Private ASN Ranges vs Your Own Public ASN: The Complete Guide

What is a private ASN? A private ASN is an Autonomous System number reserved for internal use only, taken from two ranges defined by RFC 6996: 64512 to 65534 for 16-bit numbers, and 4200000000 to 4294967294 for 32-bit numbers. You can use one for free, right now, with no registration. The catch is absolute: a private ASN must never appear in a route advertised to the global internet, and upstream providers strip or reject it. If you route entirely inside your own network or a cloud VPN, a private ASN is correct. The moment you want to announce your own IP space to two real internet peers, you need a public ASN instead.

The phrase "private ASN" hides two very different questions. Some people are asking about the reserved number ranges you can grab for a lab or an internal fabric. Others really mean "can I, as an individual, get my own AS number without running a company?" This guide answers both, with the exact ranges, the hard limits, a decision table, and honest pricing for the public path.

What are the private ASN ranges?

IANA reserves two blocks of AS numbers for private use, and both are documented in RFC 6996, "Autonomous System (AS) Reservation for Private Use." These numbers work exactly like public ASNs inside BGP, but they carry no global uniqueness, so two different networks anywhere in the world can use the same private ASN at the same time without conflict.

A few numbers sit just outside these windows and are reserved for other purposes. AS 65535 and AS 4294967295 are reserved values, not private-use numbers, and the older documentation-only ASNs live elsewhere. For practical work, treat 64512-65534 and 4200000000-4294967294 as your private pools.

If you only need a handful of AS numbers for lab segments, the 16-bit range is plenty and easier to read. If you are building a large fabric where every leaf or every rack gets its own ASN, the 32-bit range gives you almost 95 million to spend, so you never have to recycle numbers.

What are private ASNs actually used for?

Private ASNs solve a real problem: you often need BGP semantics inside a network without wanting, or being allowed, to touch the public routing table. Here is where they show up every day.

Internal BGP and data-center fabrics. Modern leaf-and-spine data centers frequently run eBGP between every switch, and each device gets a private ASN. Automation tools assign these from the 32-bit range because there are enough numbers to give every switch a unique one. This is standard practice in large fabrics and needs no registration.

Cloud hybrid connectivity. When you connect on-premises networks to a cloud provider over a private link, private ASNs are the default on both ends. A few concrete examples:

• AWS Direct Connect uses 64512 as the default Amazon-side ASN for the Direct Connect gateway if you do not choose your own. A private ASN on your side is the common, default choice, though AWS does also permit a public ASN (it verifies your ownership of a public ASN before accepting it).
• Azure ExpressRoute uses Microsoft's public AS 12076 on its own edge routers, but the default ASN on an Azure VPN gateway is 65515, a private number, and Microsoft reserves 65515 to 65520 for internal use.
• Google Cloud, Oracle Cloud, and most VPN gateways behave the same way: private ASN on your side, provider ASN on theirs.

Labs, study, and certification prep. If you are learning BGP for a CCNP, JNCIP, or just building a home lab, private ASNs let you run realistic topologies with zero paperwork and zero cost.

Overlay and community networks. dn42 is a large decentralized network run by hobbyists that is explicitly not the public internet. dn42 participants self-allocate from a sub-range of the private 32-bit space, 4242420000 to 4242423999, and connect to each other over tunnels. It is a fantastic place to practice BGP with real peers, but nothing you announce there reaches the global routing table.

Why can a private ASN never touch the public internet?

This is the single most important limit to understand, and it is not a soft convention. RFC 6996 states that private-use ASNs must be removed from AS path attributes before a route is advertised to the global internet. Because these numbers are not globally unique, leaking one would create ambiguity: your prefix and someone else's could both claim to originate from AS 65001, and the internet has no way to tell them apart.

In practice, three things happen if you try to announce space using a private ASN to a real transit provider:

1. Your upstream's routers are configured to strip private ASNs from the path, or
2. Your upstream rejects the announcement outright with a route filter, or
3. If a leak somehow escaped, you would see intermittent, unexplained loss of connectivity as different networks disagreed about the origin.

The rule is simple. If a packet needs to reach a destination on the public internet through your own AS, and you want to control that routing with BGP, a private ASN cannot do the job. That is where a public ASN comes in.

When do you actually need your own public ASN?

You need a public, globally unique ASN when all three of these are true:

• You want to announce your own IP prefixes (IPv4 or IPv6) to the internet under your own routing policy.
• You connect to more than one provider or peer, so your traffic is not simply following your single ISP's routing (this is called being multihomed).
• You need that policy to be visible and stable in the global routing table.

RIPE policy, documented in ripe-679, sets two requirements: a network must be multihomed to qualify for an AS number, and its routing policy must be provided when the number is requested. You describe that policy when you request the number. The goal is to keep the global routing table from filling with AS numbers that add no new routing behavior.

