Binding, unbinding, and moving public address ranges

BYOIP for IPv4 and Public IPv6 address ranges are beta features that are available for evaluation and testing purposes to select customers. Access is restricted to allowlisted accounts.

You can bind, unbind, and move public address ranges to a VPC in an availability zone with the console, CLI, API, and Terraform.IPv6 Beta IPv6 public address ranges bind to a virtual network interface (VNI). For IPv6 binding instructions, see Creating IPv6 public address ranges and binding to a VNI.

Before you begin

Review the following requirements and considerations before binding, unbinding, or moving a public address range:

  • Make sure to review planning considerations for public address ranges.
  • The binding of a public address range must include both a VPC and an availability zone.IPv6 Beta For IPv6 public address ranges, the binding target is a VNI, not a VPC. The VNI must be in the same zone as the authorized CIDR the range was allocated from.
  • When using a public address range, you must configure ingress routing after binding the address range to direct traffic to the appropriate resource. Binding the address range to a VPC does not automatically route traffic to the resource.IPv6 Beta IPv6 public address ranges do not require ingress routing. Traffic routes to the VNI automatically after binding.

Binding, unbinding, and moving public address ranges in the console

You can bind, unbind, and move a public address range to a VPC in an availability zone in the console.

IPv6 BetaIPv6 public address ranges are bound to a VNI instead of a VPC. The Bind public address range and Edit public address range panels differ for IPv6, and the button is Attach. For the console steps, see Binding an IPv6 public address range to a VNI.

Binding a public address range in the console

To bind a public address range in the IBM Cloud® console, follow these steps:

  1. From the IBM Cloud console, select the Navigation menu Menu icon, then click Infrastructure VPC icon > Network > Public address ranges. The Public address ranges for VPC page is displayed.
  2. Highlight the row of the address range in the table, then click Bind from the Actions menu Actions icon.
  3. From the Bind public address range page, select the VPC and its corresponding availability zone where you want to bind the address range.
  4. Click Bind to bind the public address range to the VPC.

Unbinding a public address range in the console

To unbind a public address range in the IBM Cloud console, follow these steps:

After a public address is unbound, it is still reserved and available to be bound again.

  1. From the IBM Cloud console, select the Navigation menu Menu icon, then click Infrastructure VPC icon > Network > Public address ranges. The Public address ranges for VPC page is displayed.
  2. Highlight the row of the address range in the table, then click Unbind from the Actions menu Actions icon.
  3. Click Unbind to confirm that you want to unbind this address range from the VPC.

Moving a public address range in the console

If the public address range is bound to a VPC in an availability zone, you can update and bind (move) it to a different VPC and availability zone. The public address range is automatically unbound from its VPC and availability zone and then bound to the newly specified VPC and availability zone.

You don't need to unbind the address range from its original target first.

To move a public address range in the console, follow these steps:

  1. From the IBM Cloud console, select the Navigation menu Menu icon, then click Infrastructure VPC icon > Network > Public address ranges. The Public address ranges for VPC page is displayed.
  2. Highlight the row of the address range in the table, then click Edit from the Actions menu Actions icon.
  3. From the Edit public address range page, select the VPC and its availability zone where you want to move the address range.
  4. Click Save to bind the public address range to the new VPC.

Binding, unbinding, and moving public address ranges from the CLI

To bind, unbind, or move a reserved IP address from the command line, follow these steps:

  1. Set up your CLI environment.

  2. Log in to your CLI environments. After you enter the password, the system prompts which account and region that you want to use:

    ibmcloud login --sso

  3. Run the following command:

    ibmcloud is public-address-range-update PUBLIC_ADDRESS_RANGE [--name NAME] ([--vpc VPC --zone ZONE] | [--reset-target]) [--output JSON] [-q, --quiet]

    IPv6 Beta

    ibmcloud is public-address-range-update PUBLIC_ADDRESS_RANGE [--name NAME] [--reset-target | --vni VNI | [--vpc VPC] [--zone ZONE]] [--output JSON] [-q, --quiet]

    Where:

    PUBLIC_ADDRESS_RANGE
    The ID or name of the public address range to update.
    --name
    A new identifier for the public address range, if you want to rename it.
    --vpc
    The VPC you want to attach the public address range to. When specifying the --vpc option, --zone is required.IPv6 Beta Not valid for IPv6 public address ranges. Use --vni instead.
    --zone
    The zone where you want this public address range to reside. When specifying the --zone option, --vpc is required.IPv6 Beta Not valid for IPv6 public address ranges.

    IPv6 Beta --vni : The ID or name of the virtual network interface to bind this public address range to. Mutually exclusive with --vpc, --zone, and --reset-target.

