Troubleshooting
The following topics are useful for troubleshooting BYOIP issues.
Routers receive IP packets and forward the packets to the destination IP address. Unicast Reverse Path Forwarding (uRPF) is a security feature that can prevent spoofing attacks. uRPF operates under two modes: strict and loose mode.
Under strict mode, the router performs two checks on incoming packets to look for a matching entry in the source routing table and to determine whether the interface that received the packet can be used to reach the source. If the incoming IP packets pass both checks, the packets are forwarded; if the checks do not pass, the packets are dropped.
When uRPF is set to loose mode, the router performs a single check when it receives an IP packet to look for a source's matching entry in the routing table.
If you are experiencing packet loss as a result of an upstream ISP implementing uRPF filtering, contact your ISP and request the link be set to loose mode.
Currently, BYOIP cannot be used with legacy custom certificates to support non-SNI requests.
Instead, you can use Address Maps to set a default SNI for IPs on your account or zone. Refer to Setup for further guidance.
When onboarding BYOIP prefixes via the API, you may encounter the following errors:
| Error code | Meaning | Resolution |
|---|---|---|
prefix_not_valid_and_approved | The prefix has not passed IRR validation, RPKI validation, and ownership verification (or manual approval). | Verify all three validation steps have completed. If one or more are failing, check prefix registration with your Regional Internet Registry (RIR) and your RPKI ROA configuration. If validation is passing but you are still seeing this error, contact support for manual approval. |
incomplete_bgp_deployment | Cannot create a BGP prefix without a default edge service binding configured. | Configure a default edge service binding before creating BGP prefixes. |
advertise_state_locked | Cannot create a BGP prefix — the default edge service binding is still deploying. | Wait for the edge service binding deployment to complete, then retry. |