Common scenarios that genuinely require a public ASN:

• Running BGP with two or more transit providers for redundancy.
• Announcing provider-independent (PI) space you hold yourself.
• Building anycast so the same prefix is served from multiple locations.
• Peering at an internet exchange under your own identity.

If your setup is a single home connection behind one ISP and you just want to "have an ASN," a public ASN will not do anything for you, because you have no second peer and no independent routing policy to express. That is exactly the case where people should use dn42 or a lab instead. To go deeper on the distinction between holding your own resources and using a provider's, see PI vs PA resources.

Private ASN vs public ASN: which one by use case?

Can an individual get their own public ASN?

Yes. This surprises people, but you do not need a company, and you do not need to become a RIPE NCC member. A natural person can hold a real, globally unique AS number through a sponsoring LIR (Local Internet Registry). The sponsoring LIR has the contractual relationship with RIPE NCC and submits the request on your behalf, while the AS number is assigned directly to you as the end user.

What you do need to qualify:

• A routing policy that justifies the number. In practice this means you are multihomed (connecting to two or more peers or providers) or you have a genuinely unique routing policy that your upstreams cannot express for you.
• At least two peering or transit relationships, or a credible plan to establish them. This is what "multihomed" means in the request.
• A little documentation. You describe your intended peers and routing policy. If you want help getting this right, our guide on how to prepare an ASN justification walks through what reviewers look for, and the complete ASN registration guide covers the full process.

You do not need existing IP space to get an ASN, though most people pair the ASN with IPv6 space so they have something to announce.

What does a public ASN honestly cost?

Here is where a lot of pages get vague, so let us be specific. There are two cost components behind any sponsored ASN, and a transparent provider shows you both.

RIPE NCC itself charges the sponsoring LIR a fee per resource. Under the RIPE NCC Charging Scheme 2026, that is 50 EUR per year per sponsored ASN. The bigger numbers you sometimes read about, 1,800 EUR annual membership plus a 1,000 EUR one-time sign-up fee, apply only if you become a full RIPE NCC member and run your own LIR. Going through a sponsoring LIR means you never pay those. You pay the LIR's all-in price, and the LIR pays RIPE.

Our sponsored ASN is 130 EUR per year, all in. That covers the 80 EUR service fee plus the 50 EUR RIPE NCC per-ASN fee, with no separate setup charge. Individuals are welcome, not just companies. We keep a running ASN sponsorship price comparison so you can check what different providers charge and see how the all-in figures line up.

For a single ASN, and even for a small handful of resources, the sponsored route is dramatically cheaper than running your own LIR. Membership only starts to make sense at real scale.

What about IP space to go with your ASN?

An ASN on its own announces nothing. You need at least one prefix to originate. On IPv6, you have two clean options with us.

The straightforward one is an IPv6 sub-assignment (a /48) from our allocation, leasing from 40 EUR per year. Because it comes from our block, the RPKI ROAs are set up and managed by us and configured automatically when your ASN is assigned, so you get valid route origin authorization with zero configuration on your side. That is a genuine convenience: RPKI is one of the fiddlier parts of getting a new prefix accepted cleanly, and here it is handled.

If you specifically need provider-independent space that stays with you regardless of provider, we also offer IPv6 PI sponsorship. On IPv4, leasing starts from 0.50 EUR per IP per month, which is the practical way to get announceable v4 space today given how scarce it is.

Quick decision recap

Ask yourself one question: does anything I announce need to reach the public internet under my own routing policy, with more than one peer?

• No. Use a private ASN from 64512-65534 or 4200000000-4294967294. It is free, instant, and correct for labs, internal fabrics, cloud VPNs, and dn42.
• Yes. You need a public ASN. As an individual you can get one through a sponsoring LIR for 130 EUR per year all-in with us, no company and no RIPE membership required, as long as you are multihomed and can describe your routing policy.

The two are not competitors. They solve different problems. Reach for the private range when you are inside your own walls, and step up to a public ASN the day you want a seat at the global table.

Official References

• RFC 6996, Autonomous System (AS) Reservation for Private Use: https://www.rfc-editor.org/rfc/rfc6996.html
• IANA Autonomous System (AS) Numbers registry: https://www.iana.org/assignments/as-numbers/as-numbers.xhtml
• RIPE NCC Charging Scheme 2026 (ripe-848): https://www.ripe.net/publications/docs/ripe-848/
• RIPE Autonomous System (AS) Number Assignment Policies (ripe-679): https://www.ripe.net/publications/docs/ripe-679/
• AWS Direct Connect routing and BGP documentation: https://docs.aws.amazon.com/directconnect/latest/UserGuide/routing-and-bgp.html
• Azure ExpressRoute routing requirements: https://learn.microsoft.com/en-us/azure/expressroute/expressroute-routing
• dn42 Getting Started guide: https://dn42.dev/howto/Getting-Started

Facts checked July 2026.