    --reset-target
    Unbind a public address range.
    --output
    The output format, only JSON is supported. One of: JSON.
    -q, --quiet
    Suppress verbose output.

Command examples

If a public address is not bound to a VPC, you can bind it to a VPC in any availability zone:

ibmcloud is public-address-range-update r006-81222eee-b3e0-4dc3-b429-aee9e5c0abf2 --name public-address-range-1 --vpc cli-test-vpc --zone us-south-1

Unbind a public address range from a VPC and leave it unbound:

ibmcloud is public-address-range-update r006-81222eee-b3e0-4dc3-b429-aee9e5c0abf2 --name public-address-range-1 --reset-target

Move a public address range from one VPC to another:

ibmcloud is public-address-range-update r006-81222eee-b3e0-4dc3-b429-aee9e5c0abf2 --vpc cli-test-vpc --zone us-south-2

IPv6 BetaBind an IPv6 public address range to a VNI:

ibmcloud is public-address-range-update r006-81222eee-b3e0-4dc3-b429-aee9e5c0abf2 --vni 02h7-c26bbb47-fd16-4d4b-bb3a-f620f592b84c

Move an IPv6 public address range to a different VNI (in the same zone):

ibmcloud is public-address-range-update r006-81222eee-b3e0-4dc3-b429-aee9e5c0abf2 --vni 03h7-c26bbb47-fd16-4d4b-bb3a-f620f592b84c

Binding, unbinding, and moving public address ranges with the API

To bind, unbind, or move public address ranges with the API, follow these steps:

  1. Set up your API environment.

  2. Store the following values in variables to be used in the API command:

    version (string): The API version, in format YYYY-MM-DD.

  3. When all variables are initiated, select one of the following actions:

    • Bind a public address range to a specific VPC:

        curl -X PATCH \
         "$vpc_api_endpoint/v1/public_address_ranges/$par_id?version=$api_version&generation=2" \
         -H "Authorization: Bearer $iam_token" \
         -H "Content-Type: application/json" \
         -d '{
               "target": {
                  "vpc": {
                     "id": "r006-4727d842-f94f-4a2d-824a-9bc9b02c523b"
                  },
                  "zone": {
                     "name": "us-south-2"
                  }
               }
            }'

    IPv6 Beta

    • Bind an IPv6 public address range to a VNI:

        curl -X PATCH \
         "$vpc_api_endpoint/v1/public_address_ranges/$par_id?version=$api_version&generation=2" \
         -H "Authorization: Bearer $iam_token" \
         -H "Content-Type: application/json" \
         -d '{
               "target": {
                  "virtual_network_interface": {
                     "id": "'$vni_id'"
                  }
               }
            }'

    • Unbind a public address range from a specific VPC:

         curl -X PATCH \
         "$vpc_api_endpoint/v1/public_address_ranges/$par_id?version=$api_version&generation=2" \
         -H "Authorization: Bearer $iam_token" \
         -H "Content-Type: application/json" \
         -d '{
               "target": null
            }'

      After a public address is unbound, it is still reserved and can be bound again.

    • Move a public address range from one VPC to another:

         curl -X PATCH \
         "$vpc_api_endpoint/v1/public_address_ranges/$par_id?version=$api_version&generation=2" \
         -H "Authorization: Bearer $iam_token" \
         -H "Content-Type: application/json" \
         -d '{
               "target": {
                  "vpc": {
                     "id": "r006-9999aaaa-bbbb-cccc-dddd-1234567890ab"
                  },
                  "zone": {
                     "name": "us-south-3"
                  }
               }
            }'

Binding, unbinding, and moving public address ranges with Terraform

To bind, unbind, or move a public address range with Terraform, use the following example:

resource "ibm_is_public_address_range" "public_address_range_instance" {
	ipv4_address_count = "16"
  name = "example-public-address-range"
  resource_group{
      id = "11caaa983d9c4beb82690daab08717e9"
  }
  target{
    vpc {
      id = ibm_is_vpc.testacc_vpc.id
    }
    zone {
      name = "us-south-3"
    }
  }
}

IPv6 BetaTo bind an IPv6 public address range to a VNI, use virtual_network_interface in the target block:

resource "ibm_is_public_address_range" "ipv6_bind_example" {
  name                  = "my-ipv6-par"
  network_prefix_length = 112
  authorized_cidr {
    id = ibm_is_public_address_range_authorized_cidr.example.id
  }
  target {
    virtual_network_interface {
      id = ibm_is_virtual_network_interface.example.id
    }
  }
}

Next steps