is to keep the global routing table from filling with AS numbers that add no new routing behavior.

Proposal 2026-01, still being drafted after its Discussion Phase closed on 5 August 2026, would drop that test for a holder's first ASN when the holder already has address space issued by the RIPE NCC. Until it is adopted, multihoming stays mandatory (proposal page).

Common scenarios that genuinely require a public ASN:

• Running BGP with two or more transit providers for redundancy.
• Announcing provider-independent (PI) space you hold under your own routing policy.
• Building anycast so the same prefix is served from multiple locations.
• Peering at an internet exchange under your own identity.

If your setup is a single home connection behind one ISP and you just want to "have an ASN," a public ASN will not do anything for you, because you have no second peer and no independent routing policy to express. That is exactly the case for a lab or for dn42 (see dn42 explained). To go deeper on the distinction between holding your own resources and using a provider's, see PI vs PA resources.

Private ASN vs public ASN: which one by use case?

Can an individual get their own public ASN?

Yes. This surprises people, but you do not need a company, and you do not need to become a RIPE NCC member. A natural person can hold a real, globally unique AS number through a sponsoring LIR (Local Internet Registry). The sponsoring LIR has the contractual relationship with RIPE NCC and submits the request on your behalf, while the AS number is assigned directly to you as the end user.

What you do need to qualify:

• A multihomed network and a routing policy. ripe-679 requires both: you connect to at least two peers or providers, and you describe how your AS routes toward them.
• Two peers or upstream providers. The RIPE NCC request form lists at least two, with their AS numbers and contact addresses. We ask for the provider contracts or invoices.
• A little documentation. You describe your intended peers and routing policy. If you want help getting this right, our guide on how to prepare an ASN justification walks through what reviewers look for, and the complete ASN registration guide covers the full process.

You also need at least one prefix to announce. If you have none, the order form adds one with the ASN: a leased /48 from our allocation, or your own IPv6 PI /48. The RIPE NCC issued 2,175 ASNs in 2026 up to 24 September, all of them 32-bit and none 16-bit, so expect a number above 65535; it has drawn from one undifferentiated pool since 2010 (ripe-679). Your name and address become public in the RIPE Database (no WHOIS privacy exists; phone numbers are never published), and we verify your identity online before filing.

What does a public ASN cost?

A sponsored ASN has two cost lines, and the order page shows both.

RIPE NCC itself charges the sponsoring LIR a fee per resource. Under the RIPE NCC Charging Scheme 2026, that is €50 per year per sponsored ASN. The bigger numbers you sometimes read about, €1,800 annual membership plus a €1,000 one-time sign-up fee, apply only if you become a full RIPE NCC member and run your own LIR. Going through a sponsoring LIR means you never pay those. You pay the LIR's all-in price, and the LIR pays RIPE. From 2027 the account fee rises to €1,894 with the member's first ASN included (ripe-867, adopted at the May 2026 General Meeting). The €50 pass-through on a sponsored ASN stays.

Through our ASN registration service, a sponsored ASN costs €130 per year, all in (as of September 2026): our €80 fee plus the €50 RIPE NCC per-ASN fee, in the first year and at every renewal. You can also prepay year 2 at the order step: €234 for two years, with 20% off our year-2 fee and the RIPE NCC line at cost. Individuals are welcome, not just companies. We keep a running ASN sponsorship price comparison so you can check what different providers charge.

For one ASN, sponsorship costs €130 a year against €1,850 as a RIPE NCC member in 2026, so the sponsored route is dramatically cheaper. Membership pays off once you need allocations of your own; the ASN registration cost breakdown compares the paths line by line.

What about IP space to go with your ASN?

An ASN on its own announces nothing. You need at least one prefix to originate. On IPv6, you have two clean options with us.

The straightforward one is an IPv6 sub-assignment, a /48 from our allocation, leased from €40 per year. It is provider-aggregatable (PA) space and returns to the pool if you end the lease. Because it comes from our block, the RPKI ROAs are set up and managed by us and configured automatically when your ASN is assigned, so you get valid route origin authorization with zero configuration on your side. That is a genuine convenience: RPKI is one of the fiddlier parts of getting a new prefix accepted cleanly, and here it is handled.

If the block must stay yours when you change sponsoring LIR, we also sponsor IPv6 PI: €435 for the first year (€300 setup plus €135), then €135 per year, with RPKI through your own hosted CA.

Quick decision recap

Ask yourself one question: does anything I announce need to reach the public internet under my own routing policy, with more than one peer?

• No. Use a private ASN from 64512-65534 or 4200000000-4294967294. It is free, instant, and correct for labs, internal fabrics, cloud VPNs, and dn42.
• Yes. You need a public ASN. As an individual you can get one through a sponsoring LIR for €130 per year all-in with us, no company and no RIPE membership required, as long as you are multihomed and can describe your routing policy. You can see what any public ASN announces today with our ASN lookup.

The two are not competitors. They solve different problems. Reach for the private range when you are inside your own walls, and step up to a public ASN the day you want a seat at the global table.

Official References

• RFC 6996, Autonomous System (AS) Reservation for Private Use: https://www.rfc-editor.org/rfc/rfc6996.html
• IANA Autonomous System (AS) Numbers registry: https://www.iana.org/assignments/as-numbers/as-numbers.xhtml
• IANA AS Numbers Special-Purpose Registry: https://www.iana.org/assignments/iana-as-numbers-special-registry/iana-as-numbers-special-registry.xhtml
• RIPE NCC Charging Scheme 2026 (ripe-848): https://www.ripe.net/publications/docs/ripe-848/
• RIPE NCC Charging Scheme 2027 (ripe-867): https://www.ripe.net/publications/docs/ripe-867/
• RIPE Autonomous System (AS) Number Assignment Policies (ripe-679): https://www.ripe.net/publications/docs/ripe-679/
• AWS Direct Connect routing and BGP documentation: https://docs.aws.amazon.com/directconnect/latest/UserGuide/routing-and-bgp.html
• AWS CLI reference, create-direct-connect-gateway (default Amazon-side ASN 64512): https://docs.aws.amazon.com/cli/latest/reference/directconnect/create-direct-connect-gateway.html
• Azure ExpressRoute routing requirements: https://learn.microsoft.com/en-us/azure/expressroute/expressroute-routing
• Google Cloud Router ASN requirements: https://docs.cloud.google.com/network-connectivity/docs/router/how-to/creating-routers
• dn42 Getting Started guide: https://dn42.dev/howto/Getting-